A legal challenge to the EU and US Privacy Shield, a mechanism used by thousands of companies to authorize data transfers from the European Union to the United States, will be heard by the highest court of Europe this summer.
The General Court of the EU set a date of July 1 and 2 to hear the complaint filed by the French digital rights group, La Quadrature du Net, against the European Commission commission. Renegotiated data transfer agreement that maintains that the agreement remains inconsistent with EU law due to the mass surveillance practices of the US government.
Privacy Shield was adopted just three years ago after its precursor, Safe Harbor, was brought down by the European Court of Justice in 2015 following exposure of access to personal data from US intelligence agencies. , Revealed by NSA whistleblower Edward Snowden.
The renegotiated agreement adjusted some elements and made the mechanism subject to annual reviews by the Commission to ensure that it worked as planned. But even before it was adopted, it faced fierce criticism: Data protection and privacy experts expressed it as an attempt to put a lipstick on the same pig that is breaking EU law.
The continued survival of the Shield has also come under additional pressure as a result of the Trump administration, which has entrenched itself rather than rolled back US privacy laws, as well as shuffling its feet to key quotes the Commission said the deal’s survival depends on. .
Before last year’s annual Privacy Shield review, the EU parliament called for the mechanism to be suspended until the United States complied with the requirements. (The Commission ignored the calls.)
At a particularly embarrassing time for the mechanism, the disgraced political data firm Cambridge Analytica emerged. it had been signed to self-certify its “compliance” with EU privacy law …
La Quadrature du Net has long criticized Privacy Shield and filed its complaint in October 2016, immediately after Privacy Shield went live. It argues that the mechanism infringes on fundamental EU rights and does not provide adequate protection for the data of EU citizens.
Subsequently, he filed a joint petition with a French NGO for his complaint to be presented to the General Court of the EU, in November 2016. Many things followed, with exchanges of briefs between the two parties setting out the arguments and arguments in against.
The Commission has been supported in this process by countries such as the USA, France and the UK and companies such as Microsoft. and the tech industry association, Digitaleurope, whose members include Amazon, Apple, Dropbox, Facebook, Google, Huawei, Oracle, and Qualcomm (to name a few).
While La Quadrature du Net receives support from the local consumer protection organization UFC Que Choisir and the American Civil Liberties Union – which says it provided “a detailed description of the US surveillance regime”.
“The General Court of the EU has considered our complaint serious and serious enough to open a procedure,” says La Quadrature du Net now.
It will be up to the court in Luxembourg to hear and judge the complaint.
A decision on the legality of the Privacy Shield will be made after July, perhaps in a few months, as the CJEU has been known to make rapid progress in cases involving the defense of fundamental EU rights. Although it can also take the court more time to issue a judgment.
All companies that subscribe to the Privacy Shield should be aware of the risk and have contingencies in case the agreement is canceled.
This complaint is also not the only legal question that Privacy Shield faces. A questionnaire submitted to a separate data transfer mechanism in Ireland by privacy activist Max Schrems – whose original challenge brought down Safe Harbor – has now also been referred by Irish courts to the CJEU, in what is known as ‘Schrems II’.
In that case Facebook. has attempted to block the referral of court questions to the CJEU, seeking to appeal to the Supreme Court of Ireland, although there is normally no right to appeal a referral to the CJEU.
Facebook was granted permission to appeal, and the Irish Supreme Court is expected to rule on that appeal early next month. However, the appeals process has not suspended the referral. It also does not affect La Quadrature du Net’s complaint against Privacy Shield that will be heard later this summer.
