EU: CJEU throws out Privacy Shield allowing EU-US personal data transfer

On 16 July the CJEU handed down a ruling throwing out the Privacy Shield, which had succeeded the earlier Safe Harbour data transfer agreement that was also struck down by the same court back in 2015, and also on similar grounds of the risk to data protection posed by US surveillance programmes. The Privacy Shield arrangement can currently derogate from the EU’s main data privacy regime, the General Data Protection Regulation (GDPR), and as result allows companies to legally transfer European citizens’ personal data over to the US. This arrangement results from an EU Commission decision based on observing adequate levels of protection for the personal data that is transferred to the US under the terms agreed between the two parties. It is this assessment of ‘adequate’ protection that the CJEU has been reviewing. Although the case itself directly concerns Facebook, in its judgment the CJEU considers that the ‘Privacy Shield’ ‘enables interference, … with the fundamental rights of the persons whose personal data is or could be transferred from the European Union to the United States’, because the US authorities could access the content beyond that which ensures ‘that the interference is limited to what is strictly necessary,’ this revocation has serious repercussions on companies transferring data to the US, and in particular within the HR domain. The Commissioner for Justice, Didier Reynders, is already said to have solutions at the ready and the EU Commission has already anticipated several ‘scenarios.’ The Court has also validated the legality of ‘contractual clauses’ pertaining to data transfer, which allow companies to comply with the GDPR by way of individual commitments to adhere with certain precautions over the use of their European citizens’ data.