The EU-U.S. Data Protection Framework (DPF) has been spared to live another day and remains valid for transfers of personal data from the EU to the United States. The decision of the European General Court comes in sharp contrast to the decisions of the European Court of Justice's previous decisions, which struck down the DPF's predecessors, i.e., the U.S.-EU Safe Harbor and the EU-U.S. Privacy Shield.
The European General Court oddly based its decision on the sufficiency of the safeguards provided by U.S. law (and particularly, the independence of the U.S. Data Protection Review Court) at the time the DPF was approved instead of how the facts are today. Since the approval of the DPF, President Trump has fired the Democrats on the U.S. Privacy and Civil Liberties Oversight Board (PCLOB), and the validity of such firings is still being challenged in courts.
The ultimate outcome of the court proceedings may impact the long-term fate of the DPF. While the European General Court limited the current decision to the validity of the DPF at the time it was approved by the European Commission, it noted that "The Commission is required to monitor continuously the application of the legal framework on which (the adequacy decision) is based," and "... if the legal framework in force in the United States at the time of the adoption of the contested decision changes, the Commission may decide, if necessary, to suspend, amend or repeal the contested decision or to limit its scope."
While the decision provides some necessary certainty for businesses relying on the DPF to legally transfer personal data from the EU to the United States, it may be short-lived. First, there is a chance of an appeal from the European General Court's ruling to a higher court. Second, the European General Court's statements regarding the European Commission's continual monitoring of the DPF should be a reminder that the DPF is dependent on certain protections being in place in the United States, and that the Commission can re-evaluate if those protections change or are no longer present. But for today (at least), U.S. businesses can breathe a temporary sigh of relief.
A potential threat to the EU-U.S. Data Privacy Framework has been tamped down by the European General Court. In a landmark ruling 3 Sept., the court dismissed a challenge brought by Member of French Parliament Philippe Latombe to annul the DPF and confirmed the framework validity based on the facts and law at the time of the European Commission's adequacy determination for the U.S. in 2023.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
