Background
A sense of déjà vu descended over the
international data transfer landscape on July 16, 2020. In a
landmark ruling, the Court of Justice of the European Union (CJEU)
announced that Privacy Shield, one of the main mechanisms used by
companies to transfer personal data from the EU to the United
States, is invalid.
This ruling stemmed from a case involving privacy activist Max
Schrems and Facebook.
Mechanisms for Transferring Data Outside of the EU
As a default position, the GDPR restricts the transfer of
personal data outside the EU, unless one of the mechanisms that the
GDPR provides to enable such transfer is used. One such mechanism
is an adequacy decision. If a country outside the EU is on the
"white list" (i.e., is deemed by the European
Commission to have laws equivalent to the GDPR) then transfers can
take place to that country without hindrance.
