US surveillance scuppers Privacy Shield framework, but one-to-one contracts given all-clear
The EU-US Privacy Shield legal Framework, which enables commercial transfers of personal data across the Atlantic, has been ruled invalid by the European Court of Justice, with potential consequences for research and innovation.
The court ruled on 16 July that, unlike in the EU, US state surveillance programmes “are not limited to what is strictly necessary” and are not subject to the scrutiny of an independent body, meaning EU citizens’ personal data does not receive equivalent protection if it is transferred there.