Privacy Shield 2.0 – Trial No. 3 with an unclear outcome

The Data Privacy Framework – or Privacy Shield 2.0 – is the third attempt at a data protection agreement between the EU and the US, following the Safe Harbor scheme and the Privacy Shield. According to the European Data Protection Regulation EU-DSGVO, this new regulation is intended to ensure the protection of personal data transferred from the EU to the USA.

The agreement became necessary because the European Court of Justice (ECJ) had declared the previous agreements invalid in the so-called “Schrems judgements”. The EU adopted the Data Privacy Framework in July 2023 by adequacy decision. In the Data Privacy Framework, the US commits to improving the level of data protection of personal data transferred from the EU to the US. Through the EU adequacy decision of 10 July 2023, the EU Commission declares the level of data protection of personal data transferred to the US to be adequate and in line with the requirements of the EU GDPR for data transfers to a third country.

The agreement became necessary because the European Court of Justice (ECJ) had declared the predecessor agreements invalid in the so-called “Schrems judgements”. The EU adopted the Data Privacy Framework in July 2023 by adequacy decision. In the Data Privacy Framework, the US commits to improving the level of data protection of personal data transferred from the EU to the US. Through the EU adequacy decision of 10 July 2023, the EU Commission declares the level of data protection of personal data transferred to the US to be adequate and in line with the requirements of the EU GDPR for data transfers to a third country.

This is intended to end the legal uncertainty that has prevailed since the Schrems rulings. The adequacy decision serves as the basis for the transfer of personal data to certified companies or organisations in the USA from the time of its adoption by the EU Commission. The transfer of personal data to a US company that participates in the DPF and is certified no longer requires any further security measures or additional standard contractual clauses. Whether the new agreement will actually withstand the expected legal scrutiny by the European Court of Justice is not yet foreseeable.

From Switzerland’s point of view, the question is whether it can join the agreement between the EU and the USA with a parallel solution – as it did with “Safe Harbor” and “Privacy Shield”.