The end of the Privacy Shield: Landmark judgment for international data transfers

The case involved the validity of the transfer of personal data from the EU to the US. The General Data Protection Regulation, like its predecessor the 1995 Data Protection Directive, contains a broad prohibition on the transfers of personal data outside the EU. However, this prohibition can be overcome in various ways. The most popular are where the transfer is to a country which the European Commission has decided gives adequate protection to personal data (a so-called ‘adequacy decision’), or where the data exporter and the data importer agree to a contract containing European Commission approved standard contract clauses (SCCs). Both of these methods were under scrutiny in this case.

It was a case brought by Mr Schrems which led to the ruling in 2015 that the previous ‘Safe Harbor’ framework for data transfers to the US did not offer adequate protection for individuals in Europe. The latest case has moved on to consider the validity of the replacement for Safe Harbor, the EU/US Privacy Shield, which in reality is a partial adequacy decision for certain companies in the US, as well as the use of SCCs. Mr Schrems argued that neither the EU/US Privacy Shield nor the SCCs offered adequate protection to his data once it had been transferred to the US.

Court upholds the use of SCCs

Perhaps more importantly, however, the Court also ruled on the use of SCCs. To the relief of many businesses, the Court upheld the use of SCCs as a means of validating transfers outside the EU. But in doing so, the Court emphasised that putting in place SCCs alone is not enough to ensure adequate protection. Instead, data exporters must also consider the legal context in the recipient country. Where the laws of the recipient do not provide adequate protection, the use of SCCs is not enough, and the data exporter must not transfer the data.

So what does all of this mean? Businesses that export personal data to the US using the Privacy Shield framework will need to immediately assess the situation to determine what steps to take to validate the data transfers. The use of SCCs should also be reviewed.

This decision means that international data transfers are likely to become subject to much greater scrutiny and will potentially become more difficult. And with the UK leaving the post-Brexit transition period at the end of 2020, data transfers between the EU and the UK will become subject to these rules.

Now is the time for businesses to be reviewing their international data flows. Our data protection specialists are able to assist where required.