EU data-transfer scrutiny: the collapse of Privacy Shield and Dropbox's exposure

On 16 July 2020 the Court of Justice of the European Union, in the 'Schrems II' judgment, invalidated the EU–US Privacy Shield framework, the mechanism many American companies used to legitimize transfers of Europeans' personal data to the United States. The court held that US surveillance law did not provide European data subjects with protection essentially equivalent to that guaranteed under EU law.

Dropbox had self-certified under the EU–US and Swiss–US Privacy Shield frameworks to cover its transfers of certain personal data from the European Economic Area and Switzerland to the United States. With Privacy Shield gone, that basis evaporated, and the CJEU's ruling imposed heightened obligations on companies relying on the alternative mechanism of Standard Contractual Clauses — requiring case-by-case assessments and supplementary safeguards. In its own SEC filings, Dropbox acknowledged that European regulators could apply differing standards and require additional measures, and that the uncertainty around transatlantic data transfers created compliance risk.

This is regulatory and legal exposure rather than a single named lawsuit against Dropbox: the judgment applied broadly to US cloud providers, and critics and some European authorities argued that storing EU residents' personal data on US-based services such as Dropbox had become legally fraught. The risk has been partly addressed by the later EU–US Data Privacy Framework (adopted in 2023), but the area remains contested.

On 10 July 2023 the European Commission adopted the adequacy decision establishing the EU–U.S. Data Privacy Framework. On 3 September 2025 the EU General Court dismissed a challenge to that decision brought by French citizen Philippe Latombe (Case T-553/23, Latombe v Commission), finding that, as of the decision's adoption, the United States ensured an adequate level of protection for personal data transferred from the EU. The Court noted that, under the decision, the Commission 'is required to monitor continuously' the framework and 'may decide, if necessary, to suspend, amend or repeal' it. Dropbox's privacy policy states that 'Dropbox, Inc. complies with the EU-U.S. and Swiss-U.S. Data Privacy Frameworks, as well as the UK Extension to the EU-U.S. Data Privacy Framework' under the U.S. Department of Commerce's program, and that its certification 'does not include the FormSwift portion of the Services.'