The European Union-U.S. privacy shield will no longer provide more than 5,000 companies with a legal means to transfer personal data from the EU to the United States following a compelling decision by the Court of Justice of the European Union on July 16.

If your company is relying on the privacy shield to transfer personal data from the EU to the U.S., you need to immediately put in place another legal means of transferring such personal data or risk being in violation of the General Data Protection Regulation 2016/679, commonly referred to as GDPR. You also could be potentially in breach of contractual requirements with vendors, customers and other third parties, which could include the risk of providing indemnification.

What was the EU-U.S. privacy shield?

The privacy shield was a self-certification program developed in 2016 through the collaboration of the U.S. Department of Commerce and the European Commission. Due to more stringent data protections in the EU than in the U.S., the privacy shield provided U.S.-based companies with an EU recognized framework to comply with EU data protection requirements. The privacy shield was enforced in the U.S. by the Federal Trade Commission and the Department of Transportation.

Why does the court's decision matter?

Prior to the decision, there were two practical mechanisms available for U.S.-based companies to legally transfer personal data out of the EU and into the U.S.: self-certification under the privacy shield or including the European Commission-approved standard contractual clauses in contracts pursuant to which such transfers took place.

Following the court's decision, there is now only one practical mechanism available for U.S.-based companies to legally transfer personal data out of the EU and into the U.S. — proper use of the standard contractual clauses, or SCC.

The court also considered whether to abolish the standard contractual clauses, but the decision specifically left in place a prior European Commission decision implementing the SCC as a  legal means of transferring personal data from the EU to the U.S. because they are more in line with the EU's current view on data protection. This part of the decision is important not only because it affirms one of the practical means for the continued transfer of personal data from the EU to the U.S., but it also indicates that the EU (at least through the EU's highest court) is largely relying on commercial, contractual relationships for the protection of such data transfers.

However, as a result of the decision, any company which has relied solely on the privacy shield for transfers of personal data from the EU to the U.S. must now review all vendor, customer and other third-party relationships where such transfers are involved to properly incorporate the SCC into such relationship to avoid prosecution and fines from the EU as well as potential breach of contract concerns.

Companies and their counsel should also be on the lookout for references to the privacy shield in current form contracts and future contracts, and replace those references with the proper use of the SCC.

What to watch for next

The decision from the court came as a bit of a shock to many in the U.S., especially the FTC, DOT and those companies relying exclusively on the privacy shield, as well as many EU businesses involved in the transfer of personal data to the U.S.

Given the far-reaching and potentially immediate implications of the decision (the court is the highest court in the EU from which there is no appeal), officials from both the U.S. and EU have expressed a desire to meet and work toward an updated or new mechanism to replace the privacy shield as well as a grace period for U.S.-based companies to adjust compliance efforts. Based on a history of similar decisions, such a request is likely — but not guaranteed — to be granted by the EU.

What to do next

As it is unlikely there will be a final resolution any time soon regarding the use of an updated  or replacement to the privacy shield, U.S. and EU companies should immediately review any contracts, processes and procedures which involve the transfer of personal data from the EU to the U.S. and promptly consult with knowledgeable data privacy and security counsel to ensure proper reliance on the standard contractual clauses is included in all such contracts, processes and procedures.

Kevin Levy is a Miami shareholder and chair of the technology transactions practice at GrayRobinson. Drew Haggard is an associate in the firm's Fort Lauderdale office.