Privacy Shield Does Not Shield the Privacy: EU-US Mechanism for Data Transfer Declared Invalid
Privacy Shield is a legal mechanism that has been used since 2016 as a basis for data transfer from the EU to the US. Controllers subject to the Serbian Law on Personal Data Protection (“LPDP”) could also use the benefits of this arrangement given the relevant provisions of the LPDP and special decisions of the Government of the Republic of Serbia. On 16 July 2020, the European Union Court of Justice declared invalid the decision of the European Commission 2016/1250 on the EU-US Privacy Shield arrangement. This decision had significant consequences, notably regarding the entities subject to GDPR, including the...