EU-US Privacy Shield invalidated by Europe's top court, cites surveillance concerns

Felicity Salina, International Law Officer

1 Aug 2020

The European Court of Justice (ECJ) has officially struck down the EU-US privacy agreement, which regulates the transfer of EU citizens’ data to the United States.

The suit was initiated by an Australian lawyer and data protection activist, Max Schrems. He argued that the EU-US Privacy Shield allows companies such as Facebook to forward data to their parent companies in the US and obliges them to disclose data to the US authorities without enabling the data subjects to object.

The ECJ held that additional protections for EU citizens’ data, provided under the EU-US Privacy Shield – such as the Data Protection Ombudsman and guarantees by the US to limit surveillance – have not been properly implemented. “The requirements of US national security, public interest and law enforcement have primacy, thus condoning interference with the fundamental rights of persons whose data are transferred,” the decision read.

The ruling is expected to heavily impact approximately 5,000 companies within the European Economic Area (EEA) and Switzerland relying on the instrument to transfer personal data to the US. These transfers play a major role in transatlantic trade and are estimated to be worth US $7.1 trillion (£5.6 trillion). Affected companies will now be required to sign so-called “standard contractual clauses” (SCCs), which are non-negotiable legal contracts prepared by Europe and used in other countries aside from the US.

Read more about the invalidation of the EU-US Privacy Shield here: