CJEU strikes down EU-US data transfer tool in Schrems v Facebook case

Europe’s top court has rejected the validity of the EU-US Privacy Shield, set up in 2016 to protect Europeans personal data when it is transferred across the Atlantic for commercial use. 

Read the CJEU Press Release - The Court of Justice invalidates Decision 2016/1250 on the adequacy of the protection provided by the EU-US Data Protection Shield. 

Additional commentary and responses can be read in: 

16th July:

• European Commission opening remarks at the press conference following the judgment.
• IAPP reports on the 'Schrems II' decision: EU-US data transfers in question.
• Reuters reports privacy campaigner Max Schrems welcomes the decision. 
• The Guardian, which claims tech firms like Facebook may be required to restrict data sent from EU to US.
• 11KBW Panopticon Blog declares Privacy Shield dead and provides a precise summary of the conclusion to this much-anticipated case. 
• The Guardian publishes a full timeline of the key events in the nine-year campaign.
• EDRi - European Digital Rights organisation EDRi hails the decision a victory for us all.
• Privacy & Information Security Law Blog comments on how the outcome was unexpected. 
• IAPP Schrems II backs the European legal regime into a corner. How can it get out?
• IAPP confirm while CJEU invalidates EU-US Privacy Shield; SCCs remain valid.
• IAPP has published a new Privacy Shield INVALID Infographic.
• Reuters reports that Facebook is to study the court ruling on data transfers.
• Open Rights Group asks what about the UK?
• ICO has also issued a statement on Schremms II case.

17th July:

• WIRED predicts how the end of Privacy Shield spells trouble for Brexit Britain.