On 16 July 2020, the Court of Justice of the European Union issued a judgment that made hundreds of millions of data transfers simultaneously unlawful. The case had started years earlier with a complaint from an Austrian lawyer named Max Schrems. He had noticed something straightforward. Facebook was sending his European personal data to servers in the United States. There, it became accessible to US intelligence agencies under American surveillance law. Schrems wanted to know what legal basis allowed that. The EU’s highest court eventually agreed there was not one.
The ruling — Schrems II, because this was his second successful legal challenge to transatlantic data transfer rules — invalidated Privacy Shield overnight. Facebook, Google, Microsoft, and virtually every US-based cloud provider were suddenly operating in a legal grey zone. The scale was staggering. Meta’s Facebook transfers alone represented one of the largest cross-border data flows in the world. The decision rippled across corporate legal departments on both sides of the Atlantic. Contracts had to be revisited. Risk assessments had to be done for the first time. Some never were.
That was 2020. A replacement framework arrived in 2023. It is already being challenged.
The short answer: When you use a US service from Europe, your data usually travels to US servers. There it falls under US law, including surveillance powers with no EU-style oversight. GDPR requires a legal mechanism for that transfer. Two mechanisms, Safe Harbor and Privacy Shield, were struck down by EU courts. The current one, the 2023 Data Privacy Framework, survived a first challenge in September 2025 but faces a broader “Schrems III” threat in 2026. Your practical options: check DPF certification, ask companies what transfer safeguards they use, and prefer EU-hosted providers for sensitive data.
What does “data transfer” actually mean?
Most people assume their email, search history, or social media data stays in the country where they use the service. It generally doesn’t — and for Europeans, the legal consequences of that matter considerably.
An EU resident using Gmail is having their emails processed on servers potentially in the United States, Ireland, and several other locations simultaneously. An EU resident scrolling Facebook has their clicks, reactions, and browsing patterns transferred to Meta’s US infrastructure for ad targeting. An employee at a German company using Microsoft 365 is having their files, Teams messages, and calendar data sent to Azure data centres that may include US locations. A French person using a fitness app owned by an American company has their health and location data sitting on servers subject to US law.
Chapter V of the GDPR addresses this directly. Any transfer of personal data outside the European Economic Area requires a legal mechanism: a formal basis in law that justifies moving data beyond EU jurisdiction. Without one, the transfer is unlawful, full stop. This is not a technicality. The EU takes the position that personal data is not just a commercial asset. It carries rights attached to the individual it describes, and those rights do not disappear at a border.
The three mechanisms that have governed EU-to-US transfers tell the story of two decades of failure and attempted repair.
Safe Harbor, Privacy Shield, and the current framework
Safe Harbor ran from 2000 to 2015. It was a self-certification system: US companies could declare they would comply with EU data protection principles, and their doing so was deemed adequate under EU law. The European Commission had issued a formal adequacy decision — a determination that US law provided essentially equivalent protection to the EU’s own.
Then Edward Snowden disclosed the scope of NSA surveillance in 2013. Safe Harbor’s assurances that EU data would be handled according to EU-style principles looked hollow against a programme that hoovered up data from the very US companies making those assurances. Max Schrems filed his first complaint in 2013. The Court of Justice struck down Safe Harbor in October 2015, in what became known as Schrems I. The court found that US national security law allowed interference with fundamental rights in ways incompatible with EU standards. It also found that Safe Harbor provided no effective remedy for EU citizens affected.
Privacy Shield replaced it in 2016. It was more elaborate than Safe Harbor. It added more requirements for participating companies, a new ombudsperson mechanism for EU citizens to raise complaints, and renewed adequacy findings from the European Commission. It lasted four years.
Schrems II killed it for the same underlying reason. Two US surveillance authorities were the problem. Section 702 of the Foreign Intelligence Surveillance Act (FISA), which authorises bulk collection of communications. And Executive Order 12333, which governs overseas surveillance. The court found that neither provided an effective legal remedy for EU citizens. The ombudsperson created by Privacy Shield did not qualify as an independent court or tribunal with binding authority. The problem was structural. US constitutional privacy protections do not extend to non-US persons, and EU citizens had no meaningful way to challenge how American intelligence agencies handled their data.
The EU-US Data Privacy Framework (DPF) was adopted in July 2023. It attempts to fix the specific defect the court identified. Executive Order 14086, signed by President Biden in October 2022, created a new Data Protection Review Court. This is an independent judicial body where EU citizens can challenge US surveillance activities affecting their data. It is staffed by judges who do not hold other government positions and can order remedies. The European Commission issued a fresh adequacy decision. DPF has been in operation since July 2023.
The DPF is already being litigated. The first challenge to reach court came from a French parliamentarian, Philippe Latombe. In September 2025, the EU’s General Court dismissed it and upheld the DPF’s adequacy. That was a narrow challenge, though, and it is under appeal.
A broader threat is building around NOYB, the privacy NGO Max Schrems founded. NOYB’s argument is that the Data Protection Review Court remains subject to executive control in meaningful ways. It also notes that the underlying surveillance authorities, Section 702 and EO 12333, are still in place and still permit collection that would not be permissible under EU law. Then, in mid-2026, a US Supreme Court ruling (Trump v. Slaughter) weakened protections for the independence of US oversight bodies. NOYB responded by urging the European Commission to exit the DPF, and it signalled a fresh challenge, a likely “Schrems III.” Given the previous two outcomes, legal teams advising US cloud providers are not betting heavily on permanence.
What happened between Privacy Shield and DPF
The gap between Privacy Shield being struck down in July 2020 and DPF arriving in July 2023 lasted exactly three years. During that period, the dominant legal mechanism for EU-to-US transfers was Standard Contractual Clauses — SCCs.
SCCs are contractual clauses approved by the European Commission that can be incorporated into agreements between an EU data exporter and a non-EU data importer. By signing up to SCCs, the importer makes two promises. It will handle the data according to EU-equivalent standards. And it will tell the exporter if it receives a government access request it cannot comply with under GDPR. Schrems II didn’t eliminate SCCs as a mechanism, but it significantly complicated their use. The ruling held that an exporter relying on SCCs must carry out a Transfer Impact Assessment. This is an analysis of whether SCCs actually provide adequate protection in practice, given the laws of the destination country.
For transfers to the US, this meant honestly confronting one structural problem, the same one that killed Privacy Shield. Section 702 FISA authorises collection that SCCs cannot contractually prevent. Companies were technically required to do this analysis. Most didn’t, or produced documents that reached the conclusion they needed without genuine analysis.
The Irish Data Protection Commission’s enforcement against Meta’s Facebook operations in May 2023 was the definitive test of whether this mattered. The Irish DPC found that Meta’s reliance on SCCs to transfer EU user data to US servers was inadequate. In practice, the SCCs did not provide protection equivalent to EU law, given US surveillance capabilities. The fine was €1.2 billion, the largest in GDPR history. The transfers were ordered to be suspended, though Meta relied on DPF once that became available.
The Irish DPC’s handling of this case also illustrated a chronic structural problem. The complaint that eventually produced the €1.2 billion fine was filed in 2013 — ten years before the decision arrived. Ireland hosts the European headquarters of most major US technology companies. So the Irish DPC handles the bulk of cross-border complaints against Google, Meta, Apple, Microsoft, LinkedIn, and others. Its pace of enforcement has been a persistent source of friction with other European data protection authorities. The European Data Protection Board even stepped in to require the DPC to act more forcefully on the Meta case.
What this means for your actual data
When you use a US social media platform from Europe, your posts, private messages, reactions, and location check-ins travel to US servers. They sit under US law, not just EU law. Depending on the platform and the specific programme, they may be accessible to the NSA under Section 702 without a warrant, as part of bulk collection from US internet companies. This is not a hypothetical. It is precisely what the Snowden disclosures confirmed and what three successive court challenges have turned on.
When a healthcare app you use is owned by a US company, your health data may be subject to US law. That includes law enforcement and intelligence access with no equivalent EU oversight mechanism. US health privacy law (HIPAA) only applies to specific covered entities: health insurers, healthcare providers, and their business associates. It does not apply to consumer wellness apps, fitness trackers, or most health-adjacent platforms. Your HealthKit data, your period-tracking app data, your symptom diary: none of that is necessarily HIPAA-protected. And if it crosses the Atlantic on inadequate legal grounds, it has even less protection.
When an employer migrates to a US cloud provider, employee HR data — performance reviews, salary information, disciplinary records, communications — may cross borders. Employment data is among the categories that most workers have the least visibility into. It routinely moves internationally as companies switch infrastructure, often without conducting the transfer impact assessments that GDPR requires.
SCCs on paper do not equal protection in practice. That is what the European Court of Justice said in 2015, said again in 2020, and what the pending DPF challenge may say a third time.
What you can actually do
The legal machinery is complicated. Your practical options are more limited but not meaningless.
Check DPF certification. The official list of companies certified under the EU-US Data Privacy Framework is searchable at dataprivacyframework.gov. If a company is listed, they have committed to DPF obligations and are subject to enforcement by the US Federal Trade Commission for non-compliance. Certification is not a guarantee — Safe Harbor was also self-certification — but it is the legally operative mechanism while DPF stands. If a company handles your data and isn’t on the list, they need a different transfer mechanism.
Request information about SCCs and Transfer Impact Assessments. Under GDPR Article 15 (right of access), you can request confirmation of what data is held about you. You can also ask about transfers to third countries, including the safeguards in place. You can also ask under Article 46 what transfer mechanism a company is relying on. Many companies will respond by pointing to boilerplate about SCCs. Some will claim their TIAs are commercially confidential. That response is itself informative.
Prefer EU-established and EU-hosted providers for sensitive data. For health data, financial information, or legal communications, the practical risk reduction from using a European provider running on European infrastructure is real. EU-headquartered companies can still use US cloud providers and create the same transfer problem — so ask specifically whether data is stored and processed in the EEA. Many enterprise cloud contracts include a “data residency” option. Consumer services rarely do, but it is increasingly a competitive differentiator.
File complaints when transfers look unlawful. The Schrems cases both began as individual complaints to a data protection authority. Filing a complaint costs nothing. Each EU member state has a national DPA. In France, that is the CNIL at cnil.fr. In Germany, the Federal Commissioner for Data Protection at bfdi.bund.de. In Ireland — which handles most major US platform complaints — the Data Protection Commission at dataprotection.ie. UK residents (post-Brexit the UK operates its own framework, the UK-US Data Bridge) can file with the ICO at ico.org.uk.
Complaints do result in action, even if slowly. The Meta SCC case took a decade, but it produced the largest GDPR fine in history and a transfer suspension order. The pace is frustrating. It is not nothing.
Follow NOYB. The organisation Max Schrems founded, NOYB (noyb.eu), publishes plain-English analyses of enforcement decisions and pending cases. They are the most active litigants challenging unlawful data practices across Europe. Their case tracker gives the clearest view of what is being challenged, what has been decided, and what remains unresolved. If the DPF challenge produces Schrems III, NOYB is where you will read about it first.
The underlying problem hasn’t been resolved
Three frameworks. Over two decades. Two court strikes. And fresh challenges still in play. The structural tension has never changed. The United States conducts mass surveillance that does not require warrants for non-US persons. EU privacy law requires effective legal remedies for people whose data is collected. Those two positions are hard to reconcile without the US fundamentally changing how it collects intelligence from internet infrastructure. That has not happened, and shows no sign of happening.
The Data Protection Review Court created by Executive Order 14086 is a genuine attempt to create a judicial remedy that could satisfy EU legal standards. Whether it does will be determined by the Court of Justice. If it doesn’t, a third adequacy decision will fall, and the legal basis for an enormous proportion of EU-US commercial data flows will collapse again. Companies will fall back on SCCs again. The Irish DPC will spend another decade enforcing against inadequate reliance on them.
Your data is not a passive object in this dispute. It is what the dispute is about.
See what a scan finds → walks through an example report of what data broker exposure looks like. KnytX Shield isn’t live yet; join the waitlist to run your own scan at launch.