On July 10, 2023, the European Commission adopted its decision granting adequacy status for the EU-US Data Privacy Framework (“the Framework”) – a mechanism aimed at enabling compliance with EU data protection requirements when transferring personal data from the European Union to the United States.
The Framework was the third attempt at a data transfer mechanism for transatlantic data flows after the Safe Harbor and Privacy Shield were invalidated by the Court of Justice of the European Union, in 2015 and 2020 respectively, in the infamous Schrems cases.
Prior to the granting of adequacy status for the Framework, the European Parliament expressed concerns about the Data Privacy Framework in May of this year, stating it "expects any adequacy decision, if adopted, to be challenged before the CJEU".
Unsurprisingly, no sooner had the decision been adopted than privacy campaigners were announcing that very intention. Proceedings in respect of the first challenge have already been commenced, using a previously unutilised right in the European Union.
Philippe Latombe challenges
The French MEP Philippe Latombe, announced in September (French language link) that he was challenging the adequacy decision on the Data Privacy Framework before the Court of Justice of the European Union.
The challenge, brought in his capacity as a private citizen, comprised a 33 page brief and additional 283 pages in exhibits. The challenge has been assigned case number T-553/53 but no further details have been released.
The statement released by Mr Latombe states he is seeking the immediate annulment of the adequacy decision, and also seeking to amend the existing text; which is identified as having numerous failures. These failures include insufficient guarantees for private and family life violating the Charter of Fundamental Rights corresponding to the bulk collection of personal data. In addition, there is a failure to comply with GDPR due to the absence of effective remedies, access to an impartial tribunal and guarantees relating to the safety of processed data.
The negotiations around the Framework are characterised by Mr Latombe as having a clear American-centric perspective, with the aforementioned criticisms made by the European Parliament ignored, leaving no opportunity for an informed debate. As part of the perceived rush to approve the agreement, Mr Latombe also highlighted that the Data Privacy Framework also violated EU regulations by failing to be produced in the various official languages of the European Union.
What is interesting about the Latombe challenge is the use of the annulment mechanism under Article 263, which he characterises as having the advantage of speed compared to other routes. Article 263 allows for 'non-privileged applicants' including individuals to bring an action of annulment before the CJEU challenging the validity of legal acts in the EU.
Mr Latombe must establish standing for this action, which includes establishing that the act is both of direct and individual concern to him. This may present a significant hurdle to his challenge, and as of yet, it is not clear whether the CJEU will be prepared to deal with this action. We await any progression with great interest.
Noyb / Max Schrems
Following the adoption of the adequacy decision, the privacy non-profit organisation noyb, of which Max Schrems is the Honorary Chairman, announced an intention to challenge the decision as soon as feasible.
The changes in the Framework compared to previous iterations, discussed in our piece here, are dismissed as a facsimile of the Privacy Shield. In a detailed summary of their concerns with the Framework, noyb stated that it had "prepared various procedural options to bring the new deal back before the CJEU… It is not unlikely that a challenge would reach the CJEU by the end of 2023 or beginning of 2024."
At the time of publication, noyb have not announced the progression of any of their proposed procedural challenges. Progression may be dependent on the probability of success of Mr Latombe's challenge. Nonetheless, if this fails, we would expect noyb to progress similar challenges to those used in the previous Schrems cases.
