Having mishandled Safe Harbor, will the CJEU do better with Privacy Shield? A US perspective

Abstract

An improvident, but final and unreviewable, decision by the European Union's highest court has invalidated EU approval for one of the most popular legal bases (‘Safe Harbor’) for transferring personal data from the EU to the USA. In reaching its decision, the court commandeered an issue with which it was not presented and relied on important factual findings that were inaccurate and ignored substantial changes that had been made in the US surveillance environment. This precipitous and unnecessary decision not only invalidated the legal basis for a widely used transfer programme but threatened unnecessarily to shut down essentially all transfer of personal data from the EU to the USA, and adversely to affect transfer to other non-EU nations as well. The USA and the EU are now dealing with a proposed Safe Harbor replacement, ‘Privacy Shield’. It is submitted that the EC should issue a Privacy Shield adequacy decision and that if called upon, after a bit of re-education, the CJEU should uphold that decision.