European Union: Invalidation of U.S.-EU Privacy Shield mechanism in CJEU "Schrems II" decision

With the "Schrems II" decision on 16 July 2020, the CJEU invalidates the U.S.-EU Privacy Shield. The decision finds that the United States data surveillance laws and compliance requirements for data processors (in particular, Section 702 of the Foreign Intelligence Surveillance Act and Executive Order 12333) prevent data processors to ensure that the personal data of EU citizens receive equivalent protections when transferred in the US. The decision upholds the Standard Contractual Clauses as valid "with supplementary measures" and remarks the EU national Data Protection Agencies' duty to scrutinize the application of such clauses.