Transfer of personal data to the United States after the invalidation of the decision regarding the EU-US Privacy Shield

The aim of this article is to provide a summary of the legal ground rules for the transfer of personal data to the United States following the ECJ declared the decision of the European Commission on the EU-US Privacy Shield program invalid. The author outlines the general principles of transfer of personal data to third countries in view of the regulations of Chapter 5 of the GDPR, analyzes the presumptions of the Privacy Shield program, and assesses the post-invalidation landscape. The author analyzes the Schrems II judgment, the complaint of M. Schrems, the questions submitted to the CJEU for a preliminary ruling, and describes the key points of the judgment in case file no. C-311/18. The article also provides a brief historical overview of the developments that resulted in the CJEU issuing the aforementioned judgment.

The aim of this article is to provide a summary of the legal ground rules for the transfer of personal data to the United States following the ECJ declared the decision of the European Commission on the EU-US Privacy Shield program invalid. The author outlines the general principles of transfer of personal data to third countries in view of the regulations of Chapter 5 of the GDPR, analyzes the presumptions of the Privacy Shield program, and assesses the post-invalidation landscape. The author analyzes the Schrems II judgment, the complaint of M. Schrems, the questions submitted to the CJEU for a preliminary ruling, and describes the key points of the judgment in case file no. C-311/18. The article also provides a brief historical overview of the developments that resulted in the CJEU issuing the aforementioned judgment.