The European Court of Justice (ECJ) decided to strike down the Privacy Shield pact between the European Union and the United States, said CNBC. The court also deemed that Standard Contractual Clauses (SCCs) are enough to legally transfer data from the EU to the US.
This means that multinational companies, who often have operations inside and outside of the EU, will have to create SCCs that provide a corresponding level of protection as the General Data Protection Regulation (GDPR).
According to the ECJ, “Data subjects whose personal data are transferred to a third country pursuant to standard data protection clauses must be afforded a level of protection essentially equivalent to that guaranteed within the EU by the GDPR.”
GDPR, which took effect in 2018, is the privacy and security protection law in the EU. It mandates that organizations anywhere in the world that deal with info in the EU have obligations based on its provisions. With this, it is considered the toughest info-sharing law.
The legal battle regarding info sharing agreements between the EU and the US started in 2013 when Max Schrems, a privacy activist, filed a complaint against Facebook with the Irish Data Protection Commissioner in view of the Edward Snowden leaks.
Schrems asserted that the United States’ privacy laws were not sufficient enough to protect individuals against government surveillance. The ECJ sided with Schrems, leading to the invalidation of the then info-sharing pact Safe Harbor Agreement in 2015.
Safe Harbor was replaced by Privacy Shield, which is not being scrapped by the same court, leaving international companies with a dilemma.
Regarding the matter, the International Association of Privacy Professionals research director Caitlin Hennessy commented, “I think this is the worst-case scenario for US companies.”
Hennessy added that there is difficulty in understanding what other legal options these organizations have and that “it will demand immediate action by EU and US policymakers… for guidance and reassurance.”
As per Yahoo, US Commerce Secretary Wilbur Ross said that the US was “deeply disappointed” with the ECJ’s decision as it is an essential agreement between the two parties. Members of the industry also deemed the ruling “irresponsible” and that it has negative impacts on data flows.
However, the country will work with the European Commission about the issue in the hopes of limiting “the negative consequences to the $7.1 trillion transatlantic economic relationships that is so vital to our respective citizens, companies, and governments.”
