The Court of Justice of the European Union has delivered a significant judgment in a case to examine whether the Privacy Shield Convention (2016/1250), which governs the transatlantic use of EU citizens’ personal data, achieves its intended purpose. As a result of that decision, the EU-U.S. Privacy Shield is no longer a valid mechanism to comply with EU data protection requirements when transferring personal data from the European Union to the United States. The Privacy Shield Convention thus failed to live up to its expectations in much the same way as its immediate predecessor, Safe Harbor, which had previously been challenged in court by the same Austrian activist who also brought the current lawsuit.
With the establishment of Safe Harbor and its successor, Privacy Shield, the main problem is that the U.S. legal system extends constitutional rights only to U.S. citizens, so the EU citizens has no protection against data collection. This means that local state security agencies and government institutions have wide access to the data of EU citizens stored in America. In the present case the Court examined Facebook’s practice of what could happen on the community site with personal information related to EU citizens that is transferred to the company’s California headquarters. The Court recorded that the Convention does not meet the regulation of the GDPR, therefore came to annulled it.
The court also ruled that Commission Decision 2010/87 remains in force, which sets out the general contractual conditions under which service providers are allowed to transfer personal data to third-country data processors. Following the ruling by the European Court of Justice, the United States and the European Union must conclude another agreement, this time unequivocally guaranteeing that the personal data of EU citizens will enjoy the same protection in the United States as that of American citizens. Until then data controllers are to ensure the safety of transferred data to the US by other means, such as standard contractual clauses.
