The Court of Justice of the EU ruled that "necessary" transfers of personal data to the US are not affected by the case, while voluntary outsourcing of processing to US providers may violate the GDPR. The judgment confirms the invalidity of the Privacy Shield and restricts the use of SCCs with US entities subject to surveillance laws. Companies must review and possibly halt such data flows to avoid penalties.
Why it matters: The ruling narrows permissible EU‑US data transfers, forcing companies to reassess outsourcing to US processors.
Summary generated from the sources below. Check the primary source before relying on it; this is not legal advice.
