On July 16th, 2020, the Court of Justice of the European Union issued a landmark decision in the case of Data Protection Commissioner v. Facebook Ireland Ltd, Maximillian Schrems (Schrems II) concerning the legality of Facebook’s transfers of personal data from the EU to the US. The decision has potentially significant effects on the ability of researchers to legitimately transfer personal data for health research purposes from countries inside the EU, to third countries outside the EU.[1] This article aims: i) to outline the consequences of the Schrems II decision for the legitimate sharing of personal data for health research between the EU and third countries, particularly in the context of the COVID-19 pandemic; and, in light of this elaboration, ii) to consider the avenues that might be pursued to remedy challenges posed by the decision and to facilitate international data exchange for health research moving forward.