USA: CRS releases report on Schrems II impact on EU-U.S. Privacy Shield

In particular, the report examines the impact of the Court of Justice of the European Union's ('CJEU') judgment in Data Protection Commissioner v. Facebook Ireland Limited, Maximillian Schrems (C-311/18) ('Schrems II'), and provides, among other things, an overview of EU law governing international data transfers, including the Schrems II decision, and a review of US surveillance laws relevant to the Schrems II decision.

In addition, the report discusses considerations for the U.S. Congress, including:

• that executive action could address some intelligence collection concerns raised in Schrems II, for example by limiting bulk intelligence collections and providing additional redress mechanisms through an Executive Order;
• negotiating a diplomatic solution between the US and EU, which could include a new framework to replace Privacy Shield, or enter into a treaty governing data transfers; or
• adopting statutory requirements addressing the CJEU's concerns, such as by amending the Foreign Intelligence Surveillance Act or creating a cause of action that would allow foreign subjects to bring complaints before a tribunal.

EU Data Transfer Requirements and U.S. Intelligence Laws: Understanding Schrems II and Its Impact on the EU-U.S. Privacy Shield