The Court of Justice of the European Union revoked the Privacy Shield agreement for transfer of data to the USA
The General Data Protection Regulation requires personal data of persons residing in the EU to be transferred to third countries only when these countries provide adequate measures for the data’s protection. GDPR explicitly grants an opportunity to the European Commission to accept that certain countries meet this requirement – which allows easier data transfer to the latter. To the moment such a decision was in effect with regard to the USA on basis of a concluded data protection agreement – EU – US Privacy Shield – which should guarantee adequate measures for the protection of EU residents’ personal data to be transferred to the USA.
On 16.07.2020 the Court of Justice of the EU fully revoked the decision of the European commission, whereas the court accepted that such adequate measures for data protection have not been adopted in the US. Until a new agreement is reached concerning the data protection measures and a new decision of the European commission is decreed, the data transfers to the US shall be hampered, whereas in every case an assessment shall have to be made whether a permission from the competent authority in the respective EU member state should be required prior to the transfer.