Privacy Map

European Union. Data localisation / cross-border. Commission Implementing Decision (adequacy)

EU–US Privacy ShieldCommission Implementing Decision (EU) 2016/1250 on the adequacy of the protection provided by the EU–U.S. Privacy Shield

Repealed/superseded

§1Summary

Synopsis

Implementing Decision 2016/1250 found, under Directive 95/46/EC, that the EU–U.S. Privacy Shield ensured an adequate level of protection for personal data transferred from the EU to certified organisations in the United States. It replaced the Safe Harbour decision that the Court of Justice had invalidated in 2015. The Court of Justice struck the Decision down on 16 July 2020 in Schrems II (C-311/18), because of inadequate protection against US government surveillance. Standard contractual clauses stayed available.

Key themes
  • adequacy
  • transfers to the US
  • self-certification
  • government access
  • ombudsperson
Unique features

Wikipedia mentions an Ombudsperson mechanism for surveillance concerns; its terms were not checked in the Decision text.

SaaS relevance

Historical only; invalidated in 2020. Replaced in practice by standard contractual clauses and, from 2023, the EU–US Data Privacy Framework.

§2Obligations

Extraterritorial
Applied to US organisations that self-certified
Breach notification
None
DPO
No
Cross-border transfers
Allowed transfers to certified US organisations
Maximum penalty
None

§3Dates

Key dates
  • Adopted
  • In force
  • Ended
  • Adopted 12 July 2016; published 1 August 2016; declared invalid by the Court of Justice on 16 July 2020 (Schrems II, Case C-311/18)

§4Text and authority

Text
Authority
European Commission; US Department of Commerce and Federal Trade Commission administered the US side

§5Where it applies

Also applies in

§6Sources and verification

Sources consulted
Verification

High confidence.

End date confirmed from the judgment: Schrems II (C-311/18), Grand Chamber, 16 July 2020, operative part point 5: Implementing Decision (EU) 2016/1250 'is invalid'. In force date is the adoption date (12 July 2016) as given by Wikipedia; the Decision text read gives only adoption and publication (1 August 2016). Wikipedia mention of an Ombudsperson was not checked against the Decision.