The EU-US Privacy Shield

Background and development of the EU-US Privacy Shield

The EU-US Privacy Shield was an informal arrangement in the field of data protection law negotiated between the European Union and the United States of America from 2015 to 2016 and was valid until 2020. The European Union classifies the transfer personal data to the USA due to the USA PATRIOT ACTS and the resulting extensive access rights of the U.S. authorities to company data as critical.

In the past, the transfer of personal data was regulated by the so-called Safe Harbor Agreement between the EU and the USA in such a way that personal data could be transferred to the USA in accordance with the law. The Safe Harbor Agreement was declared invalid by the European Court of Justice in October 2015.

For this reason, a successor agreement was adopted, the EU-US Privacy Shield. The Privacy Shield was adopted by the European Commission in July 2016 and was declared invalid by the European Court of Justice on 16.07.2020. This means that, with immediate effect, it is no longer possible for US companies to process personal data of EU citizens on this basis.

Why was the EU-US Privacy Shield declared invalid?

It all started with Austrian Max Schrems' complaint to the Irish supervisory authority DPC. Schrems first complained about the processing of Facebook users' data, which did not take place at Facebook's European headquarters in Ireland, but on servers in the US. At the time, this case still referred to the Safe Harbour agreement. The European Court of Justice ruled in favour of Schrems in 2015 and declared the safe harbour agreement invalid.

Despite the ruling, Facebook continued to process data in the US, this time on the basis of the standard contractual clauses and the Privacy Shield. Max Schrems sued again against the action, whereupon the Privacy Shield "data protection shield" was also declared invalid.

The judges justified the ruling by stating that the transfer of data of European data subjects to a third country can only comply with the GDPR if an appropriate level of protection is guaranteed. However, since surveillance programmes in the USA are not restricted to a necessary extent and Europeans have no right to complain about this, an adequate level of protection cannot be assumed.

Aim and benefits of the EU-US Privacy Shield

On the official website of the Privacy Shield of the U.S. Government the aims and benefits of the privacy shield are described as follows:

"The EU-U.S. and Swiss-U.S. Privacy-Shield frameworks were developed by the U.S. Department of Commerce and the European Commission, as well as the Swiss government, to provide companies on both sides of the Atlantic with a mechanism to comply with data protection requirements when transferring personal data from the European Union and Switzerland to the United States in support of transatlantic trade".

In general, the privacy shield applies to actions or practices of "persons, partnerships or companies". Custodian banks (banks, federal credit cooperatives and savings banks), telecommunications and interstate transport companies, labour associations, as well as non-profit organisations and most logistics companies are not covered.