The Privacy Shield: Update on the state of play of the EU-US data

The CJEU’s Schrems judgment of October 2015, besides declaring the European Commission’s Decision on the EU-US ‘Safe Harbour’ data transfer regime invalid, has also settled a number of crucial requirements corresponding to the foundations of EU data protection. In less than one year from the CJEU ruling, the Commission had adopted a new adequacy decision in which the new framework for EU-US data transfer, the Privacy Shield (2016), is deemed to adequately protect EU citizens. The main improvements of the Privacy Shield (over its predecessor), as well as the critical reactions to the new arrangements, are discussed in this paper. The first joint annual review took place in September 2017 on which both the Commission and Article 29 Working Party issued their own reports. Although progress is recognised, a number of concerns remain and new challenges to the Privacy Shield have arisen, among others, from the Facebook/Cambridge Analytica scandal, as pointed out by the European Parliament in its recent resolution.
The CJEU’s Schrems judgment of October 2015, besides declaring the European Commission’s Decision on the EU-US ‘Safe Harbour’ data transfer regime invalid, has also settled a number of crucial requirements corresponding to the foundations of EU data protection. In less than one year from the CJEU ruling, the Commission had adopted a new adequacy decision in which the new framework for EU-US data transfer, the Privacy Shield (2016), is deemed to adequately protect EU citizens. The main improvements of the Privacy Shield (over its predecessor), as well as the critical reactions to the new arrangements, are discussed in this paper. The first joint annual review took place in September 2017 on which both the Commission and Article 29 Working Party issued their own reports. Although progress is recognised, a number of concerns remain and new challenges to the Privacy Shield have arisen, among others, from the Facebook/Cambridge Analytica scandal, as pointed out by the European Parliament in its recent resolution.

Third Time's the Charm? “Privacy Shield 2.0” Emerges as EU Approves New Data Transfer Deal with the United States

A victory for us all: European Court of Justice makes landmark ruling to invalidate the Privacy Shield - European Digital Rights (EDRi)

GDPR, ePrivacy and CCPA - Advice and Insights - Cookiebot™ Blog

Use of Meta tracking tools found to breach EU rules on data transfers

European Commission gives EU-US data transfers third round at CJEU

Transatlantic Explainer: EU–U.S. Privacy Shield

Adequacy decision on data transfers under EU-US Data Privacy Framework

Privacy Shield (Invalidated) - TermsFeed

The Privacy Shield: Update on the state of play of the EU-US data transfer rules, Epthinktank

EU-U.S. data flows deal: game changer or more legal uncertainty? – POLITICO

Cross-border Data Flows: Security and Privacy Issues Within The EU and Beyond - CyberSec4Europe

What to do now that the EU-US Privacy Shield Framework is invalid

1 Year Since the Invalidation of the Privacy Shield Agreement: 5 Recommended Actions for Privacy-Compliant and Secure Corporate Communication – Threema Work

EU-U.S. Privacy Shield, Brexit and the Future of Transatlantic Data Flows

End of EU-US Privacy Shield: Implications for organizations