The European Court of Justice has on 6 October 2015 handed down a decision (Schrems, case C-362/04) holding that transfers of personal data from the EU to the US can no longer take place under the Safe Harbour framework. The framework has widely been relied on as the legal basis for EU-US data transfers, but after the ECJ’s ruling, this will no longer be an option.
8.10.2015
Safe Harbour No Longer – Major ECJ Decision on EU-US Data Transfers
Eija Warma-Lehtinen
The decision directly affects all European companies that have been transferring personal data to Safe Harbour-certified counterparts in the US. The decision will require prompt action by these companies.
The Court’s ruling stems from a complaint filed by Austrian Maximilian Schrems with the Irish Data Protection Commissioner, concerning Facebook’s transfer of his data to the US. Mr Schrems argued that – despite the Safe Harbour framework – the US can no longer be considered to offer an ‘adequate’ level of protection for personal data. Schrem’s claim was made in light of the large-scale surveillance activities of US National Security Agency NSA that were revealed by Edward Snowden.
Despite the Irish Data Protection Commissioner first rejecting Schrems’ claim, the European Court of Justice ultimately agreed with him and invalidated the EU Commission’s decision to authorise data transfers to the US under the Safe Harbour framework.
Under EU and Finnish data protection law, personal data can be transferred out of the EU/EEA only if the destination country provides an ‘adequate’ level of data protection or if other safeguards are met. While the US as a whole has never met the EU’s adequacy requirement, the EU Commission has authorised data transfers to individual companies that have undertaken to comply with the Safe Harbour rules, as these companies have been considered to offer adequate protection.
After the Schrems decision, even Safe Harbour-certified companies are no longer regarded as offering adequate protection for EU citizens’ personal data. An EU company wanting to transfer data to a US company will have to rely on complying with other safeguards in order to justify its US data transfers.
Generally speaking, an EU company can continue to transfer data to the US, despite the Schrems ruling, provided that the company complies with one of the other available safeguard mechanisms:
Additionally, personal data may be transferred to the US where the relevant person gives his or her unambiguous consent to the transfer. However,e.g. when a company outsources IT systems, obtaining consent from all affected employees and customers can be difficult. There are also other safeguard mechanisms available, but they are rarely used by companies due to being impractical.
After Schrems, it will in principle be up to national data protection supervisors to decide on a case-by-case basis whether a data transfer meets all the relevant requirements (unlike Safe Harbour, which was an EU-level authorisation binding on the national supervisors). Nevertheless, the ‘Article 29 Working Party’ (WP29) – a co-operation body for the national EU data protection supervisors – has announced that it will issue uniform guidance for how to comply with the post-Schrems rules later this week. The Finnish Data Protection Ombudsman is expected to issue his own statement after the WP29 guidelines are issued.
We strongly advise companies to review their existing agreements and data transfer arrangements. If the company has relied on the Safe Harbour framework, it must carefully consider how best to comply with the new rules. Companies should also note that even if their direct contract is with a local company, that local company may transfer data onwards to the US. Companies remain fully liable for such transfers, even if they take place further down the subcontracting chain.
Latest news
Latest references
Fortum – AI workshop
We delivered two AI workshops for Fortum Corporation’s Mergers and Acquisitions team, with both legal and business professionals participating. The sessions combined fundamental AI principles with custom use cases for commercially available AI tools tailored to Fortum’s needs. We also presented a bespoke solution merging AI with a script-based tool developed by our Legal Tech team, enabling a more automated way of working. Our experts conducted the training drawing on their legal background and leading experience in this emerging field of legal technology. Participants particularly appreciated the clarity and relevance of the implementations demonstrated. ‘C&S delivered an excellent, well-structured series of workshops, with directly applicable takeaways,’ says Sabina Hautaviita, Legal Counsel for M&A at Fortum.
Case published 9.3.2026
VR – Supreme Court decision clarifies working time practices
We successfully represented VR Group before the Supreme Court in a case concerning the meal break practice of commuter train drivers. On 6 February 2026, the Supreme Court ruled in VR’s favour (decision KKO:2026:12), confirming that VR had the right to amend the commuter train drivers’ meal break practice in 2021 by rendering the break unpaid in accordance with the applicable collective agreement. This decision clarifies the interpretation of collective agreements and employment legislation as well as the limits of the employer’s right to direct work. Over 250 commuter train drivers challenged the unpaid meal break practice which VR introduced in April 2021. Before the change, meal breaks had a long history of being paid. The change was based on the train drivers’ collective agreement, which allows for meal breaks to be organised either as paid or unpaid time. The Supreme Court ruled that the scheduling and managing of breaks falls within the core area of the employer’s right to direct work. This increases the threshold for an established practice becoming a binding condition for the parties. Merely following a practice consistently and over a long period of time does not make the practice binding; instead, the employer’s intent to commit to the practice must be clearly evident from the employer’s conduct or other circumstances. As both alternatives – paid and unpaid – for organising meal breaks had been retained in the collective agreement despite other amendments over the years, it could not be considered that VR had intended to commit to the paid break practice and waive its right to direct work as regards break scheduling. It was also significant that the employment contracts explicitly referred only to the collective agreement as regards working time. The Supreme Court deemed that the employees’ paid meal break was not an established term of employment and that VR was entitled to change the practice based on the collective agreement. The employer had the right, by virtue of its right to direct work, to unilaterally change the meal break practice by choosing to apply the other arrangement permitted by the collective agreement.
Case published 3.3.2026
CapMan Growth – Investment in Kuntokeskus Liikku
We are assisting CapMan Growth in its significant investment in Kuntokeskus Liikku, a Finnish gym chain known for its high-quality self-service facilities and excellent value for money. The investment will further strengthen Liikku’s position as a market leader and support the continued execution of its growth strategy. Liikku is one of Finland’s leading fitness chains, with more than 70 locations across the country serving nearly 90,000 members. The company’s concept is to offer high-quality self-service gyms at an exceptionally competitive price point which, combined with strong operational efficiency, provides a solid foundation for profitable growth. The company’s main shareholder is COR Group, a long-time partner of CapMan Growth, and a Finnish health and wellness conglomerate known for active ownership and long-term value creation. CapMan Growth is a leading Finnish growth investor that makes significant investments in entrepreneur-led growth companies with a turnover of €10–200 million. CapMan Growth is part of CapMan, which is a leading Nordic private equity investor engaged in active value creation work. CapMan has been listed on the Helsinki Stock Exchange since 2001.
Case published 27.2.2026
Terrafame – Environmental and water management permit processes concerning the company’s entire operations and the KL1 side rock area
Castrén & Snellman successfully assisted Terrafame Ltd in environmental and water management permit processes concerning the company’s entire operations and the KL1 side rock area, on which the Supreme Administrative Court issued its decision on 12 February 2026 (KHO 366/2026 and 367/2026). The changes made to the decisions of the Vaasa Administrative Court as a result of Terrafame’s appeals, enable the company to implement its new strategy and develop its operations as planned. The decisions of the Supreme Administrative Court brought the nearly ten-year-long permit process to a close.
Case published 20.2.2026