European Court Of Justice Invalidates EU-US Privacy Shield Framework

This past July, a  decision by the European Court of Justice (ECJ) struck down the European Union-United States Privacy Shield framework (EU-U.S. Privacy Shield), one mechanism through which companies could transfer personal information or data to the United States in compliance with the European Union's General Data Protection Regulation (GDPR). The ECJ overturned an earlier European Commission decision that the framework — administered by the U.S. Department of Commerce and enforced by the Federal Trade Commission (FTC) — adequately protects European individuals' personal data in compliance with the GDPR. The court based its ruling on a finding that U.S. government foreign surveillance is not limited to surveillance that is strictly necessary, and that neither U.S. national security laws nor the Privacy Shield framework provides enforceable privacy rights and effective legal remedies for European data subjects.