What will change in international data transfers after the EU Court of Justice invalidation of the EU-US Privacy Shield? Google moving to Standard Contractual Clauses for data transfers out of the EU.

In a major development for international data transfers, the European Union’s highest court declared that the EU-U.S. Privacy Shield arrangement — which includes thousands of participating companies — is invalid.

The Court of Justice of the European Union, however, did uphold the validity of standard contractual clauses, but there must be protections in place in the third country to which EU data is transferred — specifically with regard to access by public authorities and judicial redress.

A CJEU news release revealed that in the court’s view, “the limitations on the protection of personal data arising from the domestic law of the United States on the access and use by U.S. public authorities … are not circumscribed in a way that satisfies requirements that are essentially equivalent to those required under EU law, by the principle of proportionality, in so far as the surveillance programmes based on those provisions are not limited to what is strictly necessary.”

In the decision, the court particularly stated that Article 2(1) and (2) of the GDPR must be interpreted as meaning that that regulation applies to the transfer of personal data for commercial purposes by an economic operator established in a Member State to another economic operator established in a third country, irrespective of whether, at the time of that transfer or thereafter, that data is liable to be processed by the authorities of the third country in question for the purposes of public security, defence and State security

This will have resonance effects on EU-US data transfers that were based on the Privacy Shield agreement and may jeopardise a lot of these transfers.

For example, Google already announced that following this decision, theywill be moving to Standard Contractual Clauses (SCCs) for transfers of online advertising and measurement personal data out of the Europe Economic Area, Switzerland and the UK.  Google will  therefore be updating irs existing Google Ads Data Processing Terms, Google Ads Controller-Controller Data Protection Terms and Google Measurement Controller-Controller Data Protection Terms to add the relevant SCCs as adopted by the European Commission. Updates are made solely to address GDPR compliance. The updates do not give Google additional rights over data. If the Google Ads Data Processing Terms or Google Ads Controller-Controller Data Protection Terms are already part of your contract (or if you have separately accepted the Google Measurement Controller-Controller Data Protection Terms where available), the updates will apply from August 12, 2020.