203
Since these proceedings are, for the parties to the main proceedings, a step in the action pending
before the national court, the decision on costs is a matter for that court. Costs incurred in submitting
observations to the Court, other than the costs of those parties, are not recoverable.
On those grounds, the Court (Grand Chamber) hereby rules:
1.
Article 2(1) and (2) of Regulation (EU) 2016/679 of the European Parliament and of the
Council of 27 April 2016 on the protection of natural persons with regard to the processing
of personal data and on the free movement of such data, and repealing Directive 95/46/EC
(General Data Protection Regulation), must be interpreted as meaning that that regulation
applies to the transfer of personal data for commercial purposes by an economic operator
established in a Member State to another economic operator established in a third country,
irrespective of whether, at the time of that transfer or thereafter, that data is liable to be
processed by the authorities of the third country in question for the purposes of public
security, defence and State security.
2.
Article 46(1) and Article 46(2)(c) of Regulation 2016/679 must be interpreted as meaning
that the appropriate safeguards, enforceable rights and effective legal remedies required by
those provisions must ensure that data subjects whose personal data are transferred to a
third country pursuant to standard data protection clauses are afforded a level of
protection essentially equivalent to that guaranteed within the European Union by that
regulation, read in the light of the Charter of Fundamental Rights of the European Union.
To that end, the assessment of the level of protection afforded in the context of such a
transfer must, in particular, take into consideration both the contractual clauses agreed
between the controller or processor established in the European Union and the recipient of
the transfer established in the third country concerned and, as regards any access by the
public authorities of that third country to the personal data transferred, the relevant
aspects of the legal system of that third country, in particular those set out, in a nonexhaustive manner, in Article 45(2) of that regulation.
3.
Article 58(2)(f) and (j) of Regulation 2016/679 must be interpreted as meaning that, unless
there is a valid European Commission adequacy decision, the competent supervisory
authority is required to suspend or prohibit a transfer of data to a third country pursuant
to standard data protection clauses adopted by the Commission, if, in the view of that
supervisory authority and in the light of all the circumstances of that transfer, those clauses
are not or cannot be complied with in that third country and the protection of the data
transferred that is required by EU law, in particular by Articles 45 and 46 of that
regulation and by the Charter of Fundamental Rights, cannot be ensured by other means,
where the controller or a processor has not itself suspended or put an end to the transfer.
4.
Examination of Commission Decision 2010/87/EU of 5 February 2010 on standard
contractual clauses for the transfer of personal data to processors established in third
countries under Directive 95/46/EU of the European Parliament and of the Council, as
amended by Commission Implementing Decision (EU) 2016/2297 of 16 December 2016 in
the light of Articles 7, 8 and 47 of the Charter of Fundamental Rights has disclosed nothing
to affect the validity of that decision.
5.
Commission Implementing Decision (EU) 2016/1250 of 12 July 2016 pursuant to Directive
95/46/EC of the European Parliament and of the Council on the adequacy of the protection
provided by the EU-US Privacy Shield is invalid.
Lenaerts
Silva de Lapuerta
Prechal
Vilaras
Arabadjiev
Safjan