On the 30th May 2016 Giovanni Buttarelli, the European Data Protection Supervisor, published an opinion on the viability of Privacy Shield as a means of protecting EU citizens personal data when transferred to the USA and said “I appreciate the efforts made to develop a solution to replace Safe Harbor but the Privacy Shield as it stands is not robust enough to withstand future legal scrutiny before the Court. Significant improvements are needed should the European Commission wish to adopt an adequacy decision, to respect the essence of key data protection principles with particular regard to necessity, proportionality and redress mechanism. Moreover, it’s time to develop a longer term solution in the transatlantic dialogue.”
Privacy Shield is therefore ineffective and should not be relied upon for international data transfers and nor, of course, should Safe Harbor as this was struck down in October 2015.
For international transfers of personal data from the EU to other countries that are not deemed adequate by the European Commission, businesses must use approved data transfer mechanisms such as the EU Model Clauses, approved codes of conduct or Binding Corporate Rules.