Newsletter
What is it important to understand in this decision?
July 17, 2020
The CJEU decided on 16 July 2020 to invalidate the EU-US Privacy Shield, the agreement which aims to protect the fundamental rights of anyone in the EU whose personal data is transferred to the United States for commercial purposes. It allows the free transfer of data to companies that are certified in the US under the Privacy Shield.
Privacy Shield faced many criticisms, considering that the US has not acted in a sufficiently necessary manner as is expected of it, exposing the personal data of EU citizens under US surveillance, and, as a result, the US has undermined the principle of proportionality as provided for in the GDPR.
The Court found that Privacy Shield does not sufficiently guarantee the protection of personal data under EU-US transfer and decided to strike down the agreement.
What are the consequences in the clinical sector?
It should be noted that key-coded data are not covered by the Privacy Shield, with the result that the decision handed down by the court does not impact actors in the clinical sector.
Despite this decision, and the fact that SCCs were also threatened by the court’s decision, the CJEU maintains the SCCs in effect. Clients who were already using SCCs will therefore be able to continue to use them, without the approval of the protection authorities.
