ForgeRock Remarks on the Court of Justice of the European Union’s Ruling on Transfers of Personal Data


At ForgeRock we take the security and protection of our customer’s personal data seriously. We know staying abreast of shifting security and privacy laws can be challenging, which is why we have a dedicated team of experts monitoring the landscape to ensure our services help you stay compliant. 

An area we continue to watch closely is the Court of Justice of the European Union (CJEU) ruling from July 16, 2020 regarding the transfer of personal data. As part of the ruling, the court confirmed that the European Commission’s standard contractual clauses (SCCs) remain a valid and lawful method for transferring personal data from the European Union to the United States and other countries. At the same time, it decided to invalidate the EU-US Privacy Shield framework.

The Swiss data protection regulator has followed the CJEU’s ruling and deemed the Swiss-US Privacy Shield framework inadequate for protecting Swiss/US data transfers. 

What is the impact?  

For ForgeRock customers, none. The continued support of SCCs means there is no disruption to the way we do business with you. 

ForgeRock was never certified under the EU-US or Swiss-EU Privacy Shield frameworks. We have always relied on SCCs to safely and legally transfer customer’s personal data from the EU and Switzerland to our services. 

This means our customers can be assured that they may continue to use ForgeRock’s services by relying on the SCCs that are currently in our Data Protection Addendum.

What are SCCs? 

The SCCs are a set of standard contractual terms providing sufficient safeguards for the protection of personal data of EU individuals, when transferred from Europe to the US and other countries. The ruling supports our belief that SCCs stand up to our 'cast-iron' commitment to the security and protection of our customers’ data.

Need more information? 

Please reach out to ForgeRock’s Privacy team ([email protected]) with any questions you may have on ForgeRock’s data protection practices or the impact of the CJEU’s ruling in this case.

This content is provided for informational purposes. It is not intended to provide legal advice. ForgeRock’s customers should always consult their legal advisers. This information is provided as of the date indicated above, It does not account for post-publication changes.