CJEU - a significant decision regarding the transfer of personal data to the USA

On 16 July 2020 a very important judgment was delivered by the CJEU:

1. Privacy Shield programmes
2. Use of standard contractual clauses

The CJEU found that, as a mechanism for the lawful transfer of personal data from Europe to the US, the Privacy Shield is invalid. Wherever you apply this mechanism, the approach must therefore be corrected. This mechanism has often been used to transfer data in the area of marketing, IT support, modern applications. Please also check whether this mechanism was used somewhere in the processing chain at a later stage.

As regards standard contractual clauses, this instrument was upheld. However, the CJEU indicated the obligation to examine the level of personal data protection in the country to which data are to be transferred under the clauses. At the moment, it is too early to assess how this requirement will be enforced by the supervisory authorities. Our first concerns are whether SCC will apply "automatically" to the transfer of personal data to the US.

We are continuing to analyse the judgment. The whole text is available at: https://noyb.eu/en/cjeu?fbclid=IwAR3vcFuF8HpwR0avQJJ9bo-x0kOFVQRAH3mV-ldX_is7DUZOlkdt528SPVg

Please let us know if you wish to discuss specific cases and concerns.