Privacy Shield
Privacy Shield was a program for sending personal data from the EU to certified US companies. The EU Court of Justice struck it down in July 2020, and the Data Privacy Framework replaced it in 2023.
What is Privacy Shield?
Privacy Shield was a program that let US companies receive personal data from the EU by promising to follow a set of privacy principles. It is no longer valid.
The EU Court of Justice struck it down on July 16, 2020, in the Schrems II ruling (Case C-311/18). As the court's press release summarized, it found that US surveillance law went beyond what is strictly necessary and that EU individuals lacked effective redress.
Its replacement is the EU-US Data Privacy Framework (DPF), in effect since July 10, 2023. According to the Department of Commerce, active Privacy Shield participants were moved into the DPF automatically, and the new principles are nearly identical to the old ones.
Why some documents still mention it
You may still see Privacy Shield in a vendor's DPA or privacy policy. The mention may be left over from before the switch to the DPF.
Companies moved into the DPF had to update their privacy policies by October 10, 2023. Morgan Lewis warned that renaming the program alone would likely not be enough, since the descriptions of the principles also changed.
Why it matters to you
A leftover mention can be harmless. If the vendor is active on the DPF list and its DPA also includes standard contractual clauses, your EU transfers still have a valid route. The old wording is out of date, but it is not doing the work.
It is a problem when Privacy Shield is the only transfer route named. Then the document points to a mechanism that no longer exists, and transfers under it may lack a legal basis. It can also be a sign the vendor is not keeping its legal documents current.
What to check
- Whether the vendor's DPA names Privacy Shield as its only transfer route.
- Whether the vendor is active on the official DPF list today.
- Whether the DPA includes the 2021 standard contractual clauses as a fallback.
- If the documents are outdated, ask the vendor for a current DPA.
How Venpo helps
Venpo monitors your vendors' DPAs and privacy policies and emails you when their transfer wording changes, including when an old Privacy Shield reference is removed or replaced. A change history per vendor shows when each update happened.
Frequently asked questions
Is Privacy Shield still valid?
No. The EU Court of Justice invalidated it in July 2020. The EU-US Data Privacy Framework replaced it in July 2023.
What replaced Privacy Shield?
The EU-US Data Privacy Framework, along with its UK Extension and the Swiss-US Data Privacy Framework.
Related terms
Sources
- Press release No 91/20: The Court of Justice invalidates Decision 2016/1250 on the adequacy of the EU-US Data Protection Shield, Court of Justice of the EU
- FAQs – EU-U.S. Data Privacy Framework (EU-U.S. DPF), U.S. Department of Commerce
- How to comply with the new EU-US Data Privacy Framework, Morgan Lewis
Last reviewed