European Court Invalidates EU-US Privacy Shield Data Transfer Pact
Europe's top court strikes down the Privacy Shield framework, ruling that US surveillance laws fail to provide equivalent protection for EU citizens' data. The decision stems from the ongoing Schrems II case against Facebook and creates major uncertainty for transatlantic data flows.
Europe's top court invalidates the EU-US Privacy Shield, a flagship mechanism that allows companies to transfer personal data across the Atlantic. The Court of Justice of the European Union rules that US national security and law enforcement priorities take primacy over the fundamental rights of EU citizens whose data is transferred to the United States.
This landmark decision, widely known as Schrems II, originates from privacy activist Max Schrems and his ongoing legal battle against Facebook. The case highlights a fundamental clash between US digital surveillance practices, revealed during the Edward Snowden leaks, and strict European privacy rights enshrined in the General Data Protection Regulation and the EU Charter of Fundamental Rights.
While the court strikes down the Privacy Shield due to a lack of essential equivalence with EU law, it upholds the validity of Standard Contractual Clauses for data transfers. The ruling forces thousands of businesses that rely on Privacy Shield to quickly find alternative legal frameworks to continue moving EU citizen data to US-based servers and cloud providers.