The Court of Justice of the European Union (CJEU) has declared that the EU-US Privacy Shield arrangement, which has until now permitted parties in the EU to transfer personal data legally to counterparts in Canada and the US, is invalid.

The agreement, drafted in 2016 by the European Commission (EC), provided a mechanism by which US firms could self-certify that personal data they received from EU sources would be protected according to EU data protection legislation including, since May 2018, the General Data Protection Regulation (GDPR). These standard contractual clauses (SCCs) avoided the need for companies to sign special agreements covering the myriad personal data items transferred across the Atlantic every day. The arrangement was a necessary compromise, given the importance of EU/US data flows.

However, the Privacy Shield was challenged by Austrian privacy campaigner Max Schrems, who centred his objections on Facebook's routine transmission of data from its Irish operation to its US parent. He argued that the US' legal system does not offer sufficient protection for personal data, given inherent weaknesses in the SCCs and the Privacy Shield framework. Public authorities in the US, he pointed out, have access to that personal data once it has been transferred there, given the wide powers that Washington has given to its national security and law enforcement agencies; allowing interception and access to communications under surveillance programmes that extend to non-US citizens. Moreover, said Schrems, the US' privacy laws provide only weak redress for data subjects, especially foreigners, who were unhappy with how their personal data has been processed.

The CJEU has now upheld Schrems’ complaints, rejecting the EC’s arguments that the US' privacy protections for citizens are adequate.

The ruling puts a stop to all transfers that rely for their legality on the Privacy Shield. However, the CJEU decided that SCCs are still valid in principle to authorise transfers of date to the US and to other third countries outside the EU. ...