Safe Harbor Submerged: What Next?

As has been well reported, earlier today the Court of Justice of the European Union ("CJEU") handed down its long awaited judgment in Schrems v. Data Protection Commissioner (C-362/14).

The Court found that the Safe Harbor system facilitating the export of personal data from the EU to the USA is 'invalid'. But what does this mean for international business, and what are the next steps?

1. The judgment is less restrictive for businesses than the AG's opinion

The judgment doesn't go quite as far as the Advocate General Bot's Opinion of 23 September 2015, which, as we flagged in our previous post, went so far as to suggest that EU Commission Decisions approving international data transfers were not binding on national data protection authorities ("DPAs"). As we previously noted, the AG's position was quite problematic from the perspective of legal certainty and inconsistent with basic principles of EU law. The fact that the Court has not followed this aspect