Following the European Court of Justice’s landmark ruling on Privacy Shield, startup communities must strike one important mechanism off the list of avenues for transatlantic data transfers. It begs the question: why does this matter and what other mechanisms do startups have at their disposal?

Data adequacy is granted by the European Commission if another country has developed a comparable set of personal data protection laws to those in European laws. If this is the case, data can flow freely between the jurisdictions. In the case of Privacy Shield, data adequacy is achieved by voluntarily signing up and subjecting oneself to the mechanism. To date, over 5,300 companies signed up. Many of these are startups. Most of them provide services for startups and the wider economy. In terms of overall volume, the American Chamber of Commerce’s 2020 report found that transatlantic data flows accounted for one-half of Europe’s overall data flows.

Data adequacy agreements are an attractive data transfer mechanism because they provide a common mechanism for small businesses and startups to adopt and maintain. This decreases the barriers to entry for newcomers and enables innovative startups from one region to serve customers in other jurisdictions. 

The agreement was struck down because the ECJ determined that EU personal data laws were in fact not sufficiently safeguarded. 

Now that it is clear what doesn’t work, startup communities need to know what does. It should be possible to find a way for data flows to work outside of the EU as well through an adequacy decision. Policy makers supportive of global, interconnected markets and startups now have a unique crisis-turned-opportunity moment to come up with an improved mechanism. 

Today the alternatives to a data adequacy framework are Standard Contractual Clauses (SCCs) and Binding Corporate Rules. Both share high entry costs and have a set of imperfections that come with them as well. Bigger companies will be able to set this up, startups and SMEs will struggle. Indeed, when starting up entrepreneurs don’t think of hiring lawyers first, but rather coders. If we want to maintain this mindset, it is incumbent on us to build an adequacy framework for them.

In a year of uncertainty, the ECJ ruled that Privacy Shield doesn’t work. Now it is up to policy makers and the innovation ecosystem to rally and constructively build an alternative.