- In the Schrems judgment, the Court of Justice clarified that the Commission has no competence to restrict the powers that DPAs derives from Article 28 of Directive 95/46/EC (including the power to suspend data transfers) where a person, in bringing a claim under that provision, calls into question the compatibility of a Commission adequacy decision with the protection of the fundamental right to privacy and data protection[1].
- In order to effectively monitor the functioning of the Privacy Shield, the Commission should be informed by the Member States about relevant activities undertaken by DPAs.
- The Court of Justice furthermore considered that, in line with the second subparagraph of Article 25(6) of Directive 95/46/EC, Member States and their organs must take the measures necessary to comply with acts of the Union institutions, as the latter is in principle presumed to be lawful and accordingly produce legal effects until such time as they are withdrawn, annulled in an action for annulment or declared invalid following a reference for a preliminary ruling or a plea of illegality. Consequently, a Commission adequacy decision adopted pursuant to Article 25(6) of Directive 95/46/EC is binding on all organs of the Member States to which it is addressed, including their independent supervisory authorities[2]. Where such an authority has received a complaint putting in question the compliance of a Commission adequacy decision with the protection of the fundamental right to privacy and data protection and considers the objections advanced to be well founded, national law must provide it with a legal remedy to put those objections before a national court which, in case of doubts, must stay proceedings and make a reference for a preliminary ruling to the Court of Justice[3].
[1] Schrems, paragraphs 40 et seq., 101-103.
[2] Schrems, paragraphs 51, 52 and 62.
[3] Schrems, paragraph 65.
