Explaining the Schrems II Ruling and Its Implications
Premise: In 2015, the Court of Justice of the European Union (CJEU) ruled that the 2000 Safe Harbor framework, a privacy mechanism for sharing personal data for organizations between the United States and the European Union, was invalid [1]. Based on an initial 2013 complaint made by Maximilian Schrems, an Austrian privacy advocate, the ruling, known as “Schrems I,” filed soon after the Edward Snowden revelations [2]. In his complaint, Schrems argued [3] that U.S. companies did not sufficiently protect personal data for it to be securely shared by European users, and were subsequently violating the Safe Harbor requirements.
One of the most notable features of the new California Consumer Privacy Rights Act (CPRA) and the proposed Virginia Consumer Data Protection Action (VCDPA) which has now passed both.