CJEU strikes down EU-US data transfer tool in Schrems v Facebook case

Europe’s top court has rejected the validity of the EU-US Privacy Shield, set up in 2016 to protect Europeans personal data when it is transferred across the Atlantic for commercial use. 

Read the CJEU Press Release - The Court of Justice invalidates Decision 2016/1250 on the adequacy of the protection provided by the EU-US Data Protection Shield. 

Additional commentary and responses can be read in: 

16th July:

• European Commission opening remarks at the press conference following the judgment.
• IAPP reports on the 'Schrems II' decision: EU-US data transfers in question.
• Reuters reports privacy campaigner Max Schrems welcomes the decision. 
• The Guardian, which claims tech firms like Facebook may be required to restrict data sent from EU to US.
• 11KBW Panopticon Blog declares Privacy Shield dead and provides a precise summary of the conclusion to this much-anticipated case. 
• The Guardian publishes a full timeline of the key events in the nine-year campaign.
• EDRi - European Digital Rights organisation EDRi hails the decision a victory for us all.
• Privacy & Information Security Law Blog comments on how the outcome was unexpected. 
• IAPP Schrems II backs the European legal regime into a corner. How can it get out?
• IAPP confirm while CJEU invalidates EU-US Privacy Shield; SCCs remain valid.
• IAPP has published a new Privacy Shield INVALID Infographic.
• Reuters reports that Facebook is to study the court ruling on data transfers.
• Open Rights Group asks what about the UK?
• ICO has also issued a statement on Schrems II case.

17th July:

• EDPB statement.
• EDPS statement.
• CNIL statement.
• EDPB adopts statement on the CJEU's ruling in Facebook Ireland v Schrems.
• IAPP President Omar Tene declares how the show must go on. 
• 11KBW Panopticon Blog discusses more unhappy thoughts on Schrems II.
• IAPP Privacy Advisor blog asks what Privacy Shield organisations should do now.
• IAPP reaction between Max Schrems and Hogan Lovells Partner Eduardo Ustaran following CJEU's ruling on Privacy Shield, SCCs.
• TechCrunch looks at how legal clouds are gathering over US cloud IT services.
• Reuters reveals Mike Pompeo said to be 'deeply disappointed' with Privacy Shield invalidation.
• WIRED predicts how the end of Privacy Shield spells trouble for Brexit Britain.

20th July:

• NOYB watch Max Shcrems discuss the next steps for EU companies following CJEU ruling.
• IAPP launch DPA and government guidance page on Schrems II.
• IAPP more reaction as Irish DPC Helen Dixon and DLA Piper Partner Andy Serwin dissect CJEU ruling.
• IAPP publishes article on what 'Schrems II' means for controller-to-processor SCCs.
• IAPP asks what does 'Schrems II' mean for EU-UK data flows?

21st July:

• IAPP asks what the Schrems II decision means for the UK securing an adequacy finding? 

22nd July:

• IAPP asks whether the EU will become an information island?
• IAPP discusses the impact of Schrems II on controller-to-controller SCCs
• IAPP outline action steps US multinationals should take over the transfer of HR data. 

23rd July:

• EDPB urges SAs and holders of BCRs to act ahead of the end of the transition period to ensure the BCRs can still be used as a transfer tool.
• 11KBW Panopticon Blog highlights the need for organisations relying on BCRs using the ICO in the UK to act now and select an EU supervisory authority. 
• IAPP post on how DPAs advise approaching SCCs.
• IAPP post on BCRs as a robust alternative to Privacy Shield and SCCs.