The end of the Privacy Shield: Landmark judgment for international data transfers

16th July 2020

The Court of Justice of the European Union has today (16 July) given its judgment in the latest round of the long-running dispute between Facebook and the privacy rights campaigner, Max Schrems. It is likely to have significant implications for international transfers of personal data.

The case involved the validity of the transfer of personal data from the EU to the US. The General Data Protection Regulation, like its predecessor the 1995 Data Protection Directive, contains a broad prohibition on the transfers of personal data outside the EU. However, this prohibition can be overcome in various ways. The most popular are where the transfer is to a country which the European Commission has decided gives adequate protection to personal data (a so-called ‘adequacy decision’), or where the data exporter and the data importer agree to a contract containing European Commission approved standard contract clauses (SCCs). Both of these methods were under scrutiny in this case.

It was a case brought by Mr Schrems which led to the ruling in 2015 that the previous ‘Safe Harbor’ framework for data transfers to the US did not offer adequate protection for individuals in Europe. The latest case has moved on to consider the validity of the replacement for Safe Harbor, the EU/US Privacy Shield, which in reality is a partial adequacy decision for certain companies in the US, as well as the use of SCCs. Mr Schrems argued that neither the EU/US Privacy Shield nor the SCCs offered adequate protection to his data once it had been transferred to the US.

International data transfers

In the most eye-catching part of the judgment, the Court ruled that the EU/US Privacy Shield does not offer appropriate safeguards for data protection, because of the US government’s wide powers to collect and review personal data held in its jurisdiction. Accordingly, the Court has annulled the adequacy decision in respect of the EU/US Privacy Shield. Data transfers under that framework will no longer be valid. As with the similar ruling in 2015 in respect of Safe Harbor, the EU Commission and US authorities may try again to find a replacement scheme, but this appears increasingly difficult, particularly with the existing US administration.

Court upholds the use of SCCs

Perhaps more importantly, however, the Court also ruled on the use of SCCs. To the relief of many businesses, the Court upheld the use of SCCs as a means of validating transfers outside the EU. But in doing so, the Court emphasised that putting in place SCCs alone is not enough to ensure adequate protection. Instead, data exporters must also consider the legal context in the recipient country. Where the laws of the recipient do not provide adequate protection, the use of SCCs is not enough, and the data exporter must not transfer the data.

So what does all of this mean? Businesses that export personal data to the US using the Privacy Shield framework will need to immediately assess the situation to determine what steps to take to validate the data transfers. The use of SCCs should also be reviewed.

This decision means that international data transfers are likely to become subject to much greater scrutiny and will potentially become more difficult. And with the UK leaving the post-Brexit transition period at the end of 2020, data transfers between the EU and the UK will become subject to these rules.

Now is the time for businesses to be reviewing their international data flows. Our data protection specialists are able to assist where required.

If you need advice on a range of corporate legal issues

Speak to a member of our Corporate team

Arrange a call

Enjoy That? You Might Like These:


8 November -
We will have all heard of artificial intelligence (AI) by now. But what actually *is* AI? And why is it unique from a legal perspective? In this article we delve... Read More


26 October -
In his Mansion House speech on 10 July 2023, the Chancellor Jeremy Hunt announced a package of long term reforms aimed at making the City of London a more competitive... Read More


28 September -
The implementation of the new FIFA Football Agent Regulations in England, which were due to come into force on Sunday, has been put on hold awaiting the outcome of a... Read More