The General Court dismissed a French MP's challenge to annul the EU-US Data Privacy Framework (DPF). The court held that the DPF ensures an "adequate level" of protection for personal data transferred between the EU and the US, giving certainty to organisations that rely on the framework. The ruling may be appealed to the European Court of Justice, which previously struck down two earlier EU-US data-sharing agreements. The court rejected claims that US intelligence agencies require prior authorisation to intercept bulk data and found DPRC judicial oversight and safeguards sufficient to protect independence.
The court today dismissed legal action brought by a French MP to annul the EU-US Data Privacy Framework (DPF). It found that the framework, which businesses rely on to transfer data between the EU and the US, ensured "an adequate level" of protection for personal data passing between the EU and the US. The decision provides certainty for organisations and businesses that rely on the DPF to exchange data between the EU and the US.
French MP Philippe Latombe challenged the lawfulness of the EU-US Data Privacy Framework on the grounds that US intelligence services collect data in transit from the EU in bulk without adequate safeguards for the privacy of EU citizens. He argued that the US Data Protection Review Court (DPRC), set up to hear complaints from EU citizens who believe their privacy rights have been breached by US intelligence agencies, was neither impartial nor independent of the US executive.
The Luxembourg court dismissed both claims, finding that there was nothing in European case law - established in the Schrems II case in 2020 - that requires US intelligence agencies to seek prior authorisation before intercepting bulk data from the EU. The court found that it was sufficient that the US intelligence agencies were subject to judicial oversight by the DPRC. It found that the US court had safeguards in place to ensure the independence of its members from the executive.
Collection
[
|
...
]