Schrems II's Effect on US-Based LLM Providers

Schrems II is a judgment about a Facebook complaint from 2013 and it is the reason a Dutch company cannot send a customer support transcript to a model API in Virginia without first writing a document about United States surveillance law. The route from one to the other is short, and worth following, because the parts of it that are genuinely open are the parts a compliance template will present as closed.

What the Court decided

The Court of Justice gave judgment in Case C-311/18, Data Protection Commissioner v Facebook Ireland and Maximillian Schrems, on 16 July 2020. It did three things.

It invalidated the Privacy Shield adequacy decision, Decision (EU) 2016/1250, on the ground that United States law did not confine surveillance under section 702 of the Foreign Intelligence Surveillance Act and Executive Order 12333 to what is strictly necessary and proportionate, and that the Ombudsperson mechanism did not provide data subjects with a remedy before an independent body with binding powers.

It upheld the validity of the standard contractual clauses decision, but on a condition that changed how they work in practice: because the clauses are contractual, they cannot bind the public authorities of the destination country, so the exporter and importer must verify before transferring whether the law of that country allows compliance with the clauses, and must adopt supplementary measures where it does not.

And it held that where such compliance cannot be ensured, the exporter is required to suspend or end the transfer, and the competent supervisory authority is required to suspend or prohibit it. The judgment is at curia.europa.eu for C-311/18.

Why an API call is a transfer

Chapter V of the GDPR applies to a “transfer”, a word the Regulation never defines. The EDPB filled the gap in its Guidelines 05/2021 on the interplay between Article 3 and Chapter V, adopted in February 2023 and available from the EDPB’s document register, with three cumulative criteria: the exporter is subject to the GDPR for the processing; it discloses by transmission or otherwise makes personal data available to another party; and that party is in a third country or is an international organisation.

A model API call meets all three. It does not matter that the data is transient, that it is sent over TLS, that it is never written to a disk you can see, or that the response comes back in two seconds. Making available is enough, and remote access from a third country counts even where no data leaves the Union — which is the point that catches arrangements where the data sits in Frankfurt and the vendor’s support engineers sit in California.

One useful negative from the same guidelines: where a data subject sends their own personal data directly to an organisation in a third country, there is no transfer, because there is no exporter subject to the GDPR disclosing it. That distinction occasionally matters for a consumer product where the browser calls the model directly — though it rarely survives contact with the rest of the architecture, since the conversation almost always ends up in a store the operator controls.

The chain to today’s requirement

The judgment did not itself create a document called a transfer impact assessment. That arrived in two steps. The EDPB published Recommendations 01/2020 on measures that supplement transfer tools, adopted in final form in June 2021, setting out the six-step method. The Commission then adopted the new standard contractual clauses in Decision (EU) 2021/914, whose Clause 14 turns the Court’s verification duty into an express warranty and whose Clause 14(d) requires the assessment to be documented and produced to a supervisory authority on request.

So the practical requirement for an EU company calling a US-hosted model today has two parts, and they are separate obligations rather than one combined step. First, an Article 46 transfer tool — in almost every case the SCCs, in the correct module, with completed annexes. Second, a documented assessment of whether the tool can be effective given the law and practice of the destination country, with supplementary measures where it cannot. Neither is satisfied by the other. A signed set of SCCs with no assessment behind it is a warranty given without a basis, which is a worse position than having neither.

The third route, adequacy, reopened in July 2023 with the EU-US Data Privacy Framework decision, which removes both obligations for transfers to a certified organisation within its scope — see the EU-US Data Privacy Framework and AI vendors. That is why the practical answer for a given vendor now depends entirely on whether it is on the Commerce Department’s list.

What the ruling did not decide

This is the part that gets flattened in summaries, and it is where the page earns its place. Schrems II did not decide any of the following:

• That transfers to the United States are unlawful. The Court invalidated one adequacy decision and conditioned one transfer tool. It did not prohibit a category of transfer, and it expressly preserved the derogations in Article 49.
• What supplementary measures suffice. The judgment says measures must ensure a level of protection essentially equivalent to that guaranteed within the Union. It does not enumerate them. The EDPB’s recommendations are guidance from a body, not a ruling, and a court has not endorsed the specific measures in them.
• Whether encryption in transit, pseudonymisation or contractual limits are enough in a given case. Left entirely to the case-by-case assessment the Court required.
• Anything about AI. The judgment predates the current generation of model APIs. Every application of it to inference providers is an extension by analogy, and the extension is uncontroversial as to the transfer analysis and much less settled as to whether an inference provider falls within the surveillance statutes the Court was concerned about.
• Whether the same reasoning invalidates the 2023 framework. The Court has not ruled on the current decision. The Executive Order 14086 reforms were adopted precisely to address the deficiencies the Court identified, and whether they do so is the question a future challenge would put.

Where this leaves a model API call

For most EU companies the operational answer is undramatic. Determine whether the provider entity is covered by the adequacy decision for your data. If it is, record that in your Article 30 entry and keep SCCs as a fallback. If it is not, execute the correct SCC module and write the assessment, using the method in transfer impact assessments for a US-hosted AI provider.

The genuinely difficult residue is the case where the assessment cannot honestly reach a favourable conclusion: highly sensitive content, a provider that must hold the plaintext to run inference, and no jurisdictional escape. The Court’s answer there is that the transfer must not happen. In practice that is what drives EU-hosted and open-weight deployment for a narrow set of workloads, and it is the only part of the whole area where the legal analysis reaches into the architecture rather than into the contract folder.