After years of legal turbulence, transatlantic data flows got a new legal foundation on July 17, 2023, when European and US officials put a brand-new transfer mechanism into effect. Companies can now sign up and move EU personal data across the Atlantic without layering extra contracts on top.
The trouble is that the man who killed the last two deals is already sharpening his arguments.
Key facts
- Self-certification opened July 17, 2023, replacing the defunct Privacy Shield arrangement.
- The mechanism is anchored in Executive Order 14086 and a new US Data Protection Review Court.
- Participants self-certify annually; no Transfer Impact Assessment is required.
- Privacy activist Max Schrems has publicly questioned whether anything substantive changed.
- A court test could realistically land at the CJEU within a year or two.
A short history of transatlantic deals
EU and US policymakers have been arguing over personal data since Safe Harbor collapsed in 2015. Its successor, Privacy Shield, ran into the same wall in 2020 when the CJEU ruled in Schrems II that US surveillance law failed EU residents.
In the gap, firms leaned on Standard Contractual Clauses (SCCs) and Binding Corporate Rules (BCRs). Those tools still work, but they cost more time and money, especially for smaller companies without dedicated privacy staff.
What this new mechanism actually does
The latest mechanism lets EU entities send personal data to certified US recipients without extra contractual scaffolding. Annual self-certification replaces the heavier paperwork load that SCCs and BCRs impose, according to TrustArc.
The US side added two pieces meant to address the surveillance critique. Executive Order 14086 narrows the conditions under which intelligence agencies can demand data, and the Data Protection Review Court gives EU residents a venue to file redress claims.
Why Schrems is unimpressed
NOYB's founder wasted no time. He pointed to a parade of past labels and said recent press releases read like near copies of earlier ones, then argued that American surveillance law has not really moved.
Schrems has outlined several legal angles and suggested a challenge could arrive at the Court of Justice as early as the start of 2024. Alex Greenstein, who directs the program at the FTC, has countered that the Executive Order and review court genuinely resolve the concerns raised in Schrems II.
What it means for you
If your business depends on moving EU data into US systems, the new path is genuinely cheaper and simpler than the SCCs that became the de facto workaround. That is real value.
The catch is durability. Anyone who self-certifies is making a bet that the legal foundation holds. If Schrems succeeds, certification becomes worthless overnight and firms scramble back to SCCs and Binding Corporate Rules with months of re-papering ahead.
A worked example
Say you run a 40-person SaaS company selling into Germany and France. Today you manage SCCs plus a Transfer Impact Assessment your lawyer updates every quarter. You self-certify, rewrite the privacy notice to name the new mechanism, scrub your customer agreements of any Privacy Shield references, and drop the TIA. Your compliance bill shrinks. Then a year from now, a CJEU ruling wipes out the mechanism. You fall back to SCCs, re-paper contracts, and explain to nervous EU customers why the shortcut evaporated.
Our analysis
The new deal trades legal certainty for cost savings. Buyers are mostly small and mid-sized businesses that found SCCs painful. Losers are anyone who prefers a stable, decade-long legal foundation over a cheaper but fragile one. Compared with the typical privacy arrangement in this niche, the new mechanism is unusually generous to participants, which is also why it draws unusually fast fire from litigators.
What to watch next
Watch for a NOYB filing. Expect a multi-year court fight that echoes Privacy Shield's four-year run. Until courts rule, keep SCCs warm as a fallback and budget for the possibility that this deal does not outlast its predecessors.
Key takeaways
- The new mechanism slashes paperwork, but legal durability is the open question.
- Rewrite privacy notices and contracts now if you self-certify.
- Keep SCCs ready in case the framework is struck down.
Frequently asked questions
Does this mechanism replace Privacy Shield completely?
Yes. Privacy Shield is no longer valid; self-certification under the new framework opened July 17, 2023.
Do I still need Standard Contractual Clauses after joining?
No. For transfers covered by the framework, additional safeguards such as TIAs are not required.
Why is Max Schrems skeptical?
He argues US surveillance law is essentially unchanged, so the framework could face the same court fate as its predecessors.
What does the Data Protection Review Court actually do?
It is a new US body that gives EU residents a route to challenge intelligence-related data access, the core issue raised in Schrems II.
Source: trustarc.com