So, here's basically what today's Privacy Shield / Max Schrems / Facebook ECJ judgement says:
1/ The ECJ has struck down Privacy Shield because it essentially doesn't live up to the protections afforded to EU citizens by GDPR
Furthermore, the ECJ says the scope of GDPR should reach all the way to the point at which US spy agencies start sifting through EU citizens data
Furthermore, the ECJ says the scope of GDPR should reach all the way to the point at which US spy agencies start sifting through EU citizens data
2/ The court held that GDPR had to be interpreted as meaning EU citizens whose data is transferred to the US are entitled to a level of protection essentially equivalent to that guaranteed within the EU by the GDPR, as underpinned by the Charter of Fundamental Rights.
3/ The ECJ says the Charter guarantees “respect for private and family life, personal data protection and the right to effective judicial protection.”
4/ Since under Privacy Shield any decisions by the US national security services had “primacy” this therefore “condoned” interference with the fundamental rights of EU citizens whose data were transferred to the US.
5/ The ECJ essentially says any privacy protections under US law when it comes to surveillance are not as strong as those provided under EU law.
6/ In particular, the ECJ believes US surveillance of personal data breaches the principle of proportionality, ie such surveillance programmes are not limited to what was strictly necessary.
7/ Privacy Shield did not enshrine any limitations as to how such surveillance programmes were implemented, nor did Privacy Shield hold any guarantees for potentially targeted non-US persons, said the court
8/ Although the US authorities are required to comply with certain provisions when carrying out surveillance, these provisions do not give EU citizens actionable rights before the courts against the US authorities
9/ The court also takes issue with the Privacy Shield Ombudsman mechanism... Recourse to such an Ombudsman is inadequate because it does not provide citizens with any course of action which provided guarantees “substantially equivalent” to those required by EU law.
10/ The independence of such an Ombudsman was not guaranteed, nor would the Ombudsman be able to adopt decisions that were binding on US intelligence services, judges held
11/ The Court found however that Standard Contractual Clauses (SCCs) are valid. (These were fallback measures after Safe Harbour was thrown out in 2015 and essentially copy over EU protections into legal contracts between exporters and importers of data
12/ The court held that data protection commissioners are required to “suspend or prohibit a transfer of personal data to a third country where they take the view, in the light of all the circumstances of that transfer, that the standard data protection clauses are not...
13/ ...or cannot be complied with in that country and that the protection of the data transferred that is required by EU law cannot be ensured by other means”
