A 2026 vendor contract proposes Privacy Shield certification as the sole basis for transferring EU personal data to the United States. What should the controller conclude?
Select an answer to reveal the explanation.
Short Explanation
Privacy Shield got the same courtroom fate as Safe Harbor—invalidated—so it cannot carry a 2026 transfer by itself. Think of it as an expired boarding pass. Look instead at the EU–US Data Privacy Framework for eligible participants, or SCCs and the rest of the Chapter V toolkit.
Full Explanation
Privacy Shield was invalidated by the CJEU in Schrems II and cannot serve as the sole basis for EU-to-US transfers in a 2026 vendor contract. Controllers should consider current mechanisms such as the EU–US Data Privacy Framework where the recipient actually participates and the transfer fits the framework’s scope, or other Chapter V tools such as Standard Contractual Clauses paired with transfer impact analysis and supplementary measures as needed. Protecting people’s data in civic services and commercial products requires live transfer law, not nostalgia for a struck-down shield that supervisory authorities no longer treat as valid.
Privacy Shield is not still valid for processors while invalid for controllers. Private contracts cannot revive a framework the Court invalidated. The invalidation was not limited to advertising data with HR transfers left intact; organisations must move all covered US flows onto current tools.
Exam caveat: Data Privacy Framework participation is not automatic for every US vendor—self-certification status and data categories matter. SCCs remain a workhorse when framework coverage is absent, but SCCs alone may need supplementary measures depending on the destination risk picture.
Operational check: reject Privacy Shield-only paper in procurement review, verify any claimed DPF listing on the official resource, otherwise execute current SCC modules, document the transfer impact assessment, update the public international-transfers section of the notice, and calendar a reassessment if the vendor’s certification lapses.