Source: http://blog.kuan0.com/2016/09/privacy-shield-history-key-links.html
Timestamp: 2019-04-18 18:39:07+00:00

Document:
Snowden’s revelations of mass surveillance by US and other countries’ intelligence or security authorities kickstarted Safe Harbor’s demise and its replacement by the Privacy Shield. With a few exceptions, the chronology below starts with the Schrems ruling by the Court of Justice of the European Union (CJEU) on 6 October 2015, where the CJEU invalidated the EU-US Safe Harbour framework.
The links in this blog are up to date as of 6 August 2017.
See also the 12 July 2016 entry (in red) in the Chronology below, for Commission and US links on the finalised Privacy Shield framework.
"...The FTC and the Ombudsperson reiterated their general support to the Privacy Shield and their willingness to help the European Commission and the WP29 in their annual review. However, some of the key functions in the Privacy Shield architecture still need to be definitely appointed following the US election (Ombudsperson, FTC commissioners and PCLOB members). In addition, the organization of the annual review must be discussed in depth and in detail with the US authorities especially regarding access to documents. In that regard, Isabelle Falque-Pierrotin recalls that the objective of this annual review exercise is to verify through concrete evidences if US commitments under the Privacy Shield are fulfilled. It is essential that US authorities provide substance and demonstrate to EU stakeholders that the system is in place and works effectively so that this instrument ensures real and effective protection to EU data according to EU standards. The civil society expressed its concerns on the current context at national level especially on the renewal of Section 702 and on the overturn of FCC ebroadband privacy rules. The US Business industry supports the Privacy Shield as a solution bringing legal certainty to their transfers of data from the EU. In this context, the WP29 engaged at this plenary the discussions with the Commission as regard the organization of the joint review."
Pinsent Masons note on the final Privacy Shield (full disclosure – I was involved in this).
For abbreviations, see the end.
EU-U.S. data flows and data protection: opportunities and challenges in the digital era: speech by Commissioner Jourová in Washington D.C., announcing the first joint annual review of the Privacy Shield for September 2017.
Announcement of Commissioner Jourová's visit to Washington D.C. to discuss, inter alia, the Privacy Shield.
Taking data protection into a digital and globalised era: Joint Statement by Vice-President Ansip and Commissioner Jourová ahead of the 2017 Data Protection day, including: "Now, over 1700 companies have signed up to the Privacy Shield, with 700 further applications in the pipeline. We will continue to promote our data protection values at international level. This is why we will actively engage with key partners, such as Japan and South Korea, to reach adequacy decisions."
Re-certifications under Safe Harbor will no longer be accepted (see US Department of Commerce Safe Harbor webpage).
Subscribers to Privacy Shield as at this date (see the list) include, among cloud providers, Amazon, Google, Microsoft, Salesforce and Workday, but not yet Dropbox, Facebook, IBM or Twitter.
Privacy Shield Framework in force.
Does this imply that most DPAs will hold off from taking action regarding SCCs or BCRs until the first annual review?
Privacy Shield adequacy decision adopted by Commission.
Art. 31 Committee meeting approving Privacy Shield.
Note: 8 meetings of the Art. 31 Committee were held between 7 April 2016 and 8 July 2016 inclusive; find them by searching the EU Comitology register.
WP29 issued its opinion on draft Privacy Shield documents and a document on essential guarantees regarding state surveillance.
the sufficiency of the proposed Ombudsperson’s powers and independence.
the draft decision contained only limited information regarding the complex issue of access to Privacy Shield data by US law enforcement authorities.
The Privacy Shield will need review after the GDPR becomes applicable in 2018.
Effective remedies for individuals before an independent body.
Draft Privacy Shield documents released.
Note: the 29 Feb draft adequacy decision, linked to from that press release, now links only to the final July 2016 adequacy decision, which is problematic from a historical accuracy and research perspective. Fortunately, the Internet Archive has archived the original 29 Feb 2016 draft Privacy Shield adequacy decision.
We will not be seeking to expedite complaints about Safe Harbor while the process to finalise its replacement remains ongoing and businesses await the outcome.
Political agreement between EU and US on new Privacy Shield.
The US Safe Harbor – breached but perhaps not destroyed!
For the time being, [German] data protection authorities will not issue any new permission for data transfers to the US based on binding corporate rules (BCR) or data export contracts.
if, by the end of January 2016, no appropriate solution was found with the US, and depending on its assessment of transfer tools, EU DPAs were ‘committed to take all necessary and appropriate actions, which may include coordinated enforcement actions’.
Art. 1 was invalid – it did not comply with Art. 25(6) DPD or the Charter as it did not find, duly stating reasons, that that the US in fact ‘ensures’ an adequate level of protection by reason of its domestic law or its international commitments. No need to consider content of Safe Harbour principles.
WP29 – Article 29 Working Party, comprising EU data protection regulators, with an advisory function under Art.29 DPD.

References: CJEU 

Art. 31
 Art. 31

Art. 1
 Art. 25
 Art.29