[{"data":1,"prerenderedAt":357},["ShallowReactive",2],{"navigation-docs_en":3,"/en/blog/schrems-iii-cjeu-ruling-posts_en":51,"/en/blog/schrems-iii-cjeu-ruling-surround-posts_en":351},[4],{"title":5,"path":6,"stem":7,"children":8,"page":25},"En","/en","en",[9],{"title":10,"path":11,"stem":12,"children":13,"page":25},"Docs","/en/docs","en/1.docs",[14,26],{"title":15,"path":16,"stem":17,"children":18,"icon":25},"Getting Started","/en/docs/getting-started","en/1.docs/1.getting-started/1.index",[19,21],{"title":20,"path":16,"stem":17,"children":-1},"Introduction",{"title":22,"path":23,"stem":24,"children":-1},"Migration Roadmap","/en/docs/getting-started/migration-fahrplan","en/1.docs/1.getting-started/2.migration-fahrplan",false,{"title":27,"path":28,"stem":29,"children":30,"page":25},"Technologies","/en/docs/technologies","en/1.docs/2.technologies",[31,35,39,43,47],{"title":32,"path":33,"stem":34,"children":-1},"Nextcloud","/en/docs/technologies/nextcloud","en/1.docs/2.technologies/1.nextcloud",{"title":36,"path":37,"stem":38,"children":-1},"Matrix / Element","/en/docs/technologies/matrix","en/1.docs/2.technologies/2.matrix",{"title":40,"path":41,"stem":42,"children":-1},"ONLYOFFICE","/en/docs/technologies/onlyoffice","en/1.docs/2.technologies/3.onlyoffice",{"title":44,"path":45,"stem":46,"children":-1},"Ubuntu Linux","/en/docs/technologies/ubuntu","en/1.docs/2.technologies/4.ubuntu",{"title":48,"path":49,"stem":50,"children":-1},"Keycloak","/en/docs/technologies/keycloak","en/1.docs/2.technologies/5.keycloak",{"id":52,"title":53,"authors":54,"badge":60,"body":62,"date":339,"description":340,"extension":341,"faq":342,"howto":342,"image":343,"meta":345,"navigation":346,"path":347,"seo":348,"stem":349,"__hash__":350},"posts_en/en/3.blog/9.schrems-iii-cjeu-ruling.md","Sending Data to the US – What the Schrems Rulings Mean",[55],{"name":56,"to":57,"avatar":58},"Michael Wolf","https://snowblue.de/about",{"src":59},"/michael.webp",{"label":61},"Data Protection",{"type":63,"value":64,"toc":328},"minimark",[65,69,78,83,86,136,139,143,146,159,162,166,169,230,239,243,270,274,300,304,307,310,314,321],[66,67,53],"h1",{"id":68},"sending-data-to-the-us-what-the-schrems-rulings-mean",[70,71,72,73,77],"p",{},"When people talk about data protection and cloud services, the name ",[74,75,76],"strong",{},"Schrems"," often comes up. It refers to the Austrian lawyer Max Schrems, whose cases before the Court of Justice of the European Union (CJEU) clarified important questions about transferring data to the US. Here's a relaxed explanation of what it's about – and what it means for your day-to-day.",[79,80,82],"h2",{"id":81},"what-is-it-about","What is it about?",[70,84,85],{},"The GDPR allows personal data to be transferred to countries outside the EU if there's a comparable level of protection there or other safeguards have been agreed. For the US, there have been different arrangements over the years:",[87,88,89,102],"table",{},[90,91,92],"thead",{},[93,94,95,99],"tr",{},[96,97,98],"th",{},"Arrangement",[96,100,101],{},"What happened",[103,104,105,116,126],"tbody",{},[93,106,107,113],{},[108,109,110],"td",{},[74,111,112],{},"Safe Harbor",[108,114,115],{},"Declared invalid by the CJEU in 2015 (\"Schrems I\")",[93,117,118,123],{},[108,119,120],{},[74,121,122],{},"Privacy Shield",[108,124,125],{},"Declared invalid by the CJEU in 2020 (\"Schrems II\")",[93,127,128,133],{},[108,129,130],{},[74,131,132],{},"EU-U.S. Data Privacy Framework",[108,134,135],{},"The current basis since 2023",[70,137,138],{},"There are still legal discussions about the current Data Privacy Framework. Nobody can say for sure today how things will develop in the long run.",[79,140,142],{"id":141},"what-does-this-mean-in-practice","What does this mean in practice?",[70,144,145],{},"For most small businesses, law firms and practices, it mainly means: document things well and keep an overview. A few typical questions:",[147,148,149,153,156],"ul",{},[150,151,152],"li",{},"Which services do I use whose providers are based outside the EU?",[150,154,155],{},"Which personal data ends up there?",[150,157,158],{},"What does the data processing agreement (DPA) say?",[70,160,161],{},"That's not rocket science – it's simply part of proper data protection documentation. For legal assessments, your data protection adviser or a lawyer is the right contact.",[79,163,165],{"id":164},"the-relaxed-alternative-data-in-europe","The relaxed alternative: data in Europe",[70,167,168],{},"Many people would rather not have to think about it so much. A simple solution is to run your most important services with open source on servers in Europe. Then your data stays where you want it.",[87,170,171,181],{},[90,172,173],{},[93,174,175,178],{},[96,176,177],{},"Area",[96,179,180],{},"Open-source solution",[103,182,183,190,198,206,214,222],{},[93,184,185,188],{},[108,186,187],{},"Files, calendar, contacts",[108,189,32],{},[93,191,192,195],{},[108,193,194],{},"Office documents",[108,196,197],{},"ONLYOFFICE or Collabora",[93,199,200,203],{},[108,201,202],{},"Chat and video calls",[108,204,205],{},"Element (Matrix), Jitsi",[93,207,208,211],{},[108,209,210],{},"Passwords",[108,212,213],{},"Vaultwarden",[93,215,216,219],{},[108,217,218],{},"Project planning",[108,220,221],{},"OpenProject",[93,223,224,227],{},[108,225,226],{},"Customer management",[108,228,229],{},"e.g. EspoCRM or Odoo",[70,231,232,233,238],{},"You'll find more ideas under ",[234,235,237],"a",{"href":236},"/en/alternativen","Alternatives",".",[79,240,242],{"id":241},"how-to-go-about-it","How to go about it",[244,245,246,252,258,264],"ol",{},[150,247,248,251],{},[74,249,250],{},"Make a list:"," Which online services do you use, and where are the providers based?",[150,253,254,257],{},[74,255,256],{},"Set priorities:"," Where is your most sensitive data?",[150,259,260,263],{},[74,261,262],{},"Test:"," Try a European open-source solution for one area.",[150,265,266,269],{},[74,267,268],{},"Document:"," Write down what is stored where – that also helps when clients ask.",[79,271,273],{"id":272},"a-few-terms-briefly-explained","A few terms, briefly explained",[147,275,276,282,288,294],{},[150,277,278,281],{},[74,279,280],{},"Adequacy decision:"," The European Commission determines that a country offers a comparable level of data protection. Data can then be transferred there more easily.",[150,283,284,287],{},[74,285,286],{},"Standard contractual clauses:"," Contract texts provided by the European Commission, with which companies commit to certain safeguards.",[150,289,290,293],{},[74,291,292],{},"Transfer impact assessment (TIA):"," An assessment of whether the data is adequately protected in the destination country.",[150,295,296,299],{},[74,297,298],{},"Data processing agreement (DPA):"," The contract with a service provider that processes data on your behalf.",[79,301,303],{"id":302},"an-everyday-example","An everyday example",[70,305,306],{},"A small physiotherapy practice uses various online services for appointment reminders, email and file storage. It creates a simple table: which service, which provider, where it's based, what data is stored there, is there a DPA? It turns out that file storage, with findings and treatment plans, holds the most sensitive content.",[70,308,309],{},"The practice decides to move exactly that area first to a Nextcloud in a German data centre. The other services stay as they are for now. With little effort, the most important part gets sorted – without any big upheaval.",[79,311,313],{"id":312},"conclusion","Conclusion",[70,315,316,317,238],{},"The Schrems rulings show that data protection is an important topic with international services. There's no need to panic, but a clear overview helps. And if you like things simple, go for open source in Europe. I'm also happy to support you with data protection and information security as an external adviser – more under ",[234,318,320],{"href":319},"/en/consulting","Consulting",[70,322,323,324,238],{},"If you'd like to give it a try, I'm happy to help – ",[234,325,327],{"href":326},"/en/contact","just drop me a line",{"title":329,"searchDepth":330,"depth":330,"links":331},"",2,[332,333,334,335,336,337,338],{"id":81,"depth":330,"text":82},{"id":141,"depth":330,"text":142},{"id":164,"depth":330,"text":165},{"id":241,"depth":330,"text":242},{"id":272,"depth":330,"text":273},{"id":302,"depth":330,"text":303},{"id":312,"depth":330,"text":313},"2026-05-12T00:00:00.000Z","Safe Harbor, Privacy Shield, Data Privacy Framework: a calm explanation of what the Schrems rulings are about and what you can take away from them.","md",null,{"src":344},"/img/blog/photo-1589829545856-d10d557cf95f.webp",{},true,"/en/blog/schrems-iii-cjeu-ruling",{"title":53,"description":340},"en/3.blog/9.schrems-iii-cjeu-ruling","HkBerOm7De4-Bh7C8VPfMposNt_ZW6V14u5_ArOOZvQ",[352,342],{"title":353,"path":354,"stem":355,"description":356,"children":-1},"Open Source in Schools – Which Solutions Exist and What Works Well","/en/blog/microsoft-365-schools","en/3.blog/8.microsoft-365-schools","Many German states offer their own learning platforms built on open source. An overview – and what families, clubs and tutors can learn from it.",1792720370715]