The Court of Justice of the European Union has invalidated the EU-U.S. Privacy Shield framework, the primary mechanism by which thousands of companies had been transferring personal data from the European Union to the United States. The decision creates immediate compliance uncertainty for companies that relied on Privacy Shield certifications and requires urgent action to identify and implement alternative transfer mechanisms.
Why Privacy Shield Was Struck Down
The Court held that U.S. surveillance laws do not provide European data subjects with a level of protection essentially equivalent to that guaranteed under EU law, and that the Privacy Shield’s ombudsperson mechanism does not provide sufficient judicial redress for EU individuals whose data is accessed by U.S. intelligence agencies. The decision follows the Court’s earlier invalidation of the Safe Harbor framework on similar grounds.
What Companies Should Do Now
Companies that relied on Privacy Shield as their legal basis for EU-to-U.S. data transfers should immediately assess which Standard Contractual Clauses or other approved transfer mechanisms can serve as replacements. The Court affirmed that SCCs remain a valid transfer mechanism in principle, but noted that companies must conduct case-by-case assessments of whether the legal framework in the recipient country provides adequate protection. Data mapping exercises and transfer impact assessments will be essential.
Snow+Snow’s privacy and data security team assists clients with cross-border data transfer compliance, including the preparation of transfer impact assessments and the implementation of supplemental safeguards where required.
