An Austrian non-profit that successfully challenged two seminal, transatlantic data transfer agreements says that a successor deal recently announced by authorities is unlikely to hold up in Europe’s highest court.
Last week, European Commission president Ursula von der Leyen and U.S. President Joe Biden announced they had concluded a preliminary deal on a new framework that would offer companies like Meta and Google a robust legal basis to transfer the personal data of EU users to the U.S. According to the European Commission, these transatlantic data flows fuel €900 billion in cross-border commerce annually.
Since the European Court of Justice struck down the previous data protection deal in 2020, companies have had to rely on a more cumbersome legal instrument, so-called standard contractual clauses.
According to Romain Robert, program director at NOYB, short for “None of Your Business,” the new Trans-Atlantic Data Privacy Framework, as it is called, is unlikely to satisfy EU legal requirements.
Robert told Law.com International that the information currently available about the deal suggests that it will not resolve the European Court of Justice’s concerns about its Safe Harbour and Privacy Shield predecessors.
“Even if the issues [the court raised] regarding mass surveillance were addressed—lack of judicial redress and disproportionate collection of data—it remains to be seen how,” Robert said.
When the court struck down the Privacy Shield, it did so on the grounds that it violated the EU Charter of Fundamental Rights, Robert explained. The court never assessed whether the Privacy Shield even met GDPR standards, as this privacy legislation was not yet in force when the data protection deal was adopted in 2016.
“Nothing indicates that the commercial data usage principles of the Privacy Shield have been updated to align with the standards of the GDPR” in the new deal, Robert said.
Moreover, he noted that a recent U.S. Supreme Court decision had also made it even more unlikely that the Luxembourg court’s concerns over EU citizens’ lack of judicial remedy in the U.S. would be addressed under the new agreement. That decision, in FBI v. Fazaga, “confirmed that EU citizens would not have access to a court in the U.S. [to challenge] surveillance,” Robert said. “So, good luck. It’s going to be very difficult to reach the level of remedy [asked for] by the Court of Justice.”
Robert said it was too soon to comment on any prospective legal action and noted that the final texts of the U.S. and EU legal documents would likely only be released several months from now.
Still, he said, “we already are. of course. collecting information and preparing ourselves.”
