On 2 February 2016, the European Commission and United States announced the EU-US Privacy Shield, the new framework for transatlantic data flows replacing the previous Safe Harbour agreement which was invalidated by the CJEU in its Schrems ruling on 6 October 2015.

Though the text of the new agreement has yet to be published and is still subject to an adequacy decision by the Commission, Vice-President Ansip and Commissioner Jourová assure that the new agreement protects the fundamental rights of EU citizens when their personal data is transferred to US companies .

The main elements of the agreement as summarised by the Commission's press release are:

• Stronger obligations on US companies handling Europeans' personal data and robust enforcement and notably the obligation for US companies to comply with European Data Protection Authorities (DPA) decisions;
• Clear safeguards and transparency obligations on U.S. government access to imported personal data for law enforcement and national security purposes;
• Effective protection of EU citizens' rights with several redress possibilities including by lodging complaints directly with the US company concerned, the relevant EU DPA, or a newly created Ombudsperson for national security. EU DPAs will be able to refer complaints to the US Department of Commerce or the US Federal Trade Commission.

The new framework will be reviewed annually by the EU Commission and the US Department of Commerce.

Pending the Commission's adequacy decision in the coming weeks, which will set out the new rules, and until WP29's assessment on whether the new EU-US Privacy Shield does indeed address the concerns raised by Schrems judgment, WP29 has confirmed that in the meantime existing transfer mechanisms, such as Standard Contractual Clauses and Binding Corporate Rules, can be used and that transfers to the US cannot take place on the basis of the invalidated Safe Harbour decision.

However full legal certainty will only be provided when all the details of the agreement are made clear and the WP29 assessment has been performed. Moreover, it remains to be seen how the principles will apply in practice and how US companies will comply with them.