For Immediate Release

Organization Profile: 

Abdullah Hasan,

Top European Court Invalidates U.S.–E.U. Data-Transfer Agreement

Pro-Privacy Ruling Underscores Urgent Need for Comprehensive U.S. Surveillance Reform

LUXEMBOURG CITY - Citing the United States’ intrusive and sweeping surveillance practices, the European Union Court of Justice today invalidated the Privacy Shield, a data-transfer agreement between the European Union and the United States. More than 5,000 U.S. companies rely on Privacy Shield for transatlantic data transfers. The court concluded that the agreement fails to adequately protect the privacy rights of Europeans from U.S. mass surveillance.

The ruling came in a case originally brought by Austrian lawyer and privacy advocate Max Schrems against Facebook Ireland. The American Civil Liberties Union provided expert testimony about U.S. surveillance laws in the case.

“This ruling makes clear that no international agreement can adequately protect people’s privacy from the United States’ current mass surveillance programs and practices,” said Ashley Gorski, senior staff attorney with the ACLU’s National Security Project. “U.S. surveillance violates fundamental privacy rights and continues to be a massive financial liability for U.S. companies trying to compete in a global market. Unless Congress swiftly acts to enact comprehensive surveillance reforms, U.S. businesses will continue to pay the consequences.”

The court also held that European Union Data Protection Commissioners must suspend or prohibit data transfers under separate instruments, called Standard Contractual Clauses, if the commissioners conclude that U.S. law fails to appropriately protect Europeans’ data — as the court concluded today.


Never Miss a Beat.

Get our best delivered to your inbox.

Today’s ruling makes it very difficult — if not impossible — for most companies doing business in Europe to outsource significant volumes of data to tech companies in the United States for processing or for backup purposes. Companies will still be able to execute individual data transmissions where, for example, users consent to the transfer of their data, or where the transfer is strictly necessary to the performance of a contract.

This is the second time the European Union Court of Justice has invalidated a data-sharing agreement between the European Union and the United States. The court in 2015 invalidated the Safe Harbor agreement — an initial attempt by the two governments to reconcile European privacy law and U.S. surveillance practices — after Edward Snowden revealed the NSA’s warrantless surveillance practices.  The ACLU previously warned Congress and the European Commission that the Privacy Shield agreement was invalid because it failed to ensure that U.S. law adequately protected the rights of individuals in the European Union.

The ACLU is calling on Congress to radically reform U.S. surveillance laws to rein in warrantless spying, and to ensure that there is a meaningful opportunity to challenge the government’s surveillance.


This is the world we live in. This is the world we cover.

Because of people like you, another world is possible. There are many battles to be won, but we will battle them together—all of us. Common Dreams is not your normal news site. We don't survive on clicks. We don't want advertising dollars. We want the world to be a better place. But we can't do it alone. It doesn't work that way. We need you. If you can help today—because every gift of every size matters—please do. Without Your Support We Simply Don't Exist.

Please select a donation method:

The American Civil Liberties Union (ACLU) conserves America's original civic values working in courts, legislatures and communities to defend and preserve the individual rights and liberties guaranteed to every person in the United States by the Constitution and the Bill of Rights.

Share This Article