On July 16, the European Court of Justice ruled on a landmark case^[1] brought by privacy activist Max Schrems. The case is part of an ongoing campaign by Schrems to clarify and test the GDPR regulatory framework.

The court ruled that standard contractual clauses (SCCs), the mechanism many companies operating in Europe use to transfer data to the US and other countries, were valid but required significant due diligence before they could be deemed compliant with GDPR standards. More dramatically, the court ruled that Privacy Shield, the mechanism used by more than 5,350 corporations to transfer data to the the United States from the European Union (EU), is invalid.

The Privacy Shield ruling will affect most US corporations, even those that were never part of the Privacy Shield program, as many major vendors of services like payroll, helplines, sales platforms and travel management relied on Privacy Shield to make these transfers lawful.

Privacy Shield replaced Safe Harbor, another mechanism for data transfers, but both were found to have been less than adequate by GDPR standards. In particular, the fact that U.S. government agencies, including the National Security Agency, have access to that data proved problematic.