Lower Your Privacy Shield, But Max Out Your Options For Maintaining Transatlantic Data Flow

Any organization that relies on certification under the EU-U.S. Privacy Shield framework and/or entering into the Standard Contractual Clauses ("SCCs" or "Model Clauses") to effectuate personal data transfers from the European Economic Area ("EEA") to the United States ("U.S.") should reevaluate the organization's data transfer strategy. On July 16, 2020, the Court of Justice of the European Union ("CJEU"), in a case evaluating the validity of data transfers from the EEA to the U.S. ("case C-311/18" or "Schrems II"), invalidated the Privacy Shield and significantly restricted the SCCs' effectiveness. So far, regulators across Europe have signaled mixed responses to the decisions, so the countries from which an organization transfers personal data may shape the organization's response.