Telecommunications, Media And Technology (TMT) Law Update – Volume 34

JUDGMENTS

European Court of Justice invalidates EU-US Privacy Shield

The European Court of Justice (ECJ) recently considered the validity of the European Commission's 12 July 2016 decision to approve the so-called EU-US "Privacy Shield": Facebook Ireland Ltd v Maximillian Schrems C-311/18. The Privacy Shield was approved by the European Commission as a mechanism to satisfy a requirement under Article 45 of the General Data Protection Regulation (GDPR), which provides that member states can only transfer personal data to a country outside the EU if that country "ensures an adequate level of protection". Whilst the US lacks "adequate" data protection laws for EU purposes, the effect of the European Commission's approval was that data transfers were permitted from the EU to US organisations which had self-certified that they had implemented adequate data protection measures. The ECJ invalidated the European Commission's decision principally out of a concern that US