EU court upholds Europe-US data transfer accord

An EU court Wednesday upheld the pact governing the transfer of personal data between the 27-nation bloc and the United States, dismissing a challenge by a French lawmaker.

In effect since 2023, the EU-US Data Privacy Framework was the bloc’s third attempt at a legal framework to protect Europeans’ personal data in exchanges with the US — the first two were shot down in court.

French lawmaker Philippe Latombe brought his case at the Luxembourg-based General Court, the lower chamber of the Court of Justice of the European Union, two years ago.

He asked for the pact to be annulled because it did not fully respect the bloc’s data protection rules, and argued it was illegal for US intelligence agencies to  collect personal data in bulk while it was being transferred from the EU.

He also objected to the fact the pact did not allow him to prevent his personal data being collected in France by the likes of Google, Apple, Facebook, Amazon or Microsoft.

The General Court found against him on all counts and said it “dismisses the action in its entirety”.

“On the date of adoption of the contested decision, the United States of America ensured an adequate level of protection for personal data transferred from the European Union to organisations in that country,” it said in its ruling.

Latombe told AFP on Wednesday he intended to appeal.

Business groups, worried by the prospect of a protracted new legal fight, welcomed the ruling.

“This outcome provides stability and reassurance for businesses and consumers on both sides of the Atlantic who rely every day on trusted cross-border data flows,” US-based lobby group the Business Software Alliance (BSA) said in a statement.

‘Narrow challenge’

The previous two accords governing EU-US data transfers — called Safe Harbor and Privacy Shield — were struck down by the EU’s top court following challenges led by Austrian activist Max Schrems in 2015 and 2020.

The European Commission has argued that the new framework offers significant improvements over the previous mechanisms.

Under the US constitution, Americans are protected from electronic spying by US intelligence agencies — but all other nationalities are fair game.

The new pact’s adoption was made possible after a White House executive order updated intelligence agencies’ rules on international data flows to give safeguards to EU citizens and residents.

Citizens also have the right to redress if they found their data was wrongly handled by US companies.

Contacted by AFP, Latombe said he intended to appeal before the EU’s top court on the basis of several points raised in the lower chamber’s ruling.

He also said he intended to press the European Commission to examine whether changes made since 2023 — in particular since Donald Trump returned to office — would justify annulling the deal.

Reacting to the latest ruling, Schrems likewise indicated the fight was not over and said his privacy rights group NOYB (None of Your Business) was “reviewing our options” to bring a challenge of its own.

“This was a rather narrow challenge,” the Austrian activist said of Latombe’s case. “We are convinced that a broader review of US law… should yield a different result.”