A major agreement governing the transfer of EU citizens’ data to the United States has been struck down by the European Court of Justice (ECJ). The EU-US Privacy Shield let companies sign up to higher privacy standards, before transferring data to the US.

But a privacy advocate challenged the agreement, arguing that US national security laws did not protect EU citizens from government snooping. Max Schrems, the Austrian behind the case, called it a win for privacy. “It is clear that the US will have to seriously change their surveillance laws, if US companies want to continue to play a role in the EU market,” he said. The EU-US Privacy Shield system “underpins transatlantic digital trade” for more than 5,000 companies. About 65% of them are small-medium enterprises (SMEs) or start-ups, according to UCL’s European Institute. Affected companies will now have to sign standard contractual clauses, non-negotiable legal contracts drawn up by Europe, which are used in other countries besides the US. Mr Schrems had also challenged these, but the ECJ chose not to abolish them. But it also warned that those contracts should be suspended by data protection watchdogs, if the guarantees in them are not upheld. US Secretary of Commerce Wilbur Ross said his department was “deeply disappointed” by the decision.(BBC)…[+]