I'm getting confused on the differences between "GDPR", "Privacy Shield", and "Safe Harbor". Can someone please elaborate? I think Privacy Shield replaces "Safe Harbor" but I still don't understand why GDPR wouldn't just apply to everything.
EU privacy laws has specific requirements regarding the transfer of data out of the (European Economic Area) EEA. One of these requirements is that the transfer must only happen to countries deemed as having adequate data protection laws. GDPR Article 45:
A transfer of personal data to a third country or an international organisation may take place where the Commission has decided that the third country, a territory or one or more specified sectors within that third country, or the international organisation in question ensures an adequate level of protection.
The European Comission does not list the US as one of the countries that by default meets this requirement.
This means that by default, according to the GDPR, it is illegal to transfer personal data from the EEA to the USA.
That is a letdown to the transatlantic trade in digital services, which amounts to 260 billion dollars per year (source: Reuters). So the problem that faced the legislators drafting the GDPR is to both keep personal data and money flowing across the Atlantic, but at the same time pretending that the personal data is safe from surveillance. I.e. they had to come with some loophole.
And there is! In the GDPR such a loophole it provisioned in Article 47, which states that companies outside the EEA that adopt "binding corporate rules" for data protection are exempt from GDPR Article 45, if their adoption is "approved by a competent supervisory authority".
Such "binding corporate rules" was first laid down in the EU-US Safe Harbour Principles (from 2000-2015), which is now rebranded (with minor changes) as the EU-US Privacy Shield Framework (2016-).
The reason for the re-branding was that the European Court of Justice i 2015 declared the EU-US Safe Harbour Principles invalid, following the revelations by Edward Snowden regarding indiscriminate mass surveillance carried out by the US government, so in 2016, they had to think up a new name to keep the loophole open. There is not much difference between the two, and neither protects European citizen's personal data from indiscriminate mass surveillance carried out by the US government.