Data protection: The European Court of Justice invalidates the Privacy Shield agreement
Summary
On 16 July 2020, the Court of Justice of the European Union (ECJ) invalidated the Privacy Shield agreement applying since 2016 and replacing the former Safe Harbor Privacy Principles, also overturned by the Court in 2015. The judicial saga started seven years ago when Austrian Facebook user Max Schrems filed a complaint to prohibit the transfer of his personal data from Facebook Ireland to Facebook Inc. in the United States. His complaint was based on the ground that the law and practice in force in that country did not ensure adequate protection of the personal data, due to the US surveillance programme which requires the transfer of some of the data to the US public authorities for State security purposes. At the time, in the United States, the Safe Harbour Privacy Principles - established in 2000 and applying to US companies through a voluntary self-certification mechanism - were applying and considered by the European Commission as providing an adequate level of protection. Back in court, the issue was now to judge the validity of the SCCs and the Privacy Shield.