The Privacy Shield out of the game, right away

The so-called Privacy Shield has been defined inadequate in recent weeks by the Court of Justice of the European Union and must be considered immediately out of play, as stated in the new guidelines on the subject distributed by the European Data Protection Committee. Translated: none reality operating in the old continent is more authorized to rely on it to transfer the information collected here to the United States.

Europe on the Privacy Shield: no longer exists

Reality as social networks and online platforms are called to adapt to the new pronouncement on the Schrems case. To continue with the practice, it will be necessary to leverage alternative methods such as SCC (Standard Contractual Clauses) or BCR (Binding Corporate Rules), having first communicated them to the competent authorities.

There is a "grace period" during the which one can I continue to transfer data to the United States without evaluating the legal basis of the transfer?

No, the Court invalidated the Privacy Shield decision without maintaining its effects since the US law evaluated by the Court does not provide a level of protection equivalent to the European one. This decision was made with reference to all transfers to the United States.

The transmission of information overseas can however take place on the basis of what is foreseen by an article of the GDPR.

I can rely to the exceptions of article 49 of the GDPR to transfer data to the United States?

Is it still possible to transfer the data from the European Economic Area to the United States on the basis of the exceptions present in article 49 of the GDPR in compliance with the conditions established for the application of the article.

In this case, must be first obtained explicit consent, and informed by the user, providing details on the risk related to the transfer to countries that do not provide a level of protection equal to that of the regulations in force in Europe.

Source: EDPB (PDF)