The EU General Court Gives Victory to Backers of Trans-Atlantic Data Flows
The European Union General Court on Wednesday dismissed a plea by a French politician to annul the legal framework underpinning commercial data flows across the Atlantic, rejecting claims that a U.S. intelligence agency oversight body is not independent of the federal government.
See Also: On Demand | From Patch to Prevention: Modernizing Remediation Across Hybrid Environments
The ruling, which could be appealed, is a victory for American tech companies and the European and U.S. politicians who erected the framework to straddle potentially incompatible visions of digital privacy. A top European official in 2022 put the odds of the framework’s survival in court as a seven or eight out of 10 (see: EU-US Data Privacy Framework in Activist’s Crosshairs).
The EU-U.S. Trans-Atlantic Data Privacy Framework allows American companies to transfer and process the data of European citizens in the U.S., enabling an estimated 900 billion euros in annual cross-border business. Brussels and Washington adopted the framework in 2023 after two years of negotiations prompted by a Court of Justice of the European Union decision in 2020 invalidating the framework’s predecessor (see: European Commission Adopts EU-US Data Privacy Framework).
French centrist politician Philipe Latombe brought a case against the framework in 2023. He argued oversight mechanisms instituted in the U.S. as a result of framework negotiations are politically influenced and not independent. One mechanism is the Data Protection Review Court, a review board housed in the U.S. Department of Justice that reviews intelligence agency responses to complaints from European citizens that intelligence collection flouted their human rights.
The General Court said in a statement the review board is sufficiently independent and that the European Commission can amend or suspend the framework if conditions change.
Latombe also asserted that bulk collection of internet traffic by U.S. intelligence agencies itself merits the framework’s annulment. Judges said that there’s nothing to suggest that data collection must be authorized beforehand, only that it must be subject to judicial review after the fact. U.S. intelligence agencies are subject to judicial review, leading the court to reject Latombe’s lawsuit. He did not immediately respond to a request for comment.
Privacy advocates continue to be skeptical. Max Schrems, the Austrian activist behind court decisions invalidating two of the framework’s predecessors, described Latombe’s case as a “rather narrow challenge,” which primarily hinged on the politician’s fears over his data safety. “We are convinced that a broader review of U.S. law – especially the use of executive orders by the Trump administration should yield a different result,” Schrems said in a statement.
“The Data Protection Review Court is politically fragile and untested, and commercial surveillance under the framework relies on self-certification with weak enforcement,” said Itxaso DomÃnguez, policy advisor at European Digital Rights. “Executive orders are no substitute for real legal guarantees, and redress mechanisms that exist mostly on paper do not amount to effective protection.”
DomÃnguez told Information Security Media Group the judgment signals the EU’s willingness to accept “weak safeguards for political convenience.”
Helping future challenges against the framework could be the Trump administration’s dismissal in January of three Democratic members of the Privacy and Civil Liberties Oversight Board. The board’s role in the framework agreement is to ensure that any European complaint about data misuse is addressed in a timely manner by the federal government. It is also meant to ensure the intelligence community abides by restraints placed on it during the Biden administration, restrictions intended to shield Europeans from online surveillance (see: President Biden to Sign Trans-Atlantic Order).
Departure of the three commissioners has left the board – it currently has one Republican member – without sufficient members to constitute a quorum.