On September 16, 2016, Digital Rights Ireland (“DRI”), a digital rights advocacy group, lodged an action with the EU General Court for annulment of the European Commission’s Decision on the EU-U.S. Privacy Shield arrangement. While the existence of the application has only recently become public knowledge, it was widely-expected that the Privacy Shield would face a legal challenge.  It is also unsurprising that DRI have brought the action (given its objections to the Privacy Shield before it was agreed and its intervention in the Safe Harbor case).

Background

The Privacy Shield was agreed earlier this year, replacing the Safe Harbor framework that was invalidated by the Court of Justice of the EU (“CJEU”) in Schrems.  The Privacy Shield provides a legal basis for transfers of personal data from the European Economic Area to Privacy Shield-certified companies in the U.S.  To date, over 600 companies have certified to the Privacy Shield.  The Privacy Shield contains a much more robust set of commitments than those underpinning the Safe Harbor and will provide stronger protections to data subjects in the EU than its predecessor.

DRI’s action

As yet, little is known about the action and the General Court case file says only that DRI have lodged an “action for annulment.”  An application for annulment is a direct action contesting the validity of an EU act for any number of reasons, including that: (i) the EU institution(s) adopting the measure lacked competence to do so; (ii) the adoption of the measure infringes an essential procedural requirement; (iii) the measure infringes the Treaties or of any rule of law relating to their application; or (iv) adoption of the measure is a misuse of powers.

The General Court will declare the Privacy Shield adequacy decision void (a declaration of nullity) if it finds that any of the above reasons are well-founded.

Generally, applications for annulment are first heard by the General Court acting as a court of first instance.  Decisions of the General Court can be appealed to the CJEU.

Next steps

A summary of DRI’s action will be published in the Official Journal in the coming weeks.  It is unlikely that the General Court will issue its decision until late-2017 or 2018.

Unless and until the General Court orders otherwise, the Privacy Shield arrangement remains fully operational as a legal means by which transatlantic data transfers can be effected.