EU's top court strikes down flagship EU-US data transfer mechanism Privacy Shield, in a ruling that could impact thousands of companies including Facebook
This is the second time the EU's top court has killed a transatlantic transfer framework — it struck down the Shield's predecessor agreement back in 2015, warning then that mining EU users' data was about to get harder. The writing was also on the wall: a legal adviser's complex opinion last December had already injected uncertainty about whether Privacy Shield could survive scrutiny.
What changed today is that uncertainty became a verdict: the Court of Justice of the European Union invalidated the flagship mechanism outright, and the fallout lands on the 5,384 companies certified under it — from Facebook down to thousands of small businesses.
First-order effects
Thousands of Privacy Shield-certified companies, with Facebook the most prominent name, lose their primary legal basis for transferring EU users' personal data to the US effective immediately.
EU watchdogs followed within days with a warning that there is no grace period after the ruling — meaning Shield-reliant transfers are not merely at risk but already illegal, removing any transition cushion.
Second-order effects
SMBs make up 70% of the 5,384 certified companies and face the biggest compliance challenge (per the Protocol analysis), since most lack the legal resources to rapidly rebuild transfer mechanisms that large firms keep on retainer.
Facebook and other US platforms serving EU users must pivot to alternative transfer arrangements or restructure where EU user data is stored and processed, turning legal plumbing into an immediate product and operations decision.
Third-order effects
With a 2015 strike-down and now this ruling, the pattern shows court-invalidated bilateral deals cannot anchor EU-US data flows durably — pressuring negotiators toward a framework that survives judicial scrutiny of how US authorities access transferred data.
The no-grace-period enforcement posture sets a precedent that regulators will not cushion future framework collapses, raising the compliance risk premium on any single-mechanism dependency and nudging firms toward regionalized data architectures.
The trend: Court rulings are invalidating transatlantic data-transfer frameworks faster than replacements can be negotiated, forcing companies that move EU personal data toward alternative legal mechanisms or localized storage.
ECJ: the Decision on the adequacy of the protection provided by the EU-US Data Protection Shield is invalidated, but @EU_Commission Decision on standard contractual clauses for the transfer of personal data to processors established in third countries is valid #Facebook #Schrems …
BREAKING: The EU's Court of Justice has just invalidated the “Privacy Shield” data sharing system between the EU and the US, because of overreaching US surveillance. All details available here: https://noyb.eu/en/cjeu #PRISM #FISA702 #Privacy #PrivacyShield #SCCs #GDPR #CJEU
Woah. I'm just catching the statement from the Irish Data Protection Commission now, but they very much agree that “the application of the SCCs transfer mechanism to transfers of personal data to the United States is now questionable” https://twitter.com/...
Facebook statement on ECJ Schrems ruling: We welcome the decision of the Court of Justice of the European Union to confirm the validity of Standard Contractual Clauses for transfers of data to non-EU countries.
After a first read of the judgement on #PrivacyShield it seems we scored a 100% win - for our privacy The US will have to engage in serious surveillance reform to get back to a “privileged” status for US companies. More details here: https://noyb.eu/en/cjeu #ThanksToEveryone!
The #ECJ has delivered its decision in #SchremsII. @Microsoft services will continue for customers, in compliance with European law. Here's more on how we will work to preserve #privacy and cross-border data flows: https://blogs.microsoft.com/ ...
CJEU, data protection law Schrems II judgment: the “Privacy Shield” data protection adequacy decision re personal data transfers to the USA is invalid. The decision on “standard contractual clauses” used as a backup is valid, but must be strictly interpreted. https://twitter.com/…
@1Br0wn @EUCourtPress @grahamgreenleaf @tjmcintyre I had dinner with Jane Horvath after Schrems I. She was angry that such a vital part of Apple's business model was so fragile and was going to make sure it didn't happen again. I think she knew from the start SCCs were more robus…
Looks like the Court agrees with @maxschrems - it is for DPAs to strike down SCCs with certain countries, rather than throwing the mechanism itself out, and the Court decides to answer the Privacy Shield questions (the AG said they did not need to), and strikes it down. https://t…
SCCs now haunted by the question of how an underfunded DPA examines all of a third country's laws and assessed whether SCCs remain valid, when they can't even take complaints effectively in their own legal system.
MY recommendation to US Congress after Schrems I decision (2015): 1. Enact comprehensive privacy law, 2. Update Privacy Act, 3. Establish US DPA, and 4. Ratify COE 108 @SSRN https://papers.ssrn.com/... https://twitter.com/... https://twitter.com/...
Today, EU top court CJEU agreed with Schrems, and nuked Privacy Shield, which means that firms that operate in the EU will no longer be allowed to process Europeans' data outside of Europe. https://curia.europa.eu/... 4/
European Court rules that Big Tech can't store EU resident's data on US servers. Big headache for these companies, but also marks a continuing divergence between the EU's stance toward privacy online and the United States. https://www.wsj.com/...
Mmm. Facebook phoned me after the first @maxschrems judgment and asked me to write a legal opinion arguing basically the opposite of the CJEU judgment they say they “welcome” today (I said no). This is about as plausible as when their VP promised to abolish uni tuition fees. http…
😂😂😂 #PeakBullshit of the day... @Facebook “welcomes” the #CJEU decision under which they can't use #PrivacyShield and the #SCCs anymore... #YouCantMakeItUp https://twitter.com/...
Interesting: Apple “uses approved Model Contractual Clauses for the international transfer of personal information collected in the European Economic Area and Switzerland.” SCCs just *upheld* by @EUCourtPress in #SchremsII! /cc @grahamgreenleaf @tjmcintyre https://www.apple.com/.…
@maxschrems Congratulations Max. It causes a lot of mayhem all over again (and a lot of work), but I'm also happy there are people who continue to fight for our fundamental rights in Court.
@EUCourtPress @EU_Commission Curious, here's the list of 5378 companies/organizations affected by today's decision: https://www.privacyshield.gov/ list
The alternative route of standard contractual clauses under GDPR exists, but that's a high bar too. For transfers between EU Member States' and non-EU law enforcement bodies there's a different law: https://eur-lex.europa.eu/... Adequacy decisions similar but there are alternativ…
As a privacy advocate, I am totally fine and see the legal argument by the EU here. What I want to see however if Europe enforce this on Chinese tech firms and companies. They won't and they don't. Europeans would be floored to see what China has on them https://www.wsj.com/...
3/ ...in relation to the use of Privacy Shield and we look forward to regulatory guidance in this regard. We will ensure that our advertisers, customers and partners can continue to enjoy Facebook services while keeping their data safe and secure." Eva Nagle, Facebook
2/ “These are used by Facebook and thousands of businesses in Europe and provide important safeguards to protect the data of EU citizens. Like many businesses, we are carefully considering the findings and implications of the decision of the Court of Justice...
🤗 this is some world-class spin by Facebook in its statement. The reality is Facebook had the U.S. Government and Irish Data Protector as its wingmen and still got rolled by a freight truck here. https://twitter.com/...
Statement by Max Schrems / NOYB: https://noyb.eu/en/cjeu Background info on the case: https://noyb.eu/... FAQs on the case and possible consequences: https://noyb.eu/... Most common errors in reporting on the case: https://noyb.eu/...