Transatlantic Data Flows Face Stormy Seas: Privacy Shield Invalidated – Standard Contractual Clauses Viable for Now 

FDK Headshot Photo 2015 (M0846572xB1386)  RJP Headshot Photo 2018

As many here in the United States slept in the wee hours of this morning, July 16, 2020, the Court of Justice of the European Union (“CJEU”) issued a binding judgment invalidating the European Commission Decision (Commission Decision 2016/1250, the “Privacy Shield Decision”) that authorized the EU-U.S. Privacy Shield arrangement. 

For the past four years, this arrangement (resulting from negotiations between EU authorities and the Department of Commerce in the aftermath of a similar CJEU decision back in 2015, which invalidated the EU-U.S. Safe Harbor) has been relied upon by many businesses to transfer personal data from the European Union to the United States in compliance with European Union law.

As a result of the CJEU’s judgment, self-certification under the Privacy Shield framework is no longer a lawful means of transferring personal data from Europe to the United States under the General Data Protection Regulation (EU) 2016/679 (the “GDPR”).

Continue reading in our Client Alert.