GDPR- Court of Justice invalidates Privacy Shield - ICO reacts immediately - UK law may change - Brexit impact may be significant

Court of Justice invalidated Privacy Shield and Standard Contractual Clauses as mechanisms that would allow EEA based companies to transfer personal data to the US on a regular basis. 

Following the judgement, ICO published a note almost immediately saying that: 

‘We are currently reviewing our Privacy Shield […] guidance [...]

If you are currently using Privacy Shield please continue to do so until new guidance becomes available. 

Please do not start to use Privacy Shield during this period.

If you have any specific questions please call our helpline on 0303 123 1113."

As Lexis Nexis commented: 

"Following the end of the Brexit implementation period this judgment will continue to form part of UK law and UK organisations will need to comply with equivalent obligations (although the relevant standard when assessing the level of protection under the UK GDPR, which will apply after the end of that period, would be whether the protections are essentially equivalent to UK, rather than EU, laws)."

The UK government is not happy about this ruling so it is possible that the law will change soon.  If it does, it is also possible that the UK will no longer meet the adequacy condition for data protection by the European Commission making it harder to do cross-border business by UK professional services firms. 

Source: https://www.lexology.com/library/detail.aspx?g=beac4d7a-b495-437e-b633-5...