The highest court in Europe has canceled the Privacy Shield agreement between the European Union and the United States, on which around 5,000 companies rely to transfer information across borders.
The Court has maintained other agreements that can be used between Europe and the rest of the world. These so-called standard contractual clauses are only valid if the country receiving the data has protections equivalent to those of EU law – which security experts say the United States does not have.
That leaves thousands of companies out of the picture, said Caitlin Fennessy, research director at the International Association of Privacy Professionals.
“I think this is the worst-case scenario for American businesses,” said Hennessy. “It is difficult to understand what legal option companies have. But this will require immediate action on the part of EU and US political decision-makers… as an indication and reassuring. “
Schrems celebrated the decision. “It is a blow to the Irish DPC and Facebook. It is clear that the United States will have to seriously change its surveillance laws if American companies are to continue to play a role in the EU market, “he said.
The data protection shield replaced a previous agreement called Safe Harbor, which was canceled in 2015 following Schrems’ complaint.
In a statement, Facebook’s associate general counsel, Eva Nagle, said he welcomed the decision to keep standard contract terms in place for some countries.
“We are carefully examining the conclusions and implications of the Court of Justice decision concerning the use of the data protection shield and we are eagerly awaiting regulatory guidance in this regard. We will ensure that our advertisers, customers and partners can continue to benefit from Facebook services while keeping their data secure. ”
European Commission Vice-President Věra Jourová said after the decision that officials from the EU and the United States were in close contact and had already worked on alternatives, including the possible update of the agreement of the data protection shield.
Jourová added that it will take time to analyze the decision and understand its implications.
“We will continue our work to ensure the continuity of secure data flows,” she said. “We firmly believe that in today’s globalized world it is essential to have a large toolbox for international transfers while ensuring a high level of protection for personal data. We are not starting from scratch. ”
US Commerce Secretary Wilbur Ross said he was disappointed with the decision and hoped to “limit the negative consequences to the $ 7.1 trillion transatlantic economic relationship so vital to our respective citizens, businesses and governments.”
Ross said the U.S. will continue to administer the data protection shield program while it further studies the decision.