The aim of this article is to provide a summary of the legal ground rules for the transfer of personal data to the United States following the ECJ declared the decision of the European Commission on the EU-US Privacy Shield program invalid. The author outlines the general principles of transfer of personal data to third countries in view of the regulations of Chapter 5 of the GDPR, analyzes the presumptions of the Privacy Shield program, and assesses the post-invalidation landscape. The author analyzes the Schrems II judgment, the complaint of M. Schrems, the questions submitted to the CJEU for a preliminary ruling, and describes the key points of the judgment in case file no. C-311/18. The article also provides a brief historical overview of the developments that resulted in the CJEU issuing the aforementioned judgment.
JavaScript is turned off in your web browser. Turn it on to take full advantage of this site, then refresh the page.