EU's top court strikes down flagship EU-US data transfer mechanism Privacy Shield, in a ruling that could impact thousands of companies including Facebook
A highly anticipated ruling by Europe's top court has just landed — striking down a flagship EU-US data flows arrangement called Privacy Shield.
TechCrunch Natasha Lomas
Context & Ripple Effects
This ruling lands five years after the EU's courts struck down its predecessor agreement for the same underlying reason — US surveillance practices failing to meet EU data-protection standards — and eleven days after an adviser to the EU's highest court had already signaled trouble in a complex legal opinion that added uncertainty around Privacy Shield's future. The pattern was visible well before today; what changed is that uncertainty is now a verdict.
First-order effects
- Thousands of certified companies — including Facebook — lose their legal basis for moving EU personal data to US servers immediately, and per the watchdogs' later warning there is no grace period: transfers relying on Privacy Shield are now illegal outright.
- The compliance burden falls hardest on small businesses, which make up 70% of the 5,384 companies certified and lack the lawyers and engineering budgets of firms like Facebook to rework data flows.
Second-order effects
- Facebook and other US platforms face pressure to localize EU user data inside Europe or restructure transfers under alternative mechanisms, turning data-residency architecture into a competitive cost for every US service operating in the EU market.
- EU regulators gain enforcement leverage they lacked under the old framework, since the ruling converts a policy dispute into a clear legal line they can enforce against named violators.
Third-order effects
- With both transatlantic transfer frameworks now invalidated on the same surveillance grounds, a durable fix requires changes to US law itself — meaning EU-US data flows become structurally dependent on legislative action rather than bilateral corporate agreements, a recurring cycle if the pattern holds.
The trend: EU-US personal-data flows are being repeatedly invalidated by court rulings rather than negotiated stability, forcing US tech firms toward structural data localization.
Related: Privacy Shield · Facebook · SMBs make up 70% of the 5,384 companies certified · EU watchdogs warn there is no grace period after Schrems II
Related Coverage
- CJEU Judgment - First Statement noyb.eu
- Assuring Customers About Cross-Border Data Flows EU Policy Blog · Julie Brill
- EU's Top Court Restricts Personal-Data Transfers to U.S., Citing Surveillance Concerns Wall Street Journal
- EU court voids data-sharing pact with the U.S. in Facebook privacy case CNBC · Silvia Amaro
- Top E.U. court ruling throws transatlantic digital commerce into disarray over privacy concerns Washington Post · Michael Birnbaum
- Blockbuster Schrems decision to impact nearly every business The Irish Times
- The Court of Justice invalidates Decision 2016/1250 on the adequacy of the protection provided … Court of Justice of the European Union
- Assuring customers about EU cross-border data flows Microsoft on the Issues · Julie Brill
- U.S. Secretary of Commerce Wilbur Ross Statement on Schrems II Ruling and the Importance of EU-U.S. Data Flows U.S. Department of Commerce
- Insufficient protection against Government access EAID · Peter Schaar
- YouTube not liable for user copyright breaches, EU court adviser says Reuters · Marine Strauss
- European court strikes down EU-US Privacy Shield user data exchange agreement as invalid ZDNet · Charlie Osborne
- What U.S. companies should consider following the bombshell EU Privacy Shield ruling Fortune
- Tech firms like Facebook must restrict data sent from EU to US, court rules The Guardian · Alex Hern
- Privacy activist Schrems welcomes EU court decision on Facebook Reuters · Kirsti Knolle
- EU court strikes down EU-US data protection deal Politico · Vincent Manancourt
- Europe's highest court has ruled that Privacy Shield is invalid WIRED UK · Alex Lee
- US-EU Privacy Shield data-sharing pact invalidated over surveillance fears CNET · Katie Collins
- A victory for us all: European Court of Justice makes landmark ruling to invalidate the Privacy Shield EDRi
- EU court invalidates Privacy Shield data transfer agreement CSO · Dan Swinhoe
- Court bans mass transfer of personal data of EU citizens to US companies 9to5Mac · Ben Lovejoy
- “You Were Only Supposed to Blow the Bloody Doors Off!”: Schrems II and external transfers of personal data EU Law Analysis · Steve Peers
- EU-US Privacy Shield failed to protect data of EU citizens, court rules iMore · Stephen Warwick
- EU strikes down key US data sharing protocol, citing threat of mass surveillance The Verge · James Vincent
- Top EU court rules data transfer deal with US is invalid The Hill · Justin Wise
- EU court rules EU-US data protection agreement invalid RTÉ · Tony Connelly
- EU court rejects data-sharing deal due to privacy concerns UPI · Don Jacobson
- Pact allowing EU data flow from Facebook and others to U.S. ruled invalid newseu.cgtn.com · Tim Hanlon
- Europe's top court kills Privacy Shield that allowed US data sharing Engadget · Steve Dent
- EU court rules Privacy Shield data protection tool to be invalid Silicon Republic · Colm Gorey
- Internet service provider privacy law not preempted but still bad policy American Enterprise Institute · Daniel Lyons
- EU court strikes down landmark transatlantic data privacy pact Axios · Ashley Gold
- EU top court rejects EU-US data transfer tool, backs another tool The Irish Times
Discussion
-
@eucourtpress
@eucourtpress
on x
ECJ: the Decision on the adequacy of the protection provided by the EU-US Data Protection Shield is invalidated, but @EU_Commission Decision on standard contractual clauses for the transfer of personal data to processors established in third countries is valid #Facebook #Schrems …
-
@maxschrems
@maxschrems
on x
BREAKING: The EU's Court of Justice has just invalidated the “Privacy Shield” data sharing system between the EU and the US, because of overreaching US surveillance. All details available here: https://noyb.eu/en/cjeu #PRISM #FISA702 #Privacy #PrivacyShield #SCCs #GDPR #CJEU
-
@maxschrems
@maxschrems
on x
After a first read of the judgement on #PrivacyShield it seems we scored a 100% win - for our privacy The US will have to engage in serious surveillance reform to get back to a “privileged” status for US companies. More details here: https://noyb.eu/en/cjeu #ThanksToEveryone!
-
@juliesbrill
Julie Brill
on x
The #ECJ has delivered its decision in #SchremsII. @Microsoft services will continue for customers, in compliance with European law. Here's more on how we will work to preserve #privacy and cross-border data flows: https://blogs.microsoft.com/ ...
-
@tconnellyrte
Tony Connelly
on x
Facebook statement on ECJ Schrems ruling: We welcome the decision of the Court of Justice of the European Union to confirm the validity of Standard Contractual Clauses for transfers of data to non-EU countries.
-
@kierenmccarthy
Kieren McCarthy
on x
Microsoft knew exactly what it was doing when it hired former FTC Comm Brill and boy has that paid off today https://twitter.com/...
-
@stevepeers
Steve Peers
on x
Mmm. Facebook phoned me after the first @maxschrems judgment and asked me to write a legal opinion arguing basically the opposite of the CJEU judgment they say they “welcome” today (I said no). This is about as plausible as when their VP promised to abolish uni tuition fees. http…
-
@maxschrems
Max Schrems
on x
😂😂😂 #PeakBullshit of the day... @Facebook “welcomes” the #CJEU decision under which they can't use #PrivacyShield and the #SCCs anymore... #YouCantMakeItUp https://twitter.com/...
-
@marcrotenberg
Marc Rotenberg
on x
MY recommendation to US Congress after Schrems I decision (2015): 1. Enact comprehensive privacy law, 2. Update Privacy Act, 3. Establish US DPA, and 4. Ratify COE 108 @SSRN https://papers.ssrn.com/... https://twitter.com/... https://twitter.com/...
-
@europaulb
Paul Breitbarth
on x
@maxschrems Congratulations Max. It causes a lot of mayhem all over again (and a lot of work), but I'm also happy there are people who continue to fight for our fundamental rights in Court.
-
@grabancijas
Grabancija&scaron
on x
@EUCourtPress @EU_Commission Curious, here's the list of 5378 companies/organizations affected by today's decision: https://www.privacyshield.gov/ list
-
@stevepeers
Steve Peers
on x
The alternative route of standard contractual clauses under GDPR exists, but that's a high bar too. For transfers between EU Member States' and non-EU law enforcement bodies there's a different law: https://eur-lex.europa.eu/... Adequacy decisions similar but there are alternativ…
-
@sophieintveld
Sophie
on x
A victory for personal data protection, but a crushing defeat for @EU_Commission over legality of data transfer scheme. I call on the Commission to stop stubbornly ignoring the expert advice and repeated calls from @Europarl_EN on #PrivacyShield #SchremsII https://twitter.com/...
-
@tconnellyrte
Tony Connelly
on x
3/ ...in relation to the use of Privacy Shield and we look forward to regulatory guidance in this regard. We will ensure that our advertisers, customers and partners can continue to enjoy Facebook services while keeping their data safe and secure." Eva Nagle, Facebook
-
@wolfiechristl
Wolfie Christl
on x
Statement by Max Schrems / NOYB: https://noyb.eu/en/cjeu Background info on the case: https://noyb.eu/... FAQs on the case and possible consequences: https://noyb.eu/... Most common errors in reporting on the case: https://noyb.eu/...
-
@narcaware
@narcaware
on x
The single most greatest reason to expose this Govt for the treasonous poisoned shitshow it is. Britain is in a precarious perilous position because they put their amoral interests above #NationalSecurity of UK and its Neighbours. Our safety is in serious jeopardy. https://twitte…
-
@jason_kint
Jason Kint
on x
💣 is there anything which Facebook doesn't mess up for the rest of the world? https://twitter.com/...
-
@paulbernaluk
Paul Bernal
on x
And implications for the UK post-Brexit, as UK surveillance has potentially similar levels of overreach. No simple UK version of the privacy shield will be possible now. https://twitter.com/...
-
@alanbeattie
Alan Beattie
on x
The dudes in robes down in Luxembourg are having a corker of a week https://twitter.com/...
-
@linnetelwin
Linnet Taylor
on x
and a great quote from @maxschrems: “This judgment is not the cause of a limit to data transfers, but the consequence of US surveillance laws. You can't blame the Court to say the unavoidable - when shit hits the fan, you can't blame the fan.” https://twitter.com/...
-
@hadas_gold
Hadas Gold
on x
Another big ECJ decision, on security of data being transferred to US. My first reading of this (still going through) is this is a big ruling (us/eu privacy shield dead!) but not nuclear-end-of-world stuff as SCC's still valid. Of course big Q - how will Trump admin reax? https:/…
-
@paultang
Paul Tang
on x
Hurray! 🔥 Ruling @EUcourtPress sends the @EU_Commission back to the drawing board, because the EU-US Privacy Shield doesn't protect privacy standards. Come on EC, time to put fundamental rights first, before geopolitics. #SchremsII https://twitter.com/...
-
@webdevlaw
Heather Burns
on x
For years, the US has defiantly refused to reform its surveillance powers, or implement a Federal-level privacy law which respects privacy as a human right and safeguards the data of non-Americans. The CJEU has just ruled that enough is enough. https://twitter.com/...
-
@baldingsworld
@baldingsworld
on x
As a privacy advocate, I am totally fine and see the legal argument by the EU here. What I want to see however if Europe enforce this on Chinese tech firms and companies. They won't and they don't. Europeans would be floored to see what China has on them https://www.wsj.com/...
-
@raoulruparel
Raoul Ruparel
on x
From a Brexit perspective, positive that standard contractual clauses are upheld - lots of businesses on both sides relying on them. But invalidation of Privacy Shield highlights concerns around onward data transfer to US - an issue when it comes to UK being seen as adequate http…
-
@glynmoody
Glyn Moody
on x
also has implications for UK if it wants adequacy... https://twitter.com/...