From Safe Harbour to Advances and shortcomings of thePrivacynew EU-US data Shield transfer rules IN-DEPTH ANALYSIS EPRS | European Parliamentary Research Service Authors: Shara Monteleone and Laura Puccio Members' Research Service January 2017 — PE 595.892 EN The October 2015 Schrems judgment of the Court of Justice of the European Union (CJEU) declared invalid the European Commission’s decision on a 'Safe Harbour' for EU-US data transfer. The European Commission negotiated a new arrangement, known as Privacy Shield, and this new framework for EU-US data transfer was adopted in July 2016. This publication aims to present the context to the adoption of Privacy Shield as well as its content and the changes introduced. PE 595.892 ISBN 978-92-846-0369-5 doi:10.2861/09488 QA-06-16-293-EN-N Original manuscript, in English, completed in January 2017. Disclaimer The content of this document is the sole responsibility of the author and any opinions expressed therein do not necessarily represent the official position of the European Parliament. It is addressed to the Members and staff of the EP for their parliamentary work. Reproduction and translation for non-commercial purposes are authorised, provided the source is acknowledged and the European Parliament is given prior notice and sent a copy. © European Union, 2017. Photo credits: © vector_master / Fotolia.
[email protected] http://www.eprs.ep.parl.union.eu (intranet) http://www.europarl.europa.eu/thinktank (internet) http://epthinktank.eu (blog) From Safe Harbour to Privacy Shield Page 1 of 36 EXECUTIVE SUMMARY In the 2015 Schrems case, the Court of Justice of the European Union (CJEU) declared the European Commission's 2000 decision on the 'adequacy' of the EU-US Safe Harbour (SH) regime invalid, thus allowing data transfers for commercial purposes from the EU to the United States of America (USA).