Securiti leads GigaOm's DSPM Vendor Evaluation with top ratings across technical capabilities & business value.

View

Privacy Shield Invalidated: Exploring Alternatives for EU-US Data Transfers

Published July 20, 2020
Author

Omer Imran Malik

Data Privacy Legal Manager, Securiti

FIP, CIPT, CIPM, CIPP/US

Listen to the content

In a major upset, the Court of Justice of the European Union (CJEU) in Data Protection Commissioner v. Facebook Ireland Limited, Maximilian Schrems (Case C-311/18) (or colloquially referred to as Schrems-II in the privacy community) invalidated the Privacy Shield arrangement between the European Commission and the United States on July 16th 2020, bringing billions of dollars of transatlantic trade and transfer of data into uncertainty and question.

This is not the first time such a situation has been created. A similar outcome was seen back in 2015 (referred to as the Schrems-I decision) when Safe Harbour, an earlier privacy framework agreement between the Commission and the US was struck down by the CJEU for being an inadequate protection framework for the transfer of European citizens’ data to the United States.

The reasoning by the CJEU back then to invalidate Safe Harbor was very much similar: US laws allowed intelligence authorities to access the transferred data unfettered and the lack of a legal recourse for European citizens to exercise their data rights under the GDPR and EU charter on Fundamental Rights.

The difference between then and now is how the CJEU also discussed the Standard Contractual Clauses - SCCs, another popular transfer mechanism used by many entities to transfer European citizens’ data to a huge host of third parties in various countries. The CJEU generally upheld the SCCs but created a whole new set of considerations for companies to consider when dealing with transfer of data of European citizens outside the EU zone.

Given the diplomatic, political and legal implications of the judgement, it is safe to say that Schrems-II will be the subject of much discussion in the coming weeks in not only the privacy professional circles but also between global leaders and the internet industry. Thus it is important to understand what the Luxembourg court held and why and what seems to be the path going forward.

A brief background of the case

This case began with Mr. Maximilian Schrems, a citizen of Ireland and digital privacy activist, who complained to the Irish Data Protection Commission (DPC) that Facebook Ireland (a regional headquarters of Facebook Inc. a silicon valley company in the US which runs arguably the most popular and biggest social media website in the world called Facebook) should not be allowed to transfer his data to its US parent.

Shrems worried that the US mass surveillance programs - which have become public knowledge after Snowden’s revelations in 2013 - indiscriminately and in a disproportionate manner violate the privacy rights guaranteed to him under the GDPR and the EU charter on Fundamental Rights as the current protection mechanisms in place by the European Commission which allows the data to be transferred from Europe to the US (i.e back then the Safe Harbor mechanism and the Standard Contractual Clauses) are inadequate in protecting his rights and providing him a remedy.

The CJEU struck down Safe Harbor in Schrems-I and sent the case back to the Irish DPC for further proceedings. Mr. Schrems amended his complaint to include the SCCs and the newly made Privacy Shield, and the Irish DPC referred the case to the Irish High Court, which, after hearing from Facebook, US authorities and other parties, referred legal questions back to the CJEU for a final decision.

The legal questions sent by the Irish High Court to the CJEU specifically scrutinized the legitimacy and adequacy of the European Commission’s decision to consider data transfers from Europe to the US under the Privacy Shield framework and the SSCs in light of Section 702 of Foreign Intelligence Surveillance Act and Executive Order 12333 which allow US intelligence services broad powers to conduct surveillance, intercept and collect data and leave little to no judicial redress to European citizens to challenge the interception by US intelligence agencies.

Judgement on Privacy Shield

After conducting a thorough analysis, the CJEU answered the questions posited to it by concluding that the Privacy Shield protection mechanism was inadequate because:

  • The Privacy Shield does not provide adequate protection to European citizens since it allows the US intelligence agencies to circumvent the protections provided by the GDPR and EU Charter on Fundamental Rights. US intelligence agencies intercept data on European citizens with no effective oversight which ensures that the derogations are necessary, proportionate and limited as is required by the GDPR. The CJEU held that this runs afoul of the requirements of Article 52 of the EU charter on Fundamental Rights.
  • There was no judicial redress available to European citizens under the Privacy Shield protection mechanism against the violation of their rights by US intelligence agencies. The CJEU held that the office of the Intelligence Ombudsman created by the US under the Privacy Shield program was not a judicial office: it was neither independent nor insulated from the executive branch and could not enforce decisions against US intelligence agencies. Thus it was deemed complaints before the office of the Intelligence Ombudsman were an inadequate recourse as per Article 47 of the EU charter.

Judgement on SCCs

The CJEU even considered the SCCs that are signed between entities in Europe and the United States for transfer of European citizens’ data and while it did not outrightly strike down this popular mechanism of data transfer, some important guidelines were provided and additional due diligence obligations on data controllers and processors were imparted. The CJEU has also tasked the Data Protection Authorities (DPAs) in the member states of the EU to step in and do the analysis if necessary and stop the transfer of European citizens’ data when required. The guidelines and obligations are dilated below:

Data controllers and processors signing SCCs with foreign based third party entities must see to it that the third party destination countries have laws and regulations which will sufficiently respect and enforce the SCCs by providing additional protections beyond the contractual provisions.

However, if the data controller or processor finds that the law and regulations of the third party destination country are contrary to the provisions of the SCCs and they will lead to the violation of the contractual terms and the rights of European citizens under the GDPR, the controller or processor is duty bound to stop the transfer of data immediately and have the third party entity delete the data as per the SCCs terms.

If the data controller or processor is slow to take action, it is the job of the member state’s DPA to step in and stop the transfer of data under the SCC and suspend all future transfers to that country under the SCCs until the laws and regulations are amended to provide greater protection.

What is the path going forward?

Businesses transferring data from European entities must not panic. The industry has faced such an upset before with the invalidation of Safe Harbour in 2015. The transatlantic transfer of data has not screeched to a halt (the US is still certifying companies wishing to do data transfers under the Privacy Shield). The mechanism for transatlantic data transfer from Europe to the US has only entered uncertainty once again.

While data being transferred to the US under SCCs is under greater scrutiny and can be halted in the future by EU member state DPAs, the GDPR evisions more routes which allow for data transfer from GDPR protected jurisdictions to non-GDPR jurisdictions which do not have adequate domestic data protection frameworks. Consent of the consumer is certainly one option and so are certifications and corporate codes of conduct. These are options worthy of exploration by companies right now.

Many in the privacy community saw such a decision forthcoming and various possible solutions are already being considered right now. Even now, the US and European Commission are hard at work working out a new mechanism for transfer which is compliant with the CJEU’s judgement in Schrems-II. It would seem that with this judgement the pressure would increase on the United States to enact a GDPR-like all encompassing data privacy and protection federal law to counter the recurrent problems major Silicon Valley companies face due to a lack of a permanent adequate protection framework.

For businesses however, the bottom line is simple. Robust data privacy management is key. Voluntary adherence to GDPR standards is just good business sense nowadays. Expert compliance by companies all over the world to global data privacy regulations using specialized tools is the best way to avoid liabilities and carry on business without obstacles. This is where securiti.ai can help.

securiti.ai has an award winning privacy management solution based on an AI-powered PrivacyOps framework. It’s privacy management platform automates all aspects of GDPR compliance.

Ask for a DEMO today to understand how securiti.ai can help you comply with GDPR and a whole host of other global privacy laws and regulations, such as the CCPA, with ease.

Join Our Newsletter

Get all the latest information, law updates and more delivered to your inbox


Share

More Stories that May Interest You
Videos
View More
Mitigating OWASP Top 10 for LLM Applications 2025
Generative AI (GenAI) has transformed how enterprises operate, scale, and grow. There’s an AI application for every purpose, from increasing employee productivity to streamlining...
View More
Top 6 DSPM Use Cases
With the advent of Generative AI (GenAI), data has become more dynamic. New data is generated faster than ever, transmitted to various systems, applications,...
View More
Colorado Privacy Act (CPA)
What is the Colorado Privacy Act? The CPA is a comprehensive privacy law signed on July 7, 2021. It established new standards for personal...
View More
Securiti for Copilot in SaaS
Accelerate Copilot Adoption Securely & Confidently Organizations are eager to adopt Microsoft 365 Copilot for increased productivity and efficiency. However, security concerns like data...
View More
Top 10 Considerations for Safely Using Unstructured Data with GenAI
A staggering 90% of an organization's data is unstructured. This data is rapidly being used to fuel GenAI applications like chatbots and AI search....
View More
Gencore AI: Building Safe, Enterprise-grade AI Systems in Minutes
As enterprises adopt generative AI, data and AI teams face numerous hurdles: securely connecting unstructured and structured data sources, maintaining proper controls and governance,...
View More
Navigating CPRA: Key Insights for Businesses
What is CPRA? The California Privacy Rights Act (CPRA) is California's state legislation aimed at protecting residents' digital privacy. It became effective on January...
View More
Navigating the Shift: Transitioning to PCI DSS v4.0
What is PCI DSS? PCI DSS (Payment Card Industry Data Security Standard) is a set of security standards to ensure safe processing, storage, and...
View More
Securing Data+AI : Playbook for Trust, Risk, and Security Management (TRiSM)
AI's growing security risks have 48% of global CISOs alarmed. Join this keynote to learn about a practical playbook for enabling AI Trust, Risk,...
AWS Startup Showcase Cybersecurity Governance With Generative AI View More
AWS Startup Showcase Cybersecurity Governance With Generative AI
Balancing Innovation and Governance with Generative AI Generative AI has the potential to disrupt all aspects of business, with powerful new capabilities. However, with...

Spotlight Talks

Spotlight 11:29
Not Hype — Dye & Durham’s Analytics Head Shows What AI at Work Really Looks Like
Not Hype — Dye & Durham’s Analytics Head Shows What AI at Work Really Looks Like
Watch Now View
Spotlight 11:18
Rewiring Real Estate Finance — How Walker & Dunlop Is Giving Its $135B Portfolio a Data-First Refresh
Watch Now View
Spotlight 13:38
Accelerating Miracles — How Sanofi is Embedding AI to Significantly Reduce Drug Development Timelines
Sanofi Thumbnail
Watch Now View
Spotlight 10:35
There’s Been a Material Shift in the Data Center of Gravity
Watch Now View
Spotlight 14:21
AI Governance Is Much More than Technology Risk Mitigation
AI Governance Is Much More than Technology Risk Mitigation
Watch Now View
Spotlight 12:!3
You Can’t Build Pipelines, Warehouses, or AI Platforms Without Business Knowledge
Watch Now View
Spotlight 47:42
Cybersecurity – Where Leaders are Buying, Building, and Partnering
Rehan Jalil
Watch Now View
Spotlight 27:29
Building Safe AI with Databricks and Gencore
Rehan Jalil
Watch Now View
Spotlight 46:02
Building Safe Enterprise AI: A Practical Roadmap
Watch Now View
Spotlight 13:32
Ensuring Solid Governance Is Like Squeezing Jello
Watch Now View
Latest
Navigating the Data Minefield: Essential Executive Recommendations for M&A and Divestitures View More
Navigating the Data Minefield: Essential Executive Recommendations for M&A and Divestitures
The U.S. M&A landscape is back in full swing. May witnessed a significant rebound in deal activity, especially for transactions exceeding $100 million, signaling...
Simplifying Global Direct Marketing Compliance with Securiti’s Rules Matrix View More
Simplifying Global Direct Marketing Compliance with Securiti’s Rules Matrix
The Challenge of Navigating Global Data Privacy Laws In today’s privacy-first world, navigating data protection laws and direct marketing compliance requirements is no easy...
What to Know About Quebec’s Act Respecting Health and Social Services Information (AHSSS) View More
What to Know About Quebec’s Act Respecting Health and Social Services Information (AHSSS)
Learn more about Quebec's AHSSS, including its obligations on healthcare providers, researchers, and technology providers, with Securiti's latest blog.
View More
What is Automated Decision-Making Under CPRA Proposed ADMT Regulations
Learn more about automated decision-making (ADM) under California's CPRA, its regulatory approach to the technology, and how to ensure compliance.
View More
Is Your Business Ready for the EU AI Act August 2025 Deadline?
Download the whitepaper to learn where your business is ready for the EU AI Act. Discover who is impacted, prepare for compliance, and learn...
View More
Getting Ready for the EU AI Act: What You Should Know For Effective Compliance
Securiti's whitepaper provides a detailed overview of the three-phased approach to AI Act compliance, making it essential reading for businesses operating with AI.
View More
Enabling Safe Use of Data with Amazon Q
Learn how robust DSPM can help secure Amazon Q data access, automate sensitive data tagging, eliminate ROT data, and maximize AI productivity safely.
Singapore’s PDPA & Consent: Clear Guidelines for Enterprise Leaders View More
Singapore’s PDPA & Consent: Clear Guidelines for Enterprise Leaders
Download the essential infographic for enterprise leaders: A clear, actionable guide to Singapore’s PDPA and consent requirements. Stay compliant and protect your business.
Gencore AI and Amazon Bedrock View More
Building Enterprise-Grade AI with Gencore AI and Amazon Bedrock
Learn how to build secure enterprise AI copilots with Amazon Bedrock models, protect AI interactions with LLM Firewalls, and apply OWASP Top 10 LLM...
DSPM Vendor Due Diligence View More
DSPM Vendor Due Diligence
DSPM’s Buyer Guide ebook is designed to help CISOs and their teams ask the right questions and consider the right capabilities when looking for...
What's
New