On 16th July 2020, the Court of Justice of the European Union (CJEU) delivered two important judgements that affect the way in which we can lawfully transfer personal data from the European Union to other countries, in particular to the USA.

1.       The EU-US Privacy Shield has been judged to be invalid.

Those organisations that rely on the Privacy Shield to safeguard transfers of personal data from the UK to the USA will need to find an alternative protective mechanism, the options currently include SCCs and binding corporate rules.  

2.       Standard contractual clauses (SCCs) for the transfer of personal data to processors in third countries are valid.  

The judgement concluded that SCCs provide sufficient protection for EU personal data.

For further detail please see: https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf

EFAMRO Guide:

We also want to alert members that EFAMRO have prepared a very useful guide ‘International Data Transfers: The US Privacy Shield’ (July 21 2020) - https://efamro.eu/wp-content/uploads/2020/07/EFAMRO-Schrems-II-Privacy-Shield-SCC.pdf - providing an initial review of the Court of Justice of the European Union (CJEU) judgment invalidating the Privacy Shield and the latest advice from data protection regulators including the UK’s ICO.

The guide quotes the ICO’s latest advice:

• We are currently reviewing our Privacy Shield and Standard Contractual Clauses (SCCs) guidance after the judgment issued by the European Court of Justice on Thursday 16 July 2020.
• If you are currently using Privacy Shield please continue to do so until new guidance becomes available.
• Please do not start to use Privacy Shield during this period.
• If you have any specific questions please call our helpline on 0303 123 1113.

It also goes on to map out next steps including:

• Adopting Standard Contractual Clauses
• Reviewing contracts
• Considering additional safeguards
• Recording decision making processes

The guide also points out that whilst “a large EU/US data transfer challenge has arisen, it is worth remembering that until December 30th, 2020 any decision taken by the EU level is binding for all UK businesses”.

The US data transfer situation is developing and we’ll keep you up to date as new guidance becomes available, so please keep an eye on this page for further updates on this topic.