L’Accordo Privacy Shield non è un vero scudo per la privacy: scenari passati e futuri in merito al trasferimento di dati personali dall’Unione Europea verso gli Stati Uniti

On July 16, 2020, the European Court of Justice delivered a ruling in the case known as Schrems II (C-3111/18), invalidating Decision 2016/1250 on the adequacy of the protection provided by the EU-US Data Protection Shield (“Privacy Shield”). The Court, recalling arguments that had been used in the previous case Schrems I, reminded that, unless there is a valid adequacy decision by the Commission, the competent supervisory authorities are required to suspend or prohibit the transfer of personal data to a third country where the protection of the data transferred that is required by EU law cannot be ensured. The paper highlights the implications that the Schrems II judgment will have on the regulation of data transfers to the United States, underlying the importance of an early intervention by the Commission, in view of amending the Privacy Shield and adapting the standard contractual clauses to the requirements introduced by the GDPR, as read in the light of the Charter of Fundamental Rights.