---
title: "Case C-311/18: judgment of 16 July 2020"
canonical: "https://dposchool.com/gdpr/case/c-311-18"
source: "https://curia.europa.eu/juris/liste.jsf?num=C-311/18&language=en"
source_note: "Only the judgment as published by the Court of Justice is authoritative."
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en"
publisher: "DPO School"
---

Court of Justice judgment · Case C-311/18

# Data Protection Commissioner v Facebook Ireland Limited and Maximillian Schrems

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review)

- **Case:** C-311/18
- **Court:** Court of Justice
- **Date of judgment:** 16 July 2020
- **ECLI:** ECLI:EU:C:2020:559
- **Instrument:** Regulation (EU) 2016/679 (GDPR)
- **Provisions:** [Article 2](https://dposchool.com/gdpr/article/2), [Article 44](https://dposchool.com/gdpr/article/44), [Article 45](https://dposchool.com/gdpr/article/45), [Article 46(1)](https://dposchool.com/gdpr/article/46#1), [Article 46(2)(c)](https://dposchool.com/gdpr/article/46#2-c), [Article 58(2)(f)](https://dposchool.com/gdpr/article/58#2-f), [Article 58(2)(j)](https://dposchool.com/gdpr/article/58#2-j)

## Holding (summary, not the official text)

Transfers under standard contractual clauses require essentially equivalent protection, assessed case by case including access by foreign authorities; authorities must suspend or prohibit transfers that cannot be protected; the Commission's SCC decision stays valid; the EU-US Privacy Shield decision is invalid.

## Official source

- [Case C-311/18 on CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-311/18&language=en)
- [Judgment on EUR-Lex (CELEX 62018CJ0311)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62018CJ0311)

Checked against the official source on 28 October 2026.

Only the judgment as published by the Court of Justice is authoritative. This is reference material, not legal advice.

## Navigation

[GDPR Navigator](https://dposchool.com/gdpr) / [Judgments](https://dposchool.com/gdpr/cases) / C-311/18

[All judgments](https://dposchool.com/gdpr/cases)

Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/gdpr/llms.txt
- JSON API: https://dposchool.com/gdpr/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents