EU watchdogs warn that there is no grace period after Schrems II ruling and transfers of personal data from EU to US relying on Privacy Shield are now illegal
Context & Ripple Effects
The end of Privacy Shield was set in motion long before this week: a legal challenge was accepted by the General Court back in mid-2019, and an adviser to the EU's top court flagged deep uncertainty about the mechanism's future in December. When the Court invalidated the framework days ago, it left thousands of certified companies — including Facebook — legally exposed overnight.
First-order effects
- Companies relying on Privacy Shield for EU-to-US personal data transfers are now making illegal transfers as of now, per EU watchdogs, with no transition window to rework their compliance setups.
- SMBs — the bulk of the 5,384 certified companies — bear the sharpest immediate burden because they lack the legal and infrastructure resources large firms can deploy to switch transfer mechanisms quickly.
Second-order effects
- Large transatlantic data exporters like Facebook, named in the Court ruling coverage, must adopt alternative transfer arrangements, and the scale of that migration will shape which replacement mechanisms gain market acceptance.
- Pressure builds on EU and US negotiators to craft a successor pact, since Privacy Shield was itself created in 2016 specifically to ease movement of personal information between the blocs — and its collapse reopens that gap.
Third-order effects
- If each negotiated transfer framework keeps proving legally fragile at the EU court level, companies will increasingly treat US data storage as a compliance risk, pushing localization of EU personal data inside the bloc.
- Regulatory enforcement becomes the binding constraint on transatlantic digital trade: the pace of watchdog action, not corporate preference, sets how fast thousands of firms must restructure data flows.
The trend: Transatlantic personal data flows are shifting from resting on negotiated EU-US pacts to being governed by EU court rulings and enforcement cadence, with each invalidation raising the compliance cost of moving data westward.