The court kept other agreements in force that can be used between Europe and the rest of the world. So-called standard contractual clauses are only valid if the country receiving the data has protections equivalent to those set out in EU law, something security experts say the United States does not have.
That leaves thousands of companies in the lurch, said Caitlin Fennessy, director of research for the International Association of Privacy Professionals.
“I think this is the worst case scenario for American companies,” said Hennessy. “It is difficult to understand what legal option companies have. But it will demand immediate action from EU and US policy makers … for guidance and reassurance.”
Schrems celebrated the ruling. “This is a complete blow to the Irish DPC and Facebook. It is clear that the United States will have to seriously change its surveillance laws if American companies want to continue to play a role in the EU market,” he said.
Privacy Shield replaced a previous agreement called Safe Harbor, which was removed in 2015 as a result of Schrems’ complaint.
In a statement, Facebook’s associate attorney general, Eva Nagle, said she welcomed the decision to retain standard contractual clauses for certain countries.
“We are carefully considering the findings and implications of the Court of Justice decision regarding the use of the Privacy Shield and we look forward to regulatory guidance in this regard. We will ensure that our advertisers, customers and partners can continue to enjoy Facebook Services by maintaining your data safe and protected. ”
European Commission Vice President Věra Jourová said after the ruling that EU and US officials have been in close contact and have already been working on alternatives, including the possible update of the Privacy Shield agreement.
Jourová added that it will take time to analyze the decision and understand its implications.
“We will continue our work to ensure the continuity of secure data flows,” he said, “We firmly believe that in today’s globalized world it is essential to have a comprehensive toolbox for international transfers and to ensure a high level of data protection We are not starting from scratch. “
United States Secretary of Commerce Wilbur Ross said he was disappointed by the ruling and hoped “to limit the negative consequences to the $ 7.1 trillion transatlantic economic relationship that is so vital to our respective citizens, businesses and governments.”
Ross said the United States will continue to administer the Privacy Shield program as it further studies the decision.
.
