Privacy Shield invalidation — 2020 archive

Original publication — historical text

Original material from 2020. The Bulgarian text preserves the former publication, including wording from that period. The English version conveys its historical content. This is not an updated legal analysis; do not rely on the mechanisms or grounds described without checking current requirements and the specific circumstances.

International Legal Advice Center — ILAC informs you that the principal arrangement governing transfers of European Union citizens’ data to the United States is no longer applicable. On 16 July 2020, the Court of Justice of the European Union issued a judgment declaring invalid European Commission Decision (EU) 2016/1250 of 12 July 2016 on the adequacy of the protection provided by the EU–US Privacy Shield. As a result, at the time of this publication, Privacy Shield was no longer recognised as a valid mechanism for complying with EU requirements.

The Court concluded that Privacy Shield did not provide the required level of protection because it was not equivalent to the requirements established by the GDPR and EU law. The main reasons concerned surveillance programmes used by the US government and intelligence agencies, which were not limited to information that was strictly necessary and minimised, and were therefore considered disproportionate.

The original article stated that Privacy Shield participants remained responsible for personal data protection in transfers between the European Economic Area and the United States. It described the United States as remaining committed to working with the EU to maintain transatlantic data flows and privacy protection. It referred to the joint statement issued on 10 August 2020 by US Secretary of Commerce Wilbur Ross and European Commissioner for Justice Didier Reynders on discussions to assess potential improvements to the framework in light of the Schrems II judgment. It also described the continued administration of Privacy Shield during those discussions, including withdrawal requests, the participant list and records of organisations removed from that list.

The article then explained that other legal mechanisms remained available for US companies. Following the invalidation of Privacy Shield, companies wishing to transfer personal data from the EEA to the United States could consider GDPR-compatible mechanisms such as standard contractual clauses and binding corporate rules.

It stated that standard contractual clauses remained valid, but their lawful use depended on whether a controller could in practice ensure the level of protection required by EU law. Data protection rights should retain the applicable EU standard even when data is transferred to a third country. The original text also referred broadly to freely given informed consent and a valid contractual basis as possible grounds for transfers. These statements are preserved as historical commentary and are not an assessment of whether a particular transfer or derogation is lawful today.

The other mechanism discussed was binding corporate rules: data protection policies followed by EU-established companies when transferring personal data outside the EU within a group of companies or enterprises. Such rules should include general data protection principles and applicable rights to provide appropriate safeguards, and should be legally binding and followed by every member.

The original publication concluded by offering further information from the DPA.BG team about the privacy of processed data and advice on legal and practical steps concerning business counterparties.

Source: the preserved original dpa.bg publication at this address. The English text is an archive translation.