Privacy Shield 2.0 or a potential Schrems III?

On 25^th March 2022, the European Commission announced that the European Union and the United States had, in principle, reached an agreement regarding a new data transfer framework. The new agreement was intended to replace the Privacy Shield framework that was abolished by the Court of Justice of the European Union in the Schrems II decision.

Even though the announcement is the first step to finding a solution to the problematic situation concerning transfers of personal data to the United States, it is important to note that no agreement is in place today. Hence, the announcement does not change the situation for controllers and processors of personal data intending to use US-based service providers. In order to comply with GDPR, such parties still need to make sure that any transfer of personal data to the United States complies with Chapter 5 GDPR, and the recommendations of the European Data Protection Board (“EDPB”).

Furthermore,  at this moment, there is little information concerning the contents of the agreement, and no draft legal text has been released. However, the announcement is an indication that the parties have found common ground on the outline of an agreement.

Also, it is important to note that a final agreement is months away. Even if the European Commission and the United States can agree on its terms , any such agreement would not be a bilateral agreement, but an executive decision by the European Commission. Such a decision  would firstly have to be reviewed by the EDPB. This review process can only be initiated once a legal text is in place. Therefore, it is likely that any actual “adequacy decision” by the European Commission based on the agreement is still many months away.

Moreover, Max Schrems’ organisation NOYB has stated that:

“The final text will need more time, once this arrives we will analyze it in depth, together with our US legal experts. If it is not in line with EU law, we or another group will likely challenge it. In the end, the Court of Justice will decide a third time. We expect this to be back at the Court within months from a final decision.”

Therefore, once again, it is likely that any agreement will end up before the Court of Justice of the European Union and if there are no material changes in relation to the Privacy Shield it is possible that the new agreement will share the faith of its predecessors and we will once again end up where we started, with an unclear and complicated situation that lays a heavy burden on any company that wants to use service providers based in the United States.

In summary, the announced agreement is, in principle, good first step to resolving a complicated situation for many companies, but it does not constitute any real change to the state of the law in relation to third country transfers. Furthermore, it is unclear whether any agreement will pass a potential trial in the Court of Justice of the European Union.