After months of negotiations, the European Commission (the
"Commission") and the US Department of
Commerce ("DOC") have agreed on a final
EU-US "Privacy Shield" framework for use by companies
seeking a legal basis for commercial transatlantic transfers of
personal data. The Commission formally approved the
"adequacy" of the Privacy Shield on 12 July 2016, and the
DOC began accepting "self-certifications" from US
organisations on 1 August 2016.
The Privacy Shield is framed as a remedial successor to the
previous "Safe Harbor" regime, which was invalidated by
the European Court of Justice in October 2015 due largely to
concerns regarding its derogation permitting the mass,
indiscriminate sharing of EU citizens' personal data with US
agencies for national security, public interest and law enforcement
purposes (see our full summary here). Negotiations have been protracted and
various bodies have criticised draft deals along the way; including
the European Parliament,
