As widely expected, the EU-US Privacy Shield is being challenged before the European courts.

What is Privacy Shield?

In October 2015, the Court of Justice of the European Union (CJEU) ruled that the European Commission’s decision on adequacy for the Safe Harbor scheme was invalid.  The European Union and the United States agreed a new framework for the exchange of personal data for commercial purposes called the Privacy Shield to replace Safe Harbor. The Privacy Shield Framework was deemed adequate for the transfer of personal data by the European Commission in a decision dated 12 July 2016. Adequacy is granted only where the standard of protection in a third country is “essentially equivalent” to the rights and freedoms guaranteed by the EU regime on data protection.

Safe Harbor was challenged on the grounds that public authorities in the US had access to the content of electronic communications originating within the EU. When ruling on the European Commission’s adequacy decision in respect of Safe Harbor, the CJEU considered that the requirements for adequacy cannot be met where a regime compromises the right to respect for private life and fails to allow an individual to pursue legal remedies and to have access to their personal data.

The EU Article 29 Working Party recently published its opinion on the EU-U.S. Privacy Shield. It said that, despite improving some of the areas of the Safe Harbor scheme which had been particularly criticised, Privacy Shield still did not sufficiently address “massive and indiscriminate surveillance of individuals” by the US national security authorities in the light of the fight against terrorism.  The Working Party further added that this “can never be considered proportionate and strictly necessary in a democratic society as is required under the protection offered by the applicable fundamental rights”.

The Legal Challenge

The legal challenge was filed in Europe’s General Court (the Court of First Instance) on 16 September 2016 by a privacy advocacy group called Digital Rights Ireland but was only recently made public.  The General Court’s website reveals little more of substance about the challenge saying only that there is an “action for annulment” and the subject matter is “area of freedom, security and justice”. Reuters has reported that Digital Rights Ireland seeks annulment of the European Commission’s approval of the adequacy decision on the Privacy Shield Framework.

It remains to be seen how the case will be decided, but in reviewing Safe Harbor the CJEU established rationale on what adequacy means in light of the transfer of personal data. The Privacy Shield will remain in effect until the courts decide otherwise, which could take up to a year.

Matt Buckwell is co-author of this article.