In yet another case of esteemed colleague Mr. Schrems vs. Facebook, the Advocate General gave his opinion. Procedure-wise, this is a rather detailed document, effectively serving as a draft of the upcoming ECJ ruling. ECJ can divert from the opinion but tends not to do so.

From the subject matter point of view, the AG analyzed the usability of Standard Contractual Clauses within the meaning of the Commission decision 2010/87/EU and came to the conclusion that they indeed can be further used. At the same time, the AG added that the data controller (!) must ensure the effective enforceability of the SCCs in the respective importing country. If the SCCs are effectively not enforceable, as is the case in the USA given the rather broad access of the state/federal authorities to the data, the SCCs cannot be used. The export of personal data to the USA remains in the grey zone and constitutes a compliance risk.

We will keep you updated re further developments.