European Court Of Justice Rules US Privacy Shield Invalid

On 16 July 2020, the Court of Justice of the European Union (CJEU) issued a judgment in Data Protection Commissioner v Facebook Ireland Limited, Maximillian Schrems (Case C-311/18, "Schrems II") ruling that the Privacy Shield Framework decision for data transfer between the EU and US (the "Privacy Shield") is invalid, reducing the available options for the sharing of personal data between the two regions.^{1, 2} The CJEU also clarified that stringent checks are, and, potentially "additional measures" may be required before companies may rely on Standard Contractual Clauses to justify international data transfers.

GDPR complicates internal investigations

The transfer of data between countries is essential in the conduct of international internal investigations. It is often a necessary part of a document review process and vital to cooperation with foreign regulators and law enforcement agencies.