The Court of Justice of the European Union (CJEU) has ruled that the EU-US Data Protection Shield is invalid. The agreement, known as the Privacy Shield, allows the transfer of data between the EU and the US.
Executive Director of ARTICLE 19 Quinn McKew said:
“This ruling is a victory for the data protection rights of European citizens. For the second time, the CJEU has ruled that US laws and practices about access to data by public authorities do not provide adequate protection for Europeans.
“This should be a wake-up call to US policy-makers and tech companies. The lack of data protection and pervasive mass surveillance that has been normalised in the US needs urgent reform if the country is going to remain competitive globally and truly defend privacy and free expression.”
Under the European General Data Protection Regulation (GDPR), data can only be transferred to a third country if the Commission has decided that the third country in question ensures an adequate level of protection, or if it has adopted standard contractual clauses that must be tested against the reality of the receiving country’s laws.
In July 2016, the Commission adopted a decision stating the adequacy of the protection provided by the EU-U.S. Privacy Shield.That data agreement was put in place after the CJEU had declared the previous data agreement, known as Safe Harbour, invalid in a case brought by privacy campaigner Max Schrems against Facebook.
However, in today’s judgment, the Court invalidates the 2016 decision, on the basis that US surveillance laws do not provide adequate protections for European citizens’ data under the GDPR, read together with the provisions of the EU Charter on fundamental rights.
In particular, the Court points out that certain US surveillance programmes provide access and use of transferred data, which are not limited in a way that satisfies EU requirements with regard to necessity and proportionality. In addition, says the Court, those surveillance programmes do not grant EU data subjects actionable rights before the courts against US authorities.
For more information, contact [email protected]