European Court Upholds US-EU Data Privacy Framework Amid Challenges

The European Union’s General Court has upheld the US-EU Data Privacy Framework, a significant ruling that allows personal data to flow freely between the US and Europe. This decision dismisses a legal challenge from French Member of the European Parliament (MEP) Philippe Latombe, who argued that the framework, established in 2023, lacked adequate protections for European citizens' data. The ruling is crucial for over 2,800 US companies that rely on this framework for processing European data, impacting various sectors including cloud services, e-commerce, and artificial intelligence.

Center for European Policy AnalysisTransatlantic Data Flows, Privacy In Focus After EU Court Ruling

The US-EU Data Privacy Framework was negotiated to address concerns raised by previous legal challenges that invalidated earlier agreements, such as the Safe Harbour and Privacy Shield frameworks. Both were struck down by the European Court of Justice due to US surveillance laws that allowed excessive access to European data. The new framework introduces limits on intelligence collection and establishes the Data Protection Review Court, which enables Europeans to contest US surveillance practices.

Center for European Policy AnalysisTransatlantic Data Flows, Privacy In Focus After EU Court Ruling

Philippe Latombe's challenge centered on claims that the Data Protection Review Court is not independent, as it operates within the US Department of Justice. He contended that US agencies continue to collect data in bulk without sufficient oversight. However, the General Court ruled that the framework includes safeguards against executive interference and that bulk data collection is subject to judicial review. The court emphasized the importance of maintaining the framework to avoid disruption in transatlantic data transfers, which are vital for the digital economy.

Center for European Policy AnalysisTransatlantic Data Flows, Privacy In Focus After EU Court Ruling

Despite the ruling, privacy advocates remain skeptical about the framework's durability. Critics, including Austrian activist Max Schrems, argue that the US's commitments to data protection are fragile and reliant on executive orders rather than legislative measures. The European Commission has committed to reviewing the framework again in 2027, indicating that ongoing scrutiny will be necessary. Latombe has the option to appeal to the Court of Justice, which has historically taken a stricter stance on privacy issues.

Center for European Policy Analysis

• “The adequate level of protection ensured by the US in respect of transfers of personal data to organisations in that country, as affirmed by the General Court’s judgment, is by reference to the date of adoption of the European Commission’s decision that was challenged. Whether we should read anything into this is uncertain. For now, at least, Privacy Shield 2.0 has held up to judicial scrutiny, which will give comfort to most,” — Carney, Legal Expert

Transatlantic Data Flows, Privacy In Focus After EU Court Ruling

• “The ruling buys Brussels and Washington time.” — Dr. Anda Bologa, CEPA

Center for European Policy Analysis

The General Court's ruling provides a temporary resolution to the ongoing tensions surrounding transatlantic data transfers. While the framework currently stands, the potential for future legal challenges remains, highlighting the delicate balance between privacy rights and the demands of the digital economy.

Center for European Policy Analysis