MENU
European Court of Justice

Privacy Shield Adequacy Decision Invalidated

The European Court of Justice (ECJ) invalidated the Privacy Shield adequacy decision: another milestone in the legislative development on international data protection law.

The July 16, 2020 ruling of the European Court of Justice invalidated the Privacy Shield Agreement earlier established between the EU and the USA, an utmost important decision in the field of international data protection and transfer legislation. The ruling may fundamentally reform global digital culture where the right to prosecute crime will eventually come only second to the right to protect individual citizens’ personal data.

The decision of the ECJ and the background of the proceeding
A data recipient can no longer simply refer to the adequacy of the Privacy Shield as a guarantee for safe personal data transfer outside of the EEA, as according to the ECJ it provides neither adequate protection against potential misuse nor effective legal remedies to European citizens.

The verdict was preceded by a complaint procedure initiated by an Austrian Facebook user before the Irish Data Protection Authority in 2013, as a result of which the ECJ also ruled in a preliminary ruling procedure that the Safe Harbor institutional system, the predecessor of Privacy Shield, was invalid. Following this decision, the Commission accepted the Privacy Shield Agreement, which replaced the Safe Harbor. Nevertheless, the Austrian applicant upheld the complaint and asked the authorities to ban the transfer of his personal data to the US, as Facebook's Irish subsidiary, highlighting that Facebook Ireland (the subsidiary of the US parent company) transferred his data to the US to Facebook Inc., to be eventually be exposed to the US security- and intelligence service for screening purposes, which, however, violates fundamental civil rights enshrined in the Charter of Fundamental Rights of the Union. The complainant also highlighted that US law, in its framework of extensive criminal prosecution, obliges Facebook’s parent company to provide the users’ data for security screening, no matter whether the personal data belong to foreigners (Europeans, for that matter), which, however, is contrary to the rights of citizens of the European Union enshrined in the Charter of Fundamental Rights and in the GDPR.

The data protection complaint proceeding was initiated against the Irish subsidiary of Facebook Inc. as the Irish company was responsible for the transfer of all European users’ personal data to the US parent company. The implications of the case however, extend beyond FB Ireland’s data protection law infringement: the Irish Supreme Court initiated a preliminary ruling proceeding before the ECJ, to review two data protection compliance decisions, on one hand on the Standard Contractual Clauses mechanism and on the other, the Privacy Shield Agreement, which hitherto provided the legal grounds for transferring personal data in compliance with GDPR, to non-EEA-states, including the USA. The GDPR currently in force provides that personal data, as a matter of principle, can only be transferred to third countries if the recipient state guarantees adequate data protection. The GDPR sets out that the Commission is entitled to establish whether a third country’s national law or international agreement guarantees adequate level of data protection. In lack a of so-called adequacy decision, companies established outside the EEA shall comply with additional criteria of data protection to guarantee that they may lawfully receive such data.

Such an adequacy decision was made in 2016 on the Privacy Shield, to be confirmed again in the 2017 and 2018 reviews by the European Commission, which all concluded that the mechanism provided an adequate safeguard to the transfer of personal data from Europe. In practice, the application of the mechanism meant a simple green-pass on data protection compliance criteria granted to thousands of US-based corporations that applied online for a Privacy Shield Certificate issued by the US Trade Department. Corporations that acquired the certificate were regarded as an EEA member state or a state that qualified as compliant with data protection requirements in line with the Commission’s decision. Considering that the compliance with the Privacy Shield exempted corporations from several other statutory obligations – which corporations established in third countries would otherwise be obliged to perform -, more than 5000 US corporations decided to obtain the certificate. However, the operations of these companies have changed dramatically since the latest decision of the ECJ.

The ECJ ruling highlighted that the Privacy Shield mechanism, similarly to the preceding Safe Harbor mechanism, declared the priority of state security, public order and criminal prosecution that justifies the (federal/state) authorities’ intervention to the rights of those private persons whose data were transferred from the EU to the US. The ECJ declared, in this regard, that the mechanism still failed to provide, before all, an effective system of legal remedies, which would allow the injured parties to enforce their rights before court against authorities that had possibly infringed their rights. For these reasons, the ECJ decided to invalidate the adequacy decision on the Privacy Shield Agreement.

What’s next?
Since the US-based corporations were qualified by the Commission as compliant with data protection principles only on the grounds limited to the validity of the (now void) Privacy Shield, several thousands of corporations will be obliged to transform their data transfer mechanism in the near future. The US Trade Department responded in light of the ECJ ruling that it intends to proceed with the adequacy certification process and will update the registry of member companies that joined the Privacy Shield, yet this does not mean that corporations shall wait passively for a positive outcome. Until the legal grounds for data transfer are merely certificates based on the void Privacy Shield, the ECJ and national data protection authorities will likely ignore these, and will conclude such data transfers unlawful, imposing significant amounts of penalty on the involved corporations.

At the same time the ECJ declared that the ruling will not cause a legislative gap as the GDPR expressly regulates cases and criteria that (third-country) corporations shall follow in lack of applicable adequacy decisions or any other guarantees. As for now, corporations shall review their data protection systems and processes, to ensure compliance with all GDPR criteria set out for them. Among other precautions, a company may decide to:
obtain the involved party’s express consent to data transfer;

  • certify that the data control shall take place to perform public order obligations;
  • certify that data transfer is necessary to perform contractual obligations;
  • certify that data transfer is necessary for the submission, enforcement of legal claims or protection of rights;
  • apply mandatory corporate rules;
  • apply the code of conduct approved and based on the GDPR; or
  • transfer to the use of SCC (Standard Contractual Clause) mechanism adopted by the European Commission.

No matter how an involved corporation decides to proceed, after the ECJ ruling it will no longer suffice to ground the compliance of data transfer simply by reference to a code of conduct, or in itself not even the SCC mechanism approved by the Commission. The consequences of the ruling for multinational companies is that data transferors will be obliged to carry out comprehensive and extensive investigation and evaluation of the target recipient company to determine whether the necessary guarantees of personal data protection apply in the particular recipient state. In lack of investigation, the data controlling will be held unlawful, and European member states’ data protection authorities will be obliged to suspend or ban the transfer of personal data to the US (or other non-EEA country) , if the case investigation leads authorities to conclude that the protective instruments set in the GDPR are disregarded or they contradict the existing rules of law of the recipient country, and that the protection set in the EU Charter cannot be guaranteed otherwise.

bpv Jádi Németh Attorneys at Law

No comment yet. Be the first!

Leave a Reply

Your email address will not be published. Required fields are marked *

10 − 8 =

  • Top 5 Articles


  • Articles by Date

  • Hashtags

    #Abel Prize #Academy #Academy Awards #Accenture #Accident #acquisition #Adrian Ellis #Advanced Power AG #Adventure #Advertising #Advertorial #Aerospace industry #Afghanistan #Africa #Agency #Agrarian industry #Agreement #Agricultural machinery #agriculture #Ahna Capri #air cargo #Air traffic #Air transport #air travel #Airbus Helicopters Hungary Ltd. #Airline industry #Airplane Gizi #airport cargo #Albania #Alberto Vercelli #Aldi #Alexander Tolkach #Aliza Bin-Noun #Allison Transmission Ltd. #Ambassador David B. Cornstein #Ambassador David Nájera #Ambassador Kumar Tuhin #Ambassador Massimo Rustico #Ambassador of India #Ambassador of Malaysia #Ambassador of the Republic of Korea to Hungary #Ambassadors #Ambassadors in Budapest #AmCham #American Airlines #American football #Amos Oz #Andersen Consulting #András Simor #Andrea Jádi #Andrew G. Vajna #Angela Merkel #Angola #Animals #Ankita Sood #Anna Nánási #Anna Olasz #anniversary #Annual report #Antal Rogán #Antal Vöneki #Anthony Nolan foundation #Antro Moveo #Apple Design Awards #Ararat #archeological excavations #Archeology #Armenia #Arms trade #Arraiolos Group #Arrow Architects #art gallery #Art Hall #Art treasure #ASEAN #Association of Immortal Hungarian Athletes #Association of Innovative Pharmaceutical Manufacturers #aston martin #Astronomy #Athlete of the Nation #Attila Grandpierre #Attila Mesterházy #Audi #Audi Hungaria #August 20th #August 20th national holiday #Australia #Austria #Automobile industry #Automobile sales #automobile trade #automotive #Automotive industry #Automotive sector #AutoWallis Group #Avatar #Aviation industry #Award #Azerbaijan
    #bag tag #bakery #Balassagyarmat #Balaton #Bálint gazda (Master Bálint) #Ballet company of Gyõr #Bálna event center #Baltic Sea Festival #Baltic states #Ban Ki-moon #Bank for International Settlements #bank loan #Bank of China #Bank transfer #Banking #Banking sector #Banking system #banknotes #Barack Obama #BASF #basketball #battery production #BBC #Beer #Béla Bartók #Belgium #Bell Food Group #Benelux #Best of Budapest and Hungary #BHS Trans Limited #bicycle #bilateral agreement #Bilateral relations #Bio ethanol #Biotechnology #Bisnode Hungary #Bisserka Benisheva #BKV #BMW #BMW cars #BMW Group #Boglárka Kapás #Bond issue #bond market #book festival #book review #border crossing #BorderLINE Architecture #Bozsik Stadium #brandy #Brazil #Brazilian Development Bank (BNDES) #Brexit #British Ambassador #British Chamber of Commerce in Hungary #British Council #British Telecom #Broadband internet #Bronislaw Komorowski #Budakalász #Budapest #Budapest Airport #Budapest Airport Co. Ltd. #Budapest Chamber of Commerce and Industry (BKIK) #Budapest City Branding Nonprofit Ltd. (BVA) #Budapest Eurogames 2012 #Budapest Festival Orchestra #Budapest film #Budapest Fire Service #Budapest ghetto #Budapest Highland Golf Club #Budapest hospitals #Budapest Jewish Community (BZSH) #Budapest Marathon #Budapest Mayor Gergely Karácsony #Budapest Millennium Underground #Budapest Opera Ball #Budapest Sports Office #Budapest Stock Exchange #Budapest Strings Chamber Orchestra #Budapest Week Publishing #Budapest Zoo #Budapest Zoo and Botanical Garden #Buddhism #Budget policy #Bulgaria #Bundesliga (Austria) #burglary #business #Business club #business costs #Business Council for Sustainable Development in Hungary (BCSDH) #Business Council for Sustainable Development in Hungary’s (BCSDH) #Business environment #Business promotion #Business services #Businesspeople #Busójárás #Butterfly Garden
    #cable car #campaign financing #Canada #Canadian Chamber of Commerce in Hungary #Cancún Climate Summit #Canoe #capacity increase #Capital Circus of Budapest #car market #car racing #car rental #car sales #car sharing service #Car trade #Card payments #Carl Bildt #Carnival season #cars #Cartel #Cash #Cash payment #CEE region #Celldömölk #Census #Center for Budapest Transport (BKK) #Center of Excellence #Central Europe #Central European Initiative #Central European Press and Media Foundation (Kesma) #Central European University #Central European University (CEU) #Central Statistical Office #Ceremony #CERN #Cervantes Institute #Cetelem Bank #Chamber #Chamber of commerce #Chang Sun Dong #Charbel Stephan #Charity #Chemical Industry #Chemistry #chess #Chief Medical Officer Cecíla Müller #Chief Medical Officer Cecília Müller #China #Christian Mühlethaler #Christmas #Chung-ha Suh #CIG Pannonia Life Insurance Plc. #cinema culture #Citibank #City diplomacy #Civil engineering #Civil Movement #CLA 250 e Coupé #CLA 250 e Shooting Brake #climate change #CMS Cameron McKenna #cobot #Code of Civil Procedure #Colleen Bell #Colliers International #Colorful City Group #columbia #Commemoration #Commemorative coin #Commerce #Commercial accommodation #Communications #Competition #Competitiveness #Concert #Conference #Conscious Consumption #Constitution #Constitutional Court #Construction #Construction industry #Consuls #Consultancy #consumer confidence index #Consumer prices #contemporary art #contest #Convention tourism #Convertiplane #COP26 #Cordia #Corinthia Hotel Budapest #coronavirus #Corporate issues #corporate merger #Corporate real estate #Corporate social responsibility (CSR) #Corruption #countryside #Courts #Covid-19 coronavirus #Covid-19 pandemic #Crime #crisis #Crisis management #Croatia #cronyism #Csodalámpa (Magic Lamp) Foundation #Csopak #cultural festival #cultural institute #Cultural Interview #Culture #Customer service #customs service
    #D.C. #Dag Hartelius #Daikin #Dalai Lama #Dániel Gyurta #Danube #Danube Bend #Danube cruise #Darfur region #Debrecen #Debt #decision-making #Defense #defense industry #Deloitte #Deloitte Digital Hungary #Deloitte Hungary #Deloitte Technology Fast 500 EMEA list #Delta Group #Democracy #Democrats Abroad-Hungary #Demonstration #Denmark #Denso Manufacturing Hungary #dental tourism #Deputy CEO of the Hungarian Tourism Agency (MTÜ) #Deutsche Telekom #Deutsche Telekom IT and Telecommunications Hungary #Deutscher Wirtschaftsclub – DWC #Development program #Digital banking #digital channels #digital classroom #Digital education #Digitalization #Dimitris Yannakakis #dinosaurs #Diósgyőr Castle #Diplomacy #Diplomacy and Trade Business Club ('The Club') #Diplomatic Spouses of Budapest #Disability Caucus #Disadvantaged people #Disaster #Disaster Management #Disaster management legislation #disinfectant #Dividend payments #Domestic issues #Domestic tourism #Dominik Szoboszlai #donation #Dr. Andrea Jádi Németh #Dr. György Kárpáti #Dr. János Szlávik #Dr. László Szabó #Dreher Breweries #Drugs #DT April 2009 #DT April 2010 #DT April 2011 #DT Business & Culture Club #DT December 2009 #DT February 2009 #DT February 2012 #DT January 2011 #DT January-February 2013 #DT July-August 2011 #DT June 2009 #DT June 2011 #DT March 2011 #DT May 2010 #DT May 2011 #DT November 2010 #DT October 2008 #DT October-November 2011 #DT September 2009 #Dual education #Duna Elektronika #Duna House #Dyntell Hungary Ltd.
    #e-mobility #E.ON #East Central Europe #Easter #ECOFIN #Economic forecast #economic reform #Economic relations #Economic sentiment index #Economy #Edit Herczog #Education #Eger #Egypt #Eisberg #EIT Health #Elderly home #Elections #Elections in Hungary #Electric charger #Electricity #electricity industry #Electro-mobility #Electrolux #Electronic industry #Electronic payment #Electronic Payment Service Providers’ Association (EFISZ) #Electronic Payment Strategy (EPS) #Electronics industry #Eleni Tsakopoulos-Kounalakis #ELTE #EMEA region #Emergency #Emigration #Emmy Awards #Employees’ rights #Employment #Enda Kenny #Endre Szemerédi #Energy industry #energy policy #energy security #Energy supply #Engineering #Enikõ Gyõri #Enrique Pastor de Gana #Environment #environment protection #Eörs Szathmáry #epidemic #Epidemiological preparedness #epidemiological restrictions #Equifest #Ernõ Rubik #Erste Bank #Ervin Zádor #Esther Horvath #Eszter Cseke and Andras S. Takacs #Esztergom #Ethanol #EU #EU affairs #EU cooperation #EU funding #EU funds #EU General Court #EU loan #EU Presidency #EU supported projects #EuCham - European Camber #Eucham European Chamber #Euro (EUR) #Europe Day #European Automobile Manufacturers Association (ACEA) #European Capital of Culture #European Central Bank (ECB) #European Championships #European Climate Bank #European Commission #European Court of Justice #European Court of Justice (ECJ) #European Day of Parks #European Football Championship #European Green Deal #European Institute of Innovation and Technology (EIT) #European Molecular Biology Organization (EMBO) #European Parliament #European Union #European Year of Volunteering #Eurowings #evacuation #Exchange rate #Exhibition #Exhibition site #Export promotion #Exports #Exposition #External Action Service of the European Union #External trade
    #H-UNCOVER #Hableány (‘Mermaid’) river cruise ship #Hackathon #Haiti #Hamad International Airport #handball #Hankook #Használtautó.hu #Health #healthcare #Healthcare workers #Heat record #Heavy industry #Heim Pál National Pediatric Institute #Heineken #HEINEKEN Hungária #Henkel #Herbert Fisch #Herman Van Rompuy #Hidden Power #Hillary Clinton #History #Hódmezővásárhely #Holiday season #Hollywood #Holocaust #Home office #Home quarantine #Homokhátság #Honorary consul #Honorary consuls #Horizon Development #Hörmann Hungária #horticulturist #Hortobágy National Park #hospital #Hospitality #Hospitality business #Hospitals #Hotel boats #hotelier #hotels #House concert #Household products #Housing #Housing market #Hoventa #huawei #Human rights #Hungarian Academy of Sciences #Hungarian Academy of Sciences (MTA) #Hungarian Ambassador to the U.S. #Hungarian Banking Association #Hungarian Chamber of Health Care Professionals (MESZK) #Hungarian cultural season #Hungarian Democratic Forum (MDF) #Hungarian diplomats #Hungarian economy #Hungarian EU Presidency #Hungarian European Business Council (HEBC) #Hungarian F-1 Grand Prix #Hungarian Film Week #Hungarian Foreign Ministry #Hungarian Foreign Ministry (Ministry of Foreign Affairs and Trade) #Hungarian forint (HUF) #Hungarian GDP #Hungarian gov't vs. EU #Hungarian government #Hungarian Independent Trans­mission Operator Company Ltd. (MAVIR) #Hungarian industry #Hungarian Interchurch Aid #Hungarian inventors #Hungarian Investment and Trade Agency (HITA) #Hungarian Investment Promotion Agency (HIPA) #Hungarian Labor Code #Hungarian language #Hungarian Maltese Charity Service #Hungarian Medical Chamber #Hungarian military #Hungarian Ministry of Finance #Hungarian Ministry of Foreign Affairs and Trade (KKM) #Hungarian Museum of Science #Hungarian Museum of Science Technology and Transport #Hungarian National Asset Management Inc. (MNV) #Hungarian National Gallery #Hungarian National Museum #Hungarian Olympic Committee (HOC) #Hungarian Open Air Museum #Hungarian Parliament #Hungarian President János Áder #Hungarian Press Photo Exhibition #Hungarian society #Hungarian Tourism Agency (MTÜ) #Hungarian-born #Hungarians abroad #Hungaricum #Hungaroring #Hungary #Hungary tourism #Hungexpo #hybrid car #Hygiene #Hyundai
  • © Copyright 2020 Duax Kft. –  All rights reserved.
    searchenvelope-oalign-justifytwitterfacebookfeedinstagrammoon-osunearth