Invalidation of European Commission Decision (EU) 2016/1250

on the EU-US Privacy Shield

By its judgment of the 16th of July 2020 in Case C-113/18, the Court of Justice of the European Union invalidates the Commission Implementing Decision (EU) 2016/1250 of 12 July 2016 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the EU-U.S. Privacy Shield.

Thus, the Court examined the validity of the European Commission Decision (EU) 2016/1250 in light of the requirements arising from the Regulation (EU) 2016/679, taking into account the provisions of the Charter guaranteeing respect for the private and family life, personal data protection and the right to effective judicial protection.

In the view of the Court, the limitations on the protection of personal data arising from the domestic law of the United States on the access and use by US public authorities of such data transferred from the EU to that third country are not circumscribed in a way that satisfies the requirements that are essentially equivalent to those required under the EU law, by the principle of proportionality, in so far as the surveillance programmes based on those provisions are not limited to what is strictly necessary.

At the same time, the Court pointed out that, although these provisions set out the requirements that the US authorities must comply with when implementing the surveillance programmes in question, the provisions do not grant the data subjects rights of action before the courts against the US authorities.

As regards the requirement of judicial protection, in the view of the Court, the Ombudsperson mechanism for the Privacy Shield does not provide guarantees equivalent to those required by the EU law, such as to ensure both the independence of the Ombudsperson provided for by that mechanism and the existence of rules empowering the Ombudsperson to adopt decisions that are binding on the US intelligence services. In this respect, the Courts notes that, although Recital (120) of European Commission Decision (EU) 2016/1250 mentions a commitment of the US government that the intelligence component should be obliged to remedy any non-compliance with the applicable rules detected by the Ombudsperson for the Privacy Shield, that decision does not contain any indication that the Ombudsperson is empowered to adopt binding decisions in respect of those services, nor does it state the legal safequards which would accompany that commitment and which could be invoked by the data subjects so that, consequently, the Ombudsperson mechanism, provided for in the European Commission Decision (UE) 2016/1250, does not provide a judicial remedy to a body that provides persons whose data are transferred to the US with guarantees essentially equivalent to those provided for in Article 47 of the Charter of Fundamental Rights of the European Union.

On all those grounds, the Court of Justice of the European Union declares the Commission Implementing Decision (EU) 2016/1250 of 12 July 2016 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the EU-U.S. Privacy Shield invalid. The Court judgement is available at the following link: http://curia.europa.eu/juris/document/document.jsf?text=&docid=228677&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=10304093.

At the same time, during the Plenary of the European Data Protection Board, organised remotely on the 17th of July 2020, the Statement on the invalidation by the Court of Justice of the European Union of the Commission Implementing Decision (EU) 2016/1250 of 12 July 2016 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the EU-U.S. Privacy Shield was adopted.

In such situation, in the absence of an adequacy decision under Article 45 paragraph (3) of the Regulation (EU) 2016/679, the transfer of personal data to the US may take place in accordance with one of the following instruments provided by Article 46 of the Regulation (EU) 2016/679:

• standard data protection clauses,
• binding corporate rules,
• codes of conduct and certification mechanisms.

Also, the transfer of personal data to US may be performed under the derogations provided in Article 49 of the Regulation (EU) 2016/679.

The English version of the EDPB Statement is available at the following link: https://edpb.europa.eu/news/news/2020/statement-court-justice-european-union-judgment-case-c-31118-data-protection_en.