Skip to content

Lost on the High Seas without a Safe Harbor or a Shield? Navigating Cross-Border Transfers in the Pharmaceutical Sector After Schrems II Invalidation of the EU-US Privacy Shield


Marcelo Corrales Compagnucci, Timo Minssen, Claudia Seitz, Mateo Aboy


This paper analyzes the impact and associated legal challenges of cross-border data transfers in the pharmaceutical sector after the recent Court of Justice of the European Union (CJEU) decision in Case C-311/18 Data Protection Commissioner v Facebook Ireland Limited, Maximillian Schrems (Schrems II). In Schrems II, the CJEU invalidated Decision 2016/1250 on the adequacy of the protection provided by the EU-US Privacy Shield Framework. That said, the Court also found that the European Commission Decision 2010/87 on standard contractual clauses (SCCs)
for the transfer of personal data to processors established in third countries is still valid. The ruling has resulted in significant uncertainty and liability risks for organizations that depend on EU-US cross-border transfers of personal data, including pharmaceutical companies (data controllers) engaged in global clinical trials and their technology providers for endpoint collection and data transfer (processors). In light of these challenges, this paper discusses the need for a legally sound regulatory environment for data transfer. To mitigate risks and uncertainties, we stress the need for updated GDPR-compliant SCCs and SCCs guidelines and argue, inter alia, for the adoption of data protection frameworks which incorporate SCCs with a robust information security management system (ISMS) and a privacy information management system (PIMS) to ensure an appropriate level of data protection, as well as for sector specific transfer mechanisms including health data adequacy decisions and the need for GDPR certification and codes of conduct for cross-border transfers of clinical trial data.

Marcelo Corrales Compagnucci, Assoc. Professor, Center for Advanced Studies in Biomedical Innovation Law (CeBIL), University of Copenhagen (UCPH); Timo Minssen, Professor of Law at the University of Copenhagen (UCPH), Founding Director of UCPH’s Center for Advanced Studies in Biomedical Innovation Law (CeBIL), Senior Consultant at X-officio; Claudia Seitz, Visiting Professor of Law at the University of Ghent, Faculty of Law and Criminology, Lecturer at the University of Basel, Faculty of Law, Center for Life Sciences Law (CLSL) and Lecturer at the University of Bonn, Faculty of Law, Centre for the Law of Life Sciences; Mateo Aboy, Principal Research Scholar at the LML (University of Cambridge, UK) and Affiliated Professor & Fellow at the CeBIL, University of Copenhagen (UCPH). This paper could consider developments until 17 October 2020. For correspondence: <>Acknowledgement: The research for this paper was supported by a Novo Nordisk Foundation grant for a scientifically independent Collaborative Research Program in Biomedical Innovation Law (grant agreement number NNF17SA0027784).


Lx-Number Search

(e.g. A | 000123 | 01)

Export Citation