On July 16, the Court of Justice of the European Union declared the European Commission’s July 2016 decision on the adequacy of the privacy protection provided by the EU-US Privacy Shield as invalid.^[1] As a result, the EU-US Privacy Shield framework is no longer a valid mechanism to comply with General Data Protection Regulation (GDPR) requirements when transferring personal data from the European Union to the United States. The decision does not, however, relieve participants in the EU-US Privacy Shield of their obligations under the framework.