Safeguarding trans-Atlantic developer collaboration

GitHub Shifts to SCCs After EU-US Privacy Shield Invalidated

The Court of Justice of the European Union (CJEU) has ruled that the EU-US Privacy Shield—a key framework for transferring personal data from the EU to the US—is invalid, citing concerns over US government access to European data. For GitHub, the ruling means the company can no longer rely on that framework for data transfers, but its response is designed to keep trans-Atlantic developer collaboration running without interruption.

Previously, GitHub depended on both the EU-US Privacy Shield and the Swiss-US Privacy Shield to process personal data from the EU, the UK, and Switzerland. The company also offered customers supplementary protections through Standard Contractual Clauses (SCCs) upon request. SCCs are contractual agreements between parties transferring personal data, binding them to maintain the privacy and security of that data. Importantly, the CJEU ruling leaves SCCs valid.

In line with the decision, GitHub is now using SCCs as the basis for data protection across all developers and customers. This shift is reflected in updated customer data protection terms and the company's Privacy Statement. Whether GitHub operates as a processor on behalf of customers or as a data controller in its own right, the company says it has mechanisms in place to support continued data flows from the European Economic Area, the UK, and Switzerland.

The company also points to its broader privacy posture. GitHub applies GDPR-level individual privacy protections to all users worldwide, regardless of location, going beyond what the SCCs require. Its transparency reporting provides additional visibility into how the company handles legally authorized government requests for data.

With further regulatory changes likely on the horizon, GitHub acknowledges the need to remain flexible and adapt its compliance practices as new requirements emerge. The company states its commitment to upholding data privacy laws wherever it operates, and to maintaining the levels of notice, choice, transparency, accountability, security, and recourse it offers to developers and customers globally.