EU-US Privacy Shield (invalidated)
A former EU-US data transfer framework operational between 2016 and 2020, invalidated by the Court of Justice of the EU in Schrems II.
Full Definition
The EU-US Privacy Shield was a commercial-side adequacy framework that permitted EU-US personal data transfers to certified US organisations. It operated from 1 August 2016 until 16 July 2020, when the Court of Justice of the EU in Case C-311/18 (Schrems II) invalidated it. The CJEU found that US surveillance programmes (notably FISA s.702 and EO 12333) and the absence of actionable redress for EU subjects meant the framework did not provide 'essentially equivalent' protection to GDPR.
Transfers after Schrems II relied on Standard Contractual Clauses plus a transfer impact assessment. On 10 July 2023 the Commission adopted a successor adequacy decision — the EU-US Data Privacy Framework — which addresses the Schrems II concerns through Executive Order 14086 (US signals-intelligence safeguards and the Data Protection Review Court). Historical references to 'Privacy Shield' now point either to this successor framework or to the obligation to re-paper legacy transfers that still cite the invalidated instrument.
Related terms
Cross-Border Transfer
The transfer of personal data from one country to another, subject to restrictions under data protection laws.
Standard Contractual Clauses
Pre-approved contract clauses issued by the European Commission for lawfully transferring personal data outside the EEA.
Adequate Level of Protection
A finding by a privacy regulator that another country's data protection framework provides protection essentially equivalent to its own, allowing personal data to flow there without additional safeguards.
Relevant regulations
Automate your privacy program
TruePrivacy handles DSRs, consent management, data mapping, and breach response — all in one platform.
Free 14-day trial · No credit card required · Setup in minutes