As many here in the United States slept in the wee hours of this morning, July 16, 2020, the Court of Justice of the European Union (“CJEU”) issued a binding judgment invalidating the European Commission Decision (Commission Decision 2016/1250, the “Privacy Shield Decision”) that authorized the EU-U.S. Privacy Shield arrangement.
For the past four years, this arrangement (resulting from negotiations between EU authorities and the Department of Commerce in the aftermath of a similar CJEU decision back in 2015, which invalidated the EU-U.S. Safe Harbor) has been relied upon by many businesses to transfer personal data from the European Union to the United States in compliance with European Union law.
As a result of the CJEU’s judgment, self-certification under the Privacy Shield framework is no longer a lawful means of transferring personal data from Europe to the United States under the General Data Protection Regulation (EU) 2016/679 (the “GDPR”).
Continue reading in our Client Alert.