We want to make you aware of last week’s significant decision by the Court of Justice of the European Union invalidating the Department of Commerce’s EU-US Privacy Shield program so that you can decide whether you need to take any action if you are engaged in the cross-border transfer of personal data related to European Union (EU) nationals from the EU to the United States. The General Data Protection Regulation (GDPR) requires that any transfers of personal data from the EU to the United States must take place pursuant to a lawful mechanism that provides appropriate safeguards of the personal data being transferred. Such mechanisms being Privacy Shield, BCRs, SCCs, and explicit consent, to name a few.
The Court’s ruling on July 16, 2020 invalidates the EU-US Privacy Shield program as one such mechanism allowing for the transfer of personal data from the EU to the United States. However, it does not invalidate other mechanisms under the GDPR allowing for transfers of personal data, such as standard contractual clauses (SCCs) or explicit consent.
According to the U.S. Department of Commerce, notwithstanding the Court’s decision, they are stating: “This decision does not relieve participants in the EU-U.S. Privacy Shield of their obligations under the EU-U.S. Privacy Shield Framework. The U.S. Department of Commerce will continue to administer the Privacy Shield program, including processing submissions for self-certification and re-certification to the Privacy Shield Frameworks and maintaining the Privacy Shield List.” (Click here)
TazWorks is providing this information for educational purposes only and we strongly encourage you to work with your legal counsel to understand the impact of the Court’s judgment invalidating Privacy Shield and its impact on your operations. Below are some resources you may find helpful.
· Court of Justice of the European Union Press Release (click here)
· Judgment of the Court (16 July 2020) (click here)
· U.S. Department of Commerce Press Release (click here)
· Privacy Shield Overview (click here)
Sincerely, The TazWorks Team
The Court’s ruling on July 16, 2020 invalidates the EU-US Privacy Shield program as one such mechanism allowing for the transfer of personal data from the EU to the United States. However, it does not invalidate other mechanisms under the GDPR allowing for transfers of personal data, such as standard contractual clauses (SCCs) or explicit consent.
According to the U.S. Department of Commerce, notwithstanding the Court’s decision, they are stating: “This decision does not relieve participants in the EU-U.S. Privacy Shield of their obligations under the EU-U.S. Privacy Shield Framework. The U.S. Department of Commerce will continue to administer the Privacy Shield program, including processing submissions for self-certification and re-certification to the Privacy Shield Frameworks and maintaining the Privacy Shield List.” (Click here)
TazWorks is providing this information for educational purposes only and we strongly encourage you to work with your legal counsel to understand the impact of the Court’s judgment invalidating Privacy Shield and its impact on your operations. Below are some resources you may find helpful.
· Court of Justice of the European Union Press Release (click here)
· Judgment of the Court (16 July 2020) (click here)
· U.S. Department of Commerce Press Release (click here)
· Privacy Shield Overview (click here)
Sincerely, The TazWorks Team
