EU Court Endorses EU-US Data Privacy Compact, Bolstering Commission's Position
In a recent ruling, the European Court of Justice (ECJ) General Court has upheld the Data Privacy Framework (DPF) agreement between the European Union (EU) and the United States. The DPF, negotiated in July 2023, sets out the rules governing the transfer of personal data of EU citizens between the EU and the US.
The origins of this legal battle can be traced back to a 2013 complaint by law student Max Schrems against Facebook and the inadequacy of the EU's year 2000 Safe Harbour agreement with the US. Schrems' NGO, None of Your Business (NOYB), still lacks legal certainty for users and businesses.
The ruling upholds that, on the date of adoption of the DPF, the US ensured an adequate level of protection for personal data transferred from the EU. However, Max Schrems believes the Court's ruling is still open to appeal and is considering bringing a broader challenge.
The US Data Protection Review Court provides ex post judicial oversight for signals intelligence activities carried out by US intelligence agencies. The US has introduced more legal oversight of the DPF at its end, addressing concerns in Europe about its approach to surveillance and privacy being deeply incompatible with European law and values.
The DPF was quickly dismissed by campaigners who argued it was a tweaked version of a previous flawed data transfer agreement, The Privacy Shield or 'Schrems II'. Max Schrems announced the Austrian data protection authority (Datenschutzbehörde) as the next possible challenger of the EU-US Data Privacy Framework.
Caitlin Fennessy, chief knowledge officer for the International Association of Privacy Professionals (IAPP), views the ruling as a major victory for the EU-US Data Privacy Framework. Chris Linnell, associate director of data privacy at consultancy Bridewell, notes the Commission's weak record of getting agreements with the US past courts in the EU.
French MP Philippe Latombe launched a legal challenge against the DPF, arguing it failed to provide adequate protection for EU citizens' personal data. If the DPF were to fall under legal challenge on similar grounds, campaigners have already signaled that further appeals are likely.
Schrems expresses concern about the use of Executive Orders by the Trump administration and believes a broader review of US law could yield a different result. Fennessy believes there might still be room for an appeal to test the issue of adequacy.
Without the agreement, EU companies would have to draft complex contracts with US suppliers imposing restrictions on data processing and handling, which would be expensive and time-consuming. The legal challenge created another delay and more uncertainty for companies transferring data to US entities. Max Schrems, the lawyer who lodged the initial complaint, still campaigns on the issue through his NGO.
Read also:
- Understanding Hemorrhagic Gastroenteritis: Key Facts
- Trump's Policies: Tariffs, AI, Surveillance, and Possible Martial Law
- Expanded Community Health Involvement by CK Birla Hospitals, Jaipur, Maintained Through Consistent Outreach Programs Across Rajasthan
- Abdominal Fat Accumulation: Causes and Strategies for Reduction
