The Court of Justice of the European Union declared the EU-U.S. Privacy Shield arrangement is invalid. However, it did uphold the validity of standard contractual clauses, with a caveat: the third country to which EU data is transferred must have protections in place, particularly around access by public authorities and the ability for EU citizens to have legal redress.