Schrems II Decision Invalidates EU-U.S. Privacy Shield And Ushers In Enhanced Scrutiny Of Data Transfers Globally

Recently, the Court of Justice of the European Union (CJEU) released the long-anticipated Schrems II decision, which effective immediately invalidated the EU-U.S. Privacy Shield mechanism that over 5000 U.S. businesses, from major tech companies to large financial institutions, have relied on for purposes of transferring and processing data from the EU to the U.S. The decision is a companion to the 2015 Schrems I decision where the CJEU invalidated the adequacy decision underlying the EU-U.S. Safe Harbour framework, which led to the development of the Privacy Shield mechanism.

What you need to know

• Organizations should immediately review vendor agreements to determine whether any EU-U.S. personal information transfers are based on Privacy Shield.
  • Privacy Shield certification is no longer a legitimate basis to transfer personal data from the EU to the U.S. The CJEU did not put in place a grace period.