CJEU dismisses bid to annul EU-US data privacy framework
The EU General Court upheld the EU–US Data Privacy Framework, rejecting claims it lacks adequate safeguards and independence in oversight of US data practices involving personal data from the EU.
The General Court of the Court of Justice of the European Union (CJEU) has dismissed an action seeking the annulment of the EU–US Data Privacy Framework (DPF). Essentially, the DPF is an agreement between the EU and the USA allowing personal data to be transferred from the EU to US companies without additional data protection safeguards.
Following the agreement, the European Commission conducted further investigations to assess whether it offered adequate safeguards. On 10 July 2023, the Commission adopted an adequacy decision concluding that the USA ensures a sufficient level of protection comparable to that of the EU when transferring data from the EU to the USA, and that there is no need for supplementary data protection measures.
However, on 6 September 2023, Philippe Latombe, a member of the French Parliament, brought an action seeking annulment of the EU–US DPF.
He argued that the framework fails to ensure adequate protection of personal data transferred from the EU to the USA. Latombe also claimed that the Data Protection Review Court (DPRC), which is responsible for reviewing safeguards during such data transfers, lacks impartiality and independence and depends on the executive branch.
Finally, Latombe asserted that ‘the practice of the intelligence agencies of that country of collecting bulk personal data in transit from the European Union, without the prior authorisation of a court or an independent administrative authority, is not circumscribed in a sufficiently clear and precise manner and is, therefore, illegal.’As a result, the General Court of the EU dismissed the action for annulment, stating that:
- The DPRC has sufficient safeguards to ensure judicial independence,
- US intelligence agencies’ bulk data collection practices are compatible with the EU fundamental rights, and
- The decision consolidates the European Commission’s ability to suspend or amend the framework if US legal safeguards change.
Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!