European court rules in favor of the latest US and EU data transfer framework
Europe’s second-highest court has dismissed a challenge against between the European Union and the US. “On the date of adoption of the contested decision, the United States of America ensured an adequate level of protection for personal data transferred from the European Union to organisations in that country,” the EU’s General Court ruled ().
The two sides brokered the Trans-Atlantic Data Privacy Framework in 2023 to continue allowing US companies to store European users’ personal data on Stateside servers. The pact included a proviso that allows for Europeans to file complaints over what US companies do with their data.
French politician Philippe Latombe sued the European Commission (EC), the EU’s executive arm and the body that struck the deal with the US, claiming that “there were inadequate guarantees of respect for private and family life in the agreement because of the widespread and bulk collection of personal data,” according to . He also said that the Data Protection Review Court (DPRC), , wasn’t an independent tribunal and didn’t necessarily offer the level of protection required under European law.
The General Court determined that the DPRC’s functioning and appointment of judges “are accompanied by several safeguards and conditions to ensure the independence of its members.” It stated that the judges can only be removed by the Attorney General and for cause, while the AG and intelligence agencies “may not hinder or improperly influence their work.”
The political landscape has shifted dramatically since the agreement was reached in 2023. The Trump administration has over independent government agencies and it’s been at loggerheads with the EU over issues such as regulating major US-based tech companies and international trade. Still, the General Court points out that the EC is required to keep an eye on the application of the legal framework.
“If the legal framework in force in the United States at the time of the adoption of the contested decision changes, the Commission may decide, if necessary, to suspend, amend or repeal the contested decision or to limit its scope,” the court said. The judges also dismissed Latombe’s claims regarding the bulk collection of personal data.
Latombe can still take the case to the Court of Justice of the European Union. Europe’s top court previously scrapped two previous data transfer deals between the EU and US — the and the — following challenges by pro-privacy activist Max Schrems, who raised concerns about American intelligence agencies accessing the private data of European citizens.
