European High Court Finds EU-US Privacy Shield Invalid

On July 16, 2020, the Court of Justice of the European Union held that the EU-US Privacy Shield (the "Privacy Shield"), the privacy framework—used by over 5,300 companies to meet the European Union's ("EU") data protection requirements when transferring personal data from the EU to the US—is invalid. However, the court held that standard contractual clauses ("SCCs") adopted by the European Commission are valid, but with major caveats. The consequences of this decision cannot be overstated. These consequences are already felt both by organizations that have relied on the Privacy Shield and organizations that routinely enter into SCCs to transfer personal data from the countries of the European Economic Area ("EEA") to the US and worldwide.