Judgment: European Court of Justice upholds US data transfer agreement

The data transfer agreement between the EU and the USA remains in force, at least for the time being. This was confirmed by the European General Court (EGC) in a ruling today (Wednesday). The agreement is based on a so-called adequacy decision by the EU Commission in accordance with Art. 45 GDPR from July 2023. This decision confirms a similar level of data protection in the USA as in the EU, as well as sufficient enforcement options for EU citizens. French MEP Philippe Latombe questioned this and wanted to overturn the decision with an action for annulment. He has now failed at first instance.

Today's ruling had been eagerly awaited, as the adequacy decision determines whether companies based in the EU, for example, can store and process personal data in US clouds in a legally secure manner. The decision came about because the then US administration of President Joe Biden had installed new protection mechanisms for European citizens' data in the USA in October 2022 with the Trans-Atlantic Data Privacy Framework (TADPF). However, Biden had not secured these mechanisms with a law, but merely issued them by presidential decree.

No impartial court?

Philippe Latombe had expressly invoked his rights as a private citizen in his complaint. He complained that the USA had violated the EU Charter of Fundamental Rights. The EU Commission could not guarantee an effective legal remedy in the USA and an impartial court because it was not provided for in the TADPF. The Data Protection Review Court (DPRC) established in the United States was created by an act of the US executive and not by law and is therefore not an independent court as required by the GDPR.

A press release from the EGC shows that the court takes a different view. The appointment of the judges of the DPRC and its mode of operation are "linked, according to the case file, to several guarantees and conditions intended to ensure the independence of its members". In any case, the EU Commission had imposed on itself in the adequacy decision to "continuously monitor the application of the legal framework that is the subject of the decision". If the legal framework were to change, for example if US President Donald Trump were to declare the Biden TADPF decree null and void, the Commission could "decide, if necessary, to suspend, amend or repeal the contested decision or to restrict its scope of application".

Schrems announces legal action

Because Latombe's complaint was very narrowly formulated, the EGC did not take many controversial issues into account in its decision. For example, access to EU data via the CLOUD Act or foreign surveillance under the FISA Act did not play a role. The Austrian data protection organization noyb criticized this in an initial statement: "We are convinced that a more comprehensive review of US law – especially the use of executive orders by the Trump administration – should lead to a different result."

noyb was founded by data protection activist Max Schrems, who had already overturned the two previous data transfer agreements "Safe Harbor" and "Privacy Shield" with lawsuits before the European Court of Justice (ECJ). He announced today: "We are currently examining our options for filing a lawsuit. Even though the European Commission may have won for another year, we still lack legal certainty for users and companies."

The plaintiff Latombe now has two months and ten days to lodge an appeal against the ECJ's decision. It would then be reviewed by the ECJ at second instance for legal issues. In a LinkedIn post today, Alexander Golland, European law expert and Professor of Business Law at Aachen University of Applied Sciences, emphasized: "This appeal sounds like an appeal, but it is not: to a certain extent, the ECJ also examines the facts underlying the legal questions. If Latombe appeals, the ECJ can therefore go beyond a mere legal assessment in some respects."

(hob)