European Court of Justice Strikes Down US Privacy Shield

Today the European Court of Justice struck down the US-EU Privacy Shield as legal mechanism for transfer of personal data.

As one of the most-anticipated data protection rulings to date, the judgement will affect 4,500 companies and billions of data transfers.

The Privacy Shield arrangement was deemed unsuitable for protecting upholding EU citizens' rights, as it did not protect EU citizens data from being accessed by the USA Security Forces.

The petitioner, Max Schrems, said:

“I am very happy about the judgment. It seems the Court has followed us in all aspects. This is a total blow to the Irish DPC and Facebook. It is clear that the US will have to seriously change their surveillance laws, if US companies want to continue to play a major role on the EU market.”

However, the court indicated that Standard Contractual Clauses (SCCs) could be used to transfer data, a boon for UK organisations anticipating changes in UK-EU data protection regulatory relationship post-Brexit. The DMA has produced guidance on SCCs and transfer of data from UK to the EU, and the ICO are currently updating their guidance on SCCs to be released in the coming days.

John Mitchison, DMA Director of Policy and Compliance, said:

"This ruling by the Court of Justice of the EU (CJEU) could create a lot of disruption and work for some organisations, but in the end, I believe we will see this as a positive outcome. Data transfers to the US do not provide the level of protection EU data subjects have come to expect with GDPR.

Data transfers to the US are still possible based on Standard Contract Clauses (SCC) but this requires a case by case approach which is more appropriate than the blanket approval offered by Privacy Shield and in line with the accountability requirements of GDPR.

Companies should act now to check their international transfers and make the required changes and put in place the necessary documentation."

Guidance for implementing standard contractual clauses (SCC’s) can be found here.