Data transfer to US: lawsuit against EU data protection framework goes to ECJ

The dispute over the EU-US data protection framework is entering its next round. French MEP Philippe Latombe has confirmed that he will appeal the judgment of the General Court of the European Union (EuG) from September on the validity of the Data Privacy Framework (DPF) to the European Court of Justice (ECJ). This will make the free transatlantic data flow a case for the highest EU court for the third time.

Latombe, who sits for the government party Mouvement Démocrate in the French National Assembly, is opening the door to a "Schrems III" ruling with this step. The ECJ had already declared the predecessor agreements Safe Harbor and Privacy Shield invalid. This was done at the instigation of Austrian civil rights activist Max Schrems, who is still considering whether to become active in the matter again. In both proceedings, the ECJ ruled that US surveillance practices, particularly under Section 702 of the Foreign Intelligence Surveillance Act (FISA) and Executive Order 12333, violated the data protection rights of EU citizens.

Further landmark ruling expected

The latest bone of contention is the EU Commission's recent adequacy decision for the transfer of personal data from the EU to the USA. This recognizes the legal situation regarding privacy protection in the United States as being comparably high as on the old continent. The EuG had also presumed in the first instance that the USA guaranteed a substantially equivalent level of protection for personal data at the time the adequacy decision was issued.

Latombe justified his lawsuit and the subsequent appeal mainly with the argument that the DPF is incompatible with the EU Charter of Fundamental Rights and the General Data Protection Regulation (DSGVO). The parliamentarian explains his approach to Euractiv by stating that the newly created Data Protection Review Court (DPRC) in the USA is neither impartial nor independent of the executive branch. Thus, the right to an effective remedy and an impartial tribunal is not guaranteed.

Data hunger of US intelligence agencies

In addition, Latombe complains about the massive and non-targeted data collection by US intelligence agencies such as the NSA. The precautions taken in the DPF are not sufficient to counteract these serious infringements of fundamental rights. US President Donald Trump has further weakened the protective measures introduced by his predecessor, Joe Biden.

With his approach, the representative also wants to put pressure on the Commission and the member states to create a permanently legally secure framework. Whether companies based in the EU can legally store and process personal data with US cloud providers depends on the new ECJ review. It can be assumed that the Luxembourg judges, beyond evaluating the EuG decision, will also thoroughly examine the facts related to the legal questions raised and make another landmark ruling.

(nie)