Der Generalanwalt des EuGH (Attorney General, AG; Henrik Saugmandsgaard Øe) hält die von der EU-Kommission für die Datenübermittlung in Drittstaaten beschlossenen Standardvertragsklauseln für wirksam. Seine Empfehlung ist hier auf englisch abrufbar.
Schrems hatte vor dem vorlegenden Gericht, dem irischen High Court, wie folgt argumentiert:
In his reformulated complaint, Mr Schrems claims, first, that the clauses in that agreement [Grundlage der Datenübermittlung innerhalb der Facebook-Gruppe in die USA] are not consistent with the standard contractual clauses set out in Decision 2010/87 and, secondly, that those standard contractual clauses could not in any event justify the transfer of the personal data relating to him to the United States. Mr Schrems claims that there is no remedy that would allow the persons concerned to invoke, in the United States, their rights to respect for private life and to protection of personal data.
Der AG hält mit Bezug auf die Wirksamkeit bzw. Gültigkeit der Standardvertragsklauseln zwar zunächst fest, dass die Standardvertragsklauseln als Vereinbarung inter partes die Behörden des Empfängerstaats nicht binden und dessen Recht Pflichten vorsehen kann, die den Anforderungen der Standardvertragsklauseln zuwiderlaufen:
125. In that regard, as, in essence, the DPC, Mr Schrems, the BSA, Ireland, the Austrian, French, Polish and Portuguese Governments and the Commission have submitted, the safeguards in the standard contractual clauses may be reduced, or indeed eliminated, when the law of the third country of destination imposes obligations that are contrary to the requirements of those clauses on the importer. Thus, the prevailing legal context in the third country of destination may, depending on the actual circumstances of the transfer, (48) make the obligations set out in those clauses impossible to implement.
Dies führe aber nicht zur Unwirksamkeit der Standardvertragsklauseln. Denn diese verlangen vom Datenexporteur, die Übermittlung einzustellen, wenn der Empfänger seine Pflichten Verletzt oder nicht einhalten kann:
132. To my mind, and as Mr Schrems and the Commission have maintained, Clause 5(a) cannot be interpreted as meaning that suspension of the transfer or termination of the contract is merely optional where the importer cannot comply with the standard clauses. Although that clause refers only to a right in that sense for the benefit of the exporter, that wording must be understood by reference to the contractual framework of which it forms part. The fact that the exporter is given a right, in its bilateral relations with the importer, to suspend the transfer or terminate the contract where the importer is unable to honour the standard clauses is without prejudice to the obligation placed on the exporter to do so in the light of the requirements to protect the rights of the persons concerned arising under the GDPR. Any other interpretation would render Decision 2010/87 invalid in that the standard contractual clauses which it sets out would not permit the transfer to be accompanied by ‘appropriate safeguards’ as required by Article 46(1) of the GDPR, read in the light of the provisions of the Charter. (50)
133. In addition, according to Clause 5(b) the importer is to certify that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the exporter and its obligations under the contract. In the event of a change in that legislation that is likely to have a substantial adverse effect on the warranties and obligations provided by the standard clauses, the importer will promptly notify that change to the exporter, in which case the exporter is entitled to suspend the transfer of data and/or terminate the contract. In accordance with Clause 4(g), the exporter must forward the notification received from the importer to the competent supervisory authority if it decides to continue the transfer.
Überdies seien die Aufsichtsbehörden verpflichtet – und nicht nur berechtigt –, die Unterlassung oder Einstellung der Übermittlung anzuordnen, wenn der Exporteur seiner diesbezüglichen Pflicht nicht nachkommt:
146. Thus, a supervisory authority must examine with all due diligence the complaint lodged by a person whose data are alleged to be transferred to a third country in breach of the standard contractual clauses applicable to the transfer. (56) Article 58(1) of the GDPR confers on the supervisory authorities, for that purpose, significant investigative powers.
147. The competent supervisory authority is also required to react appropriately to any infringements of the rights of the data subject which it has established following its investigation. In that regard, each supervisory authority has, under Article 58(2) of the GDPR, a wide range of means — the various powers to adopt corrective measures listed in that provision — of carrying out the task entrusted to it. […] 148. Although the choice of the most effective means is a matter for the discretion of the competent supervisory authority having regard to all the circumstances of the transfer at issue, that authority is required to carry out in full the supervisory task entrusted to it. Where appropriate, it must suspend the transfer if it concludes that the standard contractual clauses are not being complied with and that appropriate protection of the data transferred cannot be ensured by other means, where the exporter has not itself put an end to the transfer.
Der EuGH ist an die Meinung des AG allerdings nicht gebunden.