The European Court of Justice’s General Court has dismissed a major legal challenge against the new Data Privacy Framework (DPF) agreement between the EU and the US. This decision means the framework remains in place, allowing data transfers between the two regions to continue more smoothly. The court stated that, at the time of the agreement’s adoption, the US provided enough protection for personal data transferred from the EU.

Even though the ruling is not final and could be appealed, it’s a big win for the European Commission. If the court had struck down the DPF now, it would have meant starting from scratch after years of negotiations and legal setbacks. The agreement, finalized in July 2023, sets new rules for how EU citizens’ personal data can be transferred to US companies and organizations.

Many critics had already called the DPF just a rehash of earlier deals that failed in court, like the Privacy Shield or Schrems II, which the European Court of Justice invalidated in 2020. Soon after the DPF was announced, French lawmaker Philippe Latombe challenged its legality, arguing it didn’t do enough to protect EU citizens from US government surveillance. This added another layer of legal uncertainty for companies relying on US data transfers.

The roots of these issues go back to 2013 when Max Schrems, a law student turned privacy activist, filed a complaint against Facebook. He argued that the US Safe Harbour agreement, in place since 2000, was not protecting EU citizens’ data enough. In 2015, the ECJ agreed, ruling Safe Harbour invalid in what became known as Schrems I. Since then, legal challenges have kept emerging, creating a long-standing tension over data privacy rules.

European critics are wary because US surveillance laws are seen as incompatible with European privacy values. However, the US has made some changes. The Court’s judgment noted that US authorities now have judicial oversight over signals intelligence activities conducted by US agencies, which was seen as a positive step toward aligning with EU standards. Still, questions remain about whether the US laws offer the same level of protection as EU law.

Experts believe the court’s decision provides reassurance for many US companies and their European partners. Caitlin Fennessy from the International Association of Privacy Professionals called it a “major victory” for transatlantic data flows and trade. She also mentioned that the ruling might boost confidence in the framework’s future, though she acknowledged that there could be more legal challenges ahead.

Legal analysts like Chris Linnell point out that this isn’t the first time EU-US data agreements have faced court hurdles. Both Safe Harbour and Privacy Shield were challenged and eventually invalidated. He warns that the current framework might not be the final solution and that further appeals are likely, especially given the history of legal setbacks.

Without an agreement like the DPF, companies on both sides would face complicated and costly contractual obligations. They’d need to draft detailed data transfer agreements for every transfer, which could slow down business and increase costs. Many businesses hope the current framework will provide a clearer legal path for data sharing, but the fight might not be over.

Max Schrems, the activist behind the initial complaint, remains skeptical. His NGO, None of Your Business (NOYB), is already considering further legal action. Schrems argues that the Court’s ruling was narrow and that a broader review of US surveillance laws, especially those enacted under the Trump administration’s Executive Orders, could produce a different outcome. He emphasizes that legal certainty still isn’t guaranteed for users or businesses involved in cross-border data transfers.

As the debate continues, companies and regulators are watching closely. While this decision offers some relief, the ongoing legal challenges and evolving US laws mean the future of transatlantic data sharing remains uncertain. For now, however, the ruling helps maintain a legal framework that many rely on for international data flows, avoiding further disruptions in global digital trade.

Inspired by

• https://www.csoonline.com/article/4050892/relief-for-european-commission-as-court-upholds-eu-data-privacy-framework-agreement-with-us.html

Sources

• gmpg.org
• shutterstock.com
• europa.eu
• europa.eu
• computerworld.com