EU court: withdraw personal data of EU citizens from US cloud services immediately

Mid July, the European Court of Justice struck down the Privacy Shield agreement between the EU and the US. The court ruled US law incompatible with EU privacy regulations, as US government agencies have access to data of EU citizens managed or stored by US firms. This violates the Charter of Fundamental Rights of the European Union and the GDPR.

In essence the ruling means that US companies can not handle data in compliance with the GDPR. European data centers or Standard Contractual Clauses (SCCs) are no solution, as access to data already defines a data transfer and US law supersedes contract law. The only legal solution to regain compliance with EU law is to immediately stop data transfers to the US businesses and repatriate data currently residing with them (source)

Summarizing the main points

The court’s decision

The European Court of Justice ruled that the US government infringes on the data protection rights of EU citizens and thus invalidated Privacy Shield, the agreement covering data transfers between the EU and the US. Either the US will have to change its laws (FISA and Executive order 12333 in particular) and keep its security agencies and courts from snooping in data of EU citizens, or the EU will have to change its laws and reduce it’s legal security and privacy guarantees.

Consequences

As US firms can no longer comply with the GDPR, businesses in Europe have to immediately stop giving US businesses access to personal data of EU citizens. Cloud services like Google services, Dropbox or Microsoft365 can no longer be used for personal data. On premises solutions from US firms can still be used, as can purely EU hosted and managed cloud platforms.

What to do

To ensure compliance with EU privacy laws, European firms should stop data transfers to the US and thus move to on-premises or EU hosted alternatives. For example, Mirosoft Office Online Server can still be used, as can alternatives like Collabora Online or ONLYOFFICE. For full online productivity, solutions like IONOS’ Nextcloud offering can easily guarantee GDPR compliance by using Europe’s largest hosting provider with worlds’ most deployed on-premises collaboration platform.

To learn more about the ruling, we recommend the FAQ of the European Data Protection Board.