On 16 July 2020, the European Court of Justice (ECJ) issued a landmark ruling (See EDPB Announcement Here) abolishing the Privacy Shield, the legal tool that made the transfer of personal data free to the United States. At the same time, it considered that the Standard Contractual Clauses (SCCs) remain in force, another legal tool that can be used to transmit data to third countries, but under strict conditions. This Decision affects all organizations that transmit or intend to transmit data to third countries and in particular to the USA.
The lawsuit was filed before the CJEU by an Austrian Facebook user, against a Decision of the Irish Data Protection Authority, during which the legality of the Privacy Shield and the SCCs was challenged. The Court of Justice of the European Union (CJEU), after examining various factors and in particular the US legal status regarding the monitoring of data from the EU to the US, declared the Privacy Shield invalid.
Although SCCs remain in force, an organization that uses or intends to use them should consider the status of the country of surveillance and, if a satisfactory level of protection is not provided, should not allow or should suspend any transmission. It should also, where necessary, take additional protection measures. Otherwise, affected citizens can take legal action against the organization for compensation and file a complaint with the competent supervisory authority.
The Personal Data Authorities, through the European Data Protection Council, which is their collective body, will soon provide guidance to the affected organizations, for the smooth and uniform implementation of the CJEU Decision.