• Press
  • Offices
  • Contact
  • Legal notice
  • EN
  • UPC
  • Firm
    • Main Focus
    • History
    • Guiding Principle
    • Awards and Rankings
  • Our Practice
    • Legal Areas
    • Industries
  • Our Team
  • News & Events
    • News
    • Events
    • UPC-Update
    • IP-Update
    • Brexit-Update
    • Publications
    • B&B Bulletin
  • Career
    • Working with us
  • Menu Menu
FIND EXPERTS
  • UPC
  • Firm
  • News & Events
    • News
    • Events
    • UPC-Update
    • IP-Update
    • Brexit-Update
    • Publications
    • B&B Bulletin
  • FIND EXPERTS
  • Contact
  • Our Practice
  • Career
  • Offices
  • EN
  • Legal Areas
  • Industries
  • Working with us

CJEU declares Privacy Shield invalid

21. July 2020/in Special Edition July 2020, Data Protection

By decision of 16 July 2020 (C-311/18), the European Court of Justice (CJEU) declared the EU-US Privacy Shield, which was the basis for a GDPR compliant transfer of personal data of EU citizens for numerous US service providers, to be invalid. The decision makes it necessary for all internationally acting companies, but also for companies simply working with service providers outside the EU, to closely review all data transfer to third countries, in particular to the USA, for GDPR compliance.

By decision of 16 July 2020 (C-311/18), the CJEU declared the EU-US Privacy Shield, which was the basis for a GDPR compliant transfer of personal data of EU citizens for numerous US service providers, to be invalid. The decision also raises questions regarding the use of the standard data protection clauses adopted by the Commission (“Standard Data Protection Clauses”) for safeguarding an adequate level of data protection when transferring data to  third countries, such as the USA, and clarifies that the mere execution of the Standard Data Protection Clauses can no longer be considered a guarantee for GDPR compliance. The decision thus makes it necessary for all internationally acting companies, but also for companies simply working with service providers outside the EU, to closely review all data transfer to third countries, in particular to the USA, for GDPR compliance.

Background of the decision

The GDPR protects the personal data of EU citizens not only within the European Union. The GDPR also requires that personal data may only be transferred to countries outside the scope of the GDPR (so-called third countries) if an adequate level of data protection comparable to the GDPR is safeguarded in these third countries. For a number of countries this adequate level of data protection has been positively established by a Commission adequacy decision. Until now, this also applied to the USA, with the particularity that the adequacy decision did not apply per se to the entire USA, but only to companies that had certified themselves according to the rules of the EU-US Privacy Shield negotiated between the USA and the EU and had thus been subject to the provisions of this agreement. The EU-US Privacy Shield followed up to the so-called “Safe Harbor Agreement” in 2016, which the CJEU declared invalid in its ruling of 6 October 2015 (C-362/14) due to incompatibility with European data protection standards.

As an alternative to such an adequacy decision, the GDPR provides for further mechanisms safeguarding an adequate level of data protection. A particularly important alternative in practice are the Standard Data Protection Clausesof the European Commission which are concluded directly between the data-exporting company and the data importing company.

The decision

In its decision of 16 July 2020, the CJEU now also declared the adequacy decision on the EU-US Privacy Shield to be invalid, thus depriving a high number of current data transfers to the USA of their legal basis. As regards the Standard Data Protection Clauses, the decision also contains statements which call into question the suitability of this instrument for ensuring an adequate level of data protection with regard to data transfers to the USA.

Towards the EU-US Privacy Shield, the CJEU concludes that the adequacy decision regarding the Privacy Shield cannot be reconciled with the standards established by the GDPR, in particular because it does not proportionately limit the rights of access to personal data granted by US law to the US security authorities, nor does it provide the data subjects with an effective legal remedy for taking action against unlawful interference by US authorities.

As a result, the adequacy decision on the EU-US Privacy Shield was declared invalid, so that on this basis a lawful data transfer to the US is no longer possible.

In contrast, the CJEU explicitly confirmed, in relation to the Commission’s decision on the Standard Data Protection Clauses, that the legal assessment had not revealed any evidence which might affect the validity of the decision. The Standard Data Protection Clausesthus remain as a potential basis for data transfers to third countries. However, also with regard to the Standard Data Protection Clauses, the judgment states that the assessment of whether an adequate level of data protection exists on the basis of the Standard Data Protection Clauses depends both on the contractual obligations and on whether the legal system of the third country safeguards an adequate level of data protection, in particular with regard to access to data by public authorities. At the same time, the court clarifies that it is the responsibility of the data processing companies to verify whether the data importing company is legally in a position to comply with the contractual obligations at all and, in case of doubt, to suspend the data transfer.

Furthermore, the CJEU imposes an obligation on national data protection supervisory authorities to verify actual compliance with the contractual obligations stipulated by the Standard Data Protection Clausesand to intervene if these obligations cannot be met.

Consequences of the decision

The decision concerns not only data transfers to the US, but all data transfers to third countries for which no adequacy decision by the Commission exists.

Individual agreements between the companies involved, Binding Corporate Rules and Standard Data Protection Clausescan still be used as a basis for GDPR compliant data transfers to third countries. However, in the future, more attention should be paid to whether the legal requirements at the data importer’s place of business permit compliance with the agreed data protection rules. As in compliance with the CJEU decision, the competent data protection supervisory authorities will also put a closer focus on this, itis to be expected that European authorities develop a common position with regard to specific third countries in order to ensure uniform application of the law and greater legal certainty.

What to do now

  • While it is to be expected that the European data protection authorities will soon take a position on the CJEU decision, immediate action is required, as there is no transition period.
  • Any data transfer based solely on the EU-US Privacy Shield has been illegal since the decision and should be suspended immediately until an alternative basis for data transfers to the US is found.
  • In case of a data transfer based on contractual arrangements, such as the Commission’s Standard Data Protection Clausesit should be examined whether the contractual obligations stipulated in such arrangement can be met subject to the legal requirement in the respective third country. In any event, it may be an option to meet the concerns of the CJEU by means of additional contractual provisions for a transitional period until a coordinated position of the data protection authorities emerges.
  • If necessary, a data transfer can also be carried out on the basis of one of the exemptions under Article 49 GDPR, in particular on the basis of express consent, whereby the legal requirements for effective consent must be complied with, unless another exception applies.

Not least because of the clear call for action which the CJEU directed to the competent data protection supervisory authorities in its decision, the practical relevance of the ruling should not be underestimated.

/wp-content/uploads/2022/04/boehmert_logo.svg 0 0 Petra Hettenkofer /wp-content/uploads/2022/04/boehmert_logo.svg Petra Hettenkofer2020-07-21 10:32:152022-08-24 13:55:53CJEU declares Privacy Shield invalid

Author

Dr. Sebastian Engels

Contents

Menu

  • Firm
  • Our Practice
  • Career
  • News & Events
  • FIND EXPERTS

Informations

  • Press
  • Contact
  • Legal notice
  • Data Protection
  • General Terms and Conditions
  • Contact

Legal Areas

  • Employee Inventions
  • Data Protection
  • Designs
  • Domains
  • Information Technology
  • Anti-Trust
  • Licensing
  • Trade Marks
  • Patent Valuation
  • Patents & Utility Models
  • Patent Litigation
  • Product Piracy
  • Copyright
  • Unfair Competition

© Copyright 2023– BOEHMERT & BOEHMERT

Scroll to top
Cookie settings Cookie settings

We need your consent before you can continue to use our website.


If you are under 16 and wish to give your consent to volunteer services, you must ask your parent or guardian for permission. We use cookies and other technologies on our website. Some of them are essential, while others provide you with more advanced information. For more information about how we use your data, please see our Data Protection Policy. There is no obligation to consent to the processing of your data in order to use this offer. You can revoke or adjust your selection at any time under Settings. Please note that due to individual settings, not all functions of the website may be available.

Cookie settings

Accept all cookies

Save settings

Accept only essential cookies

Individual data protection settings

Cookie details Privacy policy Legal notice

Cookie settings Cookie settings

If you are under 16 and wish to give your consent to volunteer services, you must ask your parent or guardian for permission. We use cookies and other technologies on our website. Some of them are essential, while others provide you with more advanced information. For more information about how we use your data, please see our Data Protection Policy. There is no obligation to consent to the processing of your data in order to use this offer. Please note that due to individual settings, not all functions of the website may be available. Here you can find an overview of all cookies used. You can give your consent to entire categories or view more information and thus select only certain cookies.

Accept all cookies Save settings Accept essential cookies only

Back

Cookie settings

Essential cookies enable basic functions and are necessary for the proper functioning of the website.

Display cookie information Hide cookie information

Name
Provider Borlabs GmbH, Legal notice
Purpose Stores the settings of the visitors selected in the Cookie Box of Borlabs Cookie.
Data protection policy https://borlabs.io/privacy/
Cookie name borlabs-cookie
Cookie duration 1 year

Privacy policy Legal notice