Report from the Bloomberg
In Brief – The European General Court has ruled that the EU-US Data Privacy Framework (DPF) adequately protects the privacy rights of Europeans regarding their personal data held by companies in the United States. The agreement was negotiated by the European Commission and the United States in 2022 to resolve a long-standing legal dispute in Europe that threatened to block the ability of countless companies in both jurisdictions to transfer, store and process data for European-based users in the US. The DPF clarified when US intelligence agencies can access personal information about people in the EU and outlines how Europeans can appeal such collection, including creating the Data Protection Review Court made up of American judges to hear appeals from EU citizens who allege that their personal data was improperly collected and used by US agencies. It was challenged by a French parliamentarian who argued that it offered EU citizens weak redress mechanisms, did not include rules on automated decision-making, and provided insufficient safeguards for data security. The General Court ruled that the DPC met appropriate standards when the European Commission approved it in 2023 but said that the Commission was required to review the DPC’s ongoing validity on a continuing basis.
Context – The legal dispute over US-EU “Cross Border Data Flows” emerged following the Snowden revelations. The European Court of Justice invalidated the US-EU Safe Harbor agreement in 2015 and then struck down the US-EU Privacy Shield agreement in 2020. Both cases technically pitted Facebook against EU privacy activists, but the fights were about US intelligence and anti-terrorism surveillance laws. The US Congress did not change the laws and EU leaders continued reaching agreements with their US counterparts to avoid major digital service shutdowns and allow valid antiterrorism surveillance. The EU privacy advocates who led the legal battles that took down the two earlier agreements criticized the legal strategy behind the recent challenge that failed at the European General Court and argue that the DPC remains vulnerable.