A 2026 vendor contract proposes Privacy Shield certification as the sole basis for transferring EU personal data to the United States. What should the controller conclude?
Select an answer to reveal the explanation.
Short Explanation
Privacy Shield got the same courtroom fate as Safe Harbor—invalidated—so it cannot carry a 2026 transfer by itself. Think of it as an expired boarding pass. Look instead at the EU–US Data Privacy Framework for eligible participants, or SCCs and the rest of the Chapter V toolkit.
Full Explanation
The CJEU invalidated the Privacy Shield adequacy decision in Schrems II. Controllers cannot treat Privacy Shield certification as a current lawful transfer basis. Depending on facts, organisations may rely on the EU–US Data Privacy Framework for certified participating organisations, SCCs with appropriate assessments and measures, BCRs, or other Chapter V pathways. Invalidation is not limited to advertising use cases, and private contracts cannot resurrect an invalidated adequacy arrangement.