The European Court of Justice today struck down the transatlantic data-sharing agreement known as the EU-US Privacy Shield in a ruling that will limit what tech giants can do with their users’ information.

The EU-US Privacy Shield is a legal framework implemented by the European Union and the U.S. in 2016. It allows, or more precisely allowed, companies to move the personal information of EU-based users to U.S. data centers for commercial purposes such as customer analytics. Today’s court decision invalidating the framework is a major development because thousands of companies, among them tech giants such as Google LLC and Facebook Inc., relied on it.

The ruling is made even more significant by the fact that it also restricts cross-border data transfers in a second way. In addition to the EU-US Privacy Shield, tech giants relied on a legal mechanism called SCCs to move data outside the EU. The court today put restrictions on the use of SCCs in a way that will further limit companies’ ability to continue this practice. 

Under the ruling, EU-based users whose data is transferred to a country outside the bloc via SCCs “must be afforded a level of protection essentially equivalent to that guaranteed within the EU by the GDPR.” The GDPR is a sweeping privacy law the EU implemented in 2016. The U.S. currently doesn’t have privacy legislation “essentially equivalent” to GDPR, which may limit companies with regard to whether they can move user information to the U.S.

Microsoft Corp. provided some clarification about the decision’s effect on its users in a blog post. Julie Brill, the company’s chief privacy officer, wrote that the ruling “does not change data flows for our consumer services” when it comes to data transfers such as the transmission of emails. As for Microsoft’s commercial customers, they’re covered by SCCs, which might mitigate the impact from the part of the ruling that invalidates the EU-US Privacy Shield.

Today’s landmark court decision may further accelerate the shift to the cloud in the enterprise. The three major cloud operators, Microsoft among them, all have multiple EU-based data centers that enterprises can use to process the records of users based in the bloc. Spinning up a data processing environment in the cloud is potentially much faster than deploying new infrastructure, especially for companies that don’t already have an in-house EU data center.

The move may also spark more demand for regulatory compliance tools. There are already multiple venture-backed firms including DataGrail Inc., unicorn startup OneTrust LLC and others that sell software to help companies meet the requirements set forth by privacy laws such as GDPR. Today’s ruling may lead to more deals, as well as more venture funding, for players in this segment.

A second potential effect could be that companies in other parts of the enterprise software market may start adding more privacy-related features.

Some already took this step after the implementation of GDPR in 2018. Recently funded database startup Cockroach Labs Inc., for example, provides a capability that lets customers specify the region where records should be stored. Other database makers, as well as players in areas such as analytics and marketing automation, may make data localization a bigger part of their development roadmaps following the ruling.

Photo: Pixabay