EU-US Privacy Shield declared invalid – What you need to know when transferring data from the EU to the US
The decision in Schrems II is one of the most significant developments since the implementation of the GDPR.
A recent decision of the Court of Justice of European Union (CJEU) in the case of Data Protection Commissioner v Facebook Ireland and Maximillian Schrems (Case C-311/18) EU:C:2020:559 (known as “Schrems II”) has declared the EU-US Privacy Shield to be invalid. This article looks at the background to the EU-US Privacy Shield, the key points of the CJEU’s ruling and its impact.
What was the EU-US Privacy Shield?
- The EU-US Privacy Shield, being an agreement between the European Commission and US Department of Commerce, aimed to allow for the free transfer of data between EU and US organisations. It was intended to ensure that any personal data transferred to an organisation in the US from an organisation based in an EU country was subject to appropriate levels of protection.
- Fundamentally, it meant that businesses in the US that received data from their EU counterparts could choose to commit to a set of data protection principles to ensure their compliance with EU law and make it easier for EU organisations to transfer personal data to US organisations.
- These principles under the Privacy Shield broadly reflect the rights afforded to data subjects under the General Data Protection Regulation (GDPR), such as the right to access personal data and the right to have personal data erased.
What did the Court of Justice of the European Union decide?
- US domestic law on the international transfer of data did not provide an equivalent level of protection to that afforded by EU law.
- This was on the basis that US authorities had seemingly unfettered access to personal data transferred from the EU for the purposes of protecting national security.
- As such, the CJEU deemed the Privacy Shield to be an inadequate mechanism for the protection of individuals’ personal data.
- Separately, for businesses relying on standard contractual clauses to transfer data to processors outside of the EU, they must ensure that the rights and remedies of data subjects in the third country are at least equivalent to those guaranteed under the GDPR.
What effect does this have on businesses transferring data from the EU to the US?
- The judgment means that businesses in the EU that have transferred data to the US under the Privacy Shield will no longer be able to rely on this framework for future transfers.
- Instead, businesses should look to rely on one or more of the other exemptions permitted by EU law for international transfers, such as standard contractual clauses or binding corporate rules.
- If businesses choose to rely on standard contractual clauses, they should assess whether the countries to which they are transferring data have equivalent legal protections for EU data subjects as those that exist under the GDPR.
- As US law has been deemed to not provide equivalent protections to EU law, businesses looking to rely on standard contractual clauses to transfer data to the US will need to decide whether any further security measures can be put in place for the individual arrangements.
- To assist with this, the European Data Protection Board has recommended that businesses undertake risk assessments as to whether these clauses offer enough protection to data subjects in respect of the country to which their data is being transferred.
Summary
The decision in Schrems II is one of the most significant developments since the implementation of the GDPR. It makes the transfer of personal data to organisations based in the US fundamentally more difficult and increases the administrative burden required for international data transfers.
As such, businesses must now consider whether or not they can transfer personal data to US organisations and, if still required, the additional measures that they need to put in place for the transfer to be lawful under the GDPR.
If your business is affected by the matters discussed above, the Data Protection Team at Leathes Prior would be happy to assist and provide advice on alternative ways for you to meet your data protection obligations. Please contact us on 01603 281141 or asaunders@leathesprior.co.uk for more information.
Autumn Budget 2025: Agricultural Property Relief & Business Property Relief Changes
It was announced in the 2025 Budget that from 6 April 2026, changes will be made to agricultural property relief and business property relief. These changes bring APR and BPR in line with the nil-rate band rules, meaning unused allowances can be transferred to a surviving spouse or civil partner. This is a significant step towards making estate planning easier for families who own farms or businesses.
The Employment Rights Act 2025 is expected to come into force tomorrow (18 December 2025)
After an extended period of back-and-forth amendments between Parliament and the House of Lords, on 16 December 2025, the ERB finally received approval from the House of Lords, with the formality of Royal Assent due to take place tomorrow (18 December 2025). Head of LP Employment, Dan Chapman, explains...
Autumn Budget 2025: Agricultural Property Relief & Business Property Relief Changes
It was announced in the 2025 Budget that from 6 April 2026, changes will be made to agricultural property relief and business property relief. These changes bring APR and BPR in line with the nil-rate band rules, meaning unused allowances can be transferred to a surviving spouse or civil partner. This is a significant step towards making estate planning easier for families who own farms or businesses.
The Employment Rights Act 2025 is expected to come into force tomorrow (18 December 2025)
After an extended period of back-and-forth amendments between Parliament and the House of Lords, on 16 December 2025, the ERB finally received approval from the House of Lords, with the formality of Royal Assent due to take place tomorrow (18 December 2025). Head of LP Employment, Dan Chapman, explains...
Charity of the Month: The Matthew Project
Leathes Prior is delighted to be supporting The Matthew Project as our Charity of the Month for December 2025. The Matthew Project supports young people and adults across Norfolk, Suffolk, and Essex to overcome issues around drugs, alcohol, and mental health, empowering them to rebuild confidence and lead fulfilling lives.
Leathes Prior’s Milan Pandit appointed President of the Norfolk & Norwich Law Society
Leathes Prior Solicitors is proud to announce that Milan Pandit, Solicitor in our Corporate & Commercial Team, has been appointed President of the Norfolk & Norwich Law Society (NNLS) for 2025/26.
Commercial Lease Renewals: A guide for Landlords & Tenants
Commercial lease renewals are a topic that every commercial landlord and business that rents commercial premises should have at the forefront of their minds. It is essential for good succession planning, though it is often neglected until the expiry of an existing lease term is looming or once the existing term has come to an end and the tenant is holding over. In this article, our newly qualified solicitor, Maggie Berry explores the process that landlords and tenants can expect when navigating this complex area of law.
Our Guidance, Your Legacy: What is a Will, and why should I make one?
Not only is a Will one of the most important steps you can take to protect your loved ones and ensure your wishes are respected, but it also limits the likelihood of a claim/dispute following your death. To ensure your loved ones and the causes you care about benefit from your estate, a Will is essential to ensuring this happens. Find out more in this article.
Lease extensions: The essentials to getting started
Extending your lease can seem complex, but taking the right steps early can make the process much smoother. Jake Mowatt, Associate and Harry Smith, Trainee Solicitor in our Residential Property Team outlines the key essentials every leaseholder should understand prior to extending their lease.
Upcoming changes to bringing employment law claims: What these mean for you
The highly anticipated Employment Rights Bill (ERB) is set to increase the time limits in which employees can bring an employment tribunal claim. Gareth Stevens & Rose Woolterton explain what this means for employers & employees.
Service Charges in Residential Leases: FAQs
Service charges are forever a hot topic in the world of property disputes, and it remains one of the most contentious areas between freeholders and leaseholders, particularly in long residential leases. Danny Turpin, Associate, discusses frequently asked questions regarding service charges on long residential leases.
Leathes Prior winners in nine categories in the prestigious Legal 500 Future Laywer Survey
We are thrilled to announce that the firm has placed once again in the Legal 500 Future Lawyer survey as No.1 in the UK for our Social Life; a ranking we have held in the survey for seven years out of the past nine years.
Jess’s Rule – New Guidelines for GPs
A new initiative is being rolled out across GP practices across England in the hope of preventing serious illnesses being missed by GPs where patients present with the same, or deteriorating, symptoms on multiple occasions. Kimberley Nelson in our Personal Injury & Clinical Negligence Team discusses new guidelines for GPs.
Leathes Prior are excited to announce that four Trainee Solicitors qualify at the firm
Leathes Prior is excited to announce that four of our amazing trainees, Eleanor Chapman, Maggie Berry, Alex Robinson, and Georgia Sartin, have successfully completed their training contracts and are now qualifying as Solicitors at the firm.
