The aim of the master's thesis is to address the issue of (un)lawful data transfers to the USA through an analysis of the data transfer provisions under the General Regulation and relevant decisions of the CJEU. First, the legal bases for transfers of personal data to third countries or international organisations are presented. The next section discusses the Decision 2000/520 on the Safe Harbor and the CJEU judgment C-362/14 Schrems I, as well as the Implementing Decision 2016/1250 on the Privacy Shield and the CJEU judgment C-311/18 Schrems II, as the findings of the CJEU in the mentioned judgments are necessary to understand the issue of transfers of personal data to the USA. This is followed by an analysis of the lawfulness of transfers to the USA, specifically transfers carried out on other legal bases after the invalidation of the Implementing Decision 2016/1250 on the Privacy Shield, and an analysis of the Implementing Decision 2023/1795 on the EU-US Data Privacy Shield Framework. In conclusion, the thesis answers the question of whether the analysed transfers of personal data to the USA are subject to a level of protection essentially equivalent to that guaranteed within the EEA. The broader issue of international transfers is highlighted, as revealed by the analysed cases of data transfers to the USA.
|
