Maximilian Schrems (born 1987) is an Austrian activist, lawyer, and author who became known for campaigns against Facebook for its privacy violations, including violations of European privacy laws and the alleged transfer of personal data to the US National Security Agency (NSA) as part of the NSA's PRISM program.

[a] During the hearing, Bot asked the European Commission lawyer Bernhard Schima what advice he could give him if he was worried about his data being at the disposal of US authorities.

[14] He said the European Commission was unable to guarantee that "adequate" safeguards for the protection of data are met, a remark that Schrems said was the most striking thing he heard at the hearing.

[17][18][19][20] On 6 October 2015, the Court of Justice of the European Union ruled that, (1) national supervisory authorities still have the power to examine EU–US data transfers in spite of an existing Commission decision (such as its Safe Harbor Decision in 2000 which determined that US companies complying with the principles were allowed to transfer data from the EU to the US), and (2) the Safe Harbor framework is invalid.

[21] The Court found that the framework is invalid for several reasons: the scheme allows for government interference of the protections, it does not provide legal remedies for individuals who seek to access data related to them or have it erased or amended, and it prevents national supervisory authorities from exercising their powers.

The complaints are designed to enforce the CJEU judgement on Facebook, which presently does not rely on Safe Harbor for its data transfers.

[23][24] The Irish Data Protection Commissioner took the view that Schrems had raised "well-founded" objections,[25] but that it needs further guidance from the CJEU to determine the complaint.

After the proceedings in February/March 2017,[26] Ms Justice Costello of the Irish High Court delivered the executive summary on 3 October 2017, referring the case to the CJEU.

[36] On 18 January 2019, Schrems filed further GDPR complaints against Amazon, Apple Music, DAZN, Filmmit, Netflix, SoundCloud, Spotify, and YouTube.

[37][38] His non-profit, noyb.eu, alleged they failed to respond, did not include sufficient background information, or provided insufficient or unintelligible raw data.

This decision has significant implications for U.S. Companies and for the U.S. Congress because it calls into question the adequacy of privacy protection in the United States.

""This is another landmark ruling for privacy rights by the Court of Justice, and a clear signal that the United States needs to reform its surveillance laws or risk losing its position as a global technology leader.

[45] Facebook's blog published a response letter by Nick Clegg, VP of Global Affairs and Communications, on 9 September 2020.

[46] Clegg acknowledged that the laws regarding data transfer are changing, yet still more legal clarity is needed for everyone involved, and advocated a revision to the Privacy Shield.

"A lack of safe, secure and legal international data transfers would damage the economy and hamper the growth of data-driven businesses in the EU, just as we seek a recovery from COVID-19.

Facebook therefore welcomes the efforts already underway between EU and US lawmakers to evaluate the potential for an "enhanced" EU-US framework – a Privacy Shield Plus.

These efforts will need to recognise that EU Member States and the US are both democracies that share common values and the rule of law, are deeply culturally, socially and commercially interconnected, and have very similar data surveillance powers and practices"In March 2021 possible repercussions on trans-Atlantic intelligence services and surveillance have surfaced again.

Citing national security and member states' rights, a new initiative has formed in an attempt to keep European intelligence services beyond court jurisdiction.

EU member state governments, led by France, are seeking to insert a national security exemption into the pending ePrivacy Regulation that would exclude third-party states such as the U.S.[47] In May 2021 the Irish High Court rejected judicial review proceedings (brought by Facebook Ireland Limited) seeking to stop a preliminary draft decision (PDD) of the DPC.