On Thursday 16 July 2020, the CJEU (Court of Justice of the European Union) invalidated the Privacy Shield in a resounding but hardly surprising decision. The cause of this invalidation: the American legislation which tolerates, without consideration of the principle of proportionality, that personal data transferred to the United States be communicated to the American administration, the guarantor of national security.

The CJEU considers that the security mechanisms put in place by US law do not guarantee a sufficient level of protection against the omnipotence of interference by US surveillance programmes.

After the Safe Harbor, it is therefore the Privacy Shield that is invalidated, but this time a new dimension is added in the decision of the CJEU: it is not so much the instrument that is at issue but the structural characteristics of the US legislation, which disproportionately privileges national security over data protection, that prevent adequate protection.

The standard contractual clauses put in place by the European Commission remain in place and can still be used for any contract involving a transfer of personal data to the United States.