Shielded No Longer: Top EU Court Invalidates Privacy Shield Framework and Clarifies Use of Standard Contractual Clauses as Bases for EU-U.S. Data Transfers

The Court of Justice of the European Union (CJEU) has issued its long-awaited opinion in Data Protection Commissioner v. Facebook Ireland and Maximillian Schrems (Schrems II), a landmark case challenging the continued legitimacy of Standard Contractual Clauses agreements as a basis for transferring the personal data of EU residents to the United States, and also calling into question the validity of a data-recipient’s adherence to the Privacy Shield Framework as a valid transfer mechanism. The verdict: Privacy Shield is out, but Standard Contractual Clauses are still in—with some caveats. Read more >>