EU–US Privacy Shield

In October 2015 the European Court of Justice declared the previous framework called the International Safe Harbor Privacy Principles invalid in a ruling that later became known as "Schrems I".[3] Soon after this decision the European Commission and the U.S. Government started talks about a new framework and on February 2, 2016 they reached a political agreement.[1] The European Commission published the "adequacy decision" draft, declaring principles to be equivalent to the protections offered by EU law.[5]

The Article 29 Data Protection Working Party delivered an opinion on April 13, 2016, stating that the Privacy Shield offers major improvements compared to the Safe Harbor decisions, but that three major points of concern still remain. They relate to deletion of data, collection of massive amounts of data, and clarification of the new Ombudsperson mechanism.[6] The European Data Protection Supervisor issued an opinion on 30 May 2016 in which he stated that "the Privacy Shield, as it stands, is not robust enough to withstand future legal scrutiny before the [European] Court".[7]

On 8 July 2016 EU member states' representatives (article 31 committee) approved the final version of the EU-U.S. Privacy Shield, paving the way for the adoption of the decision by the commission.[8] The European Commission adopted the framework on 12 July 2016 and it went into effect the same day.[9][10]

On January 25, 2017, U.S. President Donald Trump signed an executive order entitled "Enhancing Public Safety" which states that U.S. privacy protections will not be extended beyond US citizens or residents:

Agencies shall, to the extent consistent with applicable law, ensure that their privacy policies exclude persons who are not United States citizens or lawful permanent residents from the protections of the Privacy Act regarding personally identifiable information.[11]

This executive order was declared unconstitutional by US judge William Orrick III on November 21, 2017.[12]

The European Commission has stated that:

The US Privacy Act has never offered data protection rights to Europeans. The Commission negotiated two additional instruments to ensure that EU citizens’ data is duly protected when transferred to the US:

• The EU–U.S. Privacy Shield, which does not rely on the protections under the US Privacy Act.
• The EU–US Umbrella Agreement, which enters into force on 1 February (2017). To finalize this agreement, the US Congress adopted a new law in 2017, the US Judicial Redress Act,[13] which extends the benefits of the US Privacy Act to Europeans and gives them access to US courts."[14]

The commission said it will "continue to monitor the implementation of both instruments".[14]

In general, there are seven major principles which the organization has developed. They are stated in the following paragraphs:[15]

1. Notice
2. Choice
3. Accountability for Onward Transfer
4. Security
5. Data Integrity and Purpose Limitation
6. Access
7. Resources, Enforcement and Liability

German MEP Jan Philipp Albrecht and campaigner Max Schrems criticized the new ruling, with the latter predicting that the commission might be taking a "round-trip to Luxembourg" (where the European Court of Justice (CJEU) is located).[16] Many Europeans demanded a mechanism for individual European citizens to lodge complaints over the use of their data, as well as a transparency scheme to assure that European citizens' data does not fall into the hands of U.S intelligence agencies.[17]

The Privacy Shield has been challenged legally by privacy groups.[18][19] Initially, it was not clear whether the cases would be considered admissible.[20][21] However, by February 2017 the future of the Privacy Shield was contested. One consultant, Matt Allison, predicted that "The EU's citizen-driven, regulated model will swiftly come into conflict with the market forces of the US and the UK."[22] Allison summarized a new paper in which the European Commission lays out its plans for adequacy decisions and global strategy.[23]

In December 2019, the Court of Justice of the European Union (CJEU) issued a preliminary opinion in the Data Protection Commissioner v Facebook Ireland case (also known as Schrems II). It outlined various scenarios that may result from the conflict in regimes. The author concluded that the opinion "should generate equal measures of relief and alarm for the U.S. government and for companies dependent on data transfers.[24]

A final CJEU decision was published on 16 July 2020 in Schrems II.[25][26] The EU-US Privacy Shield for data sharing was struck down by the European Court of Justice on the grounds it did not provide adequate protections to EU citizens on government snooping.[4] The European Data Protection Board (EDPD), an EU organization whose decisions are binding for national privacy supervisory authorities, declared that, "transfers on the basis of this legal framework are illegal".[27]

The ruling does not stop data transfers between the EU and other foreign countries as the court upheld the use of "standard contractual clauses" (SCCs). But SCCs does not necessarily protect data in countries where the law is fundamentally incompatible with the Charter of Fundamental Rights of the EU and the GDPR, like the US.

A decision regarding the impact of Brexit on Privacy Shield was expected by 31 December 2020, but may be moot due to the CJEU decision.[28]

Switzerland is not an EU member but follows many EU policies through treaty implementations. Accordingly, it has implemented its own version of the Privacy Shield framework through its own Swiss-US Privacy Shield. It is largely similar to the EU-US Privacy Shield framework, but implements its own DPA instead of various EU DPAs. It also has no grace period and several other meaningful differences to the definition of "sensitive data," binding arbitration, and changes to privacy policies.[29] The EU-US and Swiss-US programs are adequately similar that they are administered together by the United States.[30]

• Binding corporate rules
• Electronic Communications Privacy Act
• FTC fair information practice (FIPP), US
• IT risk
• Privacy
• Safe harbor (law)
• Stored Communications Act
• General Data Protection Regulation (GDPR)

• Commission Implementing Decision (EU) 2016/1250 of 12 July 2016 on the adequacy of the protection provided by the EU-U.S. Privacy Shield, now void because of Schrems II
• EU-U.S. Privacy Shield fact sheet at the European Union
• EU-U.S. Privacy Shield fact sheet at the US Department of Commerce