12. July 2019

Being the successor of the Safe Harbor Agreement declared ineffective by the European Court of Justice in 2015, the EU-US Privacy Shield now forms one of the most important legal bases for the transfer of personal data between the EU and the USA.

On 1 and 2 July 2019, the ECJ held the oral hearing in the legal dispute (Case T-738/16) concerning the EU-US Privacy Shield.

The French NGO “La Quadrature du Net” together with two other French organisations had already filed a complaint against the European Commission on 25 October 2016, shortly after the EU-US Privacy Shield came into force.

They criticized the Privacy Shield as insufficient to ensure an adequate level of data protection in the USA and requested the declaration of invalidity of the underlying EU Commission decision (Implementing Decision (EU) 2016/1250).

The plaintiffs asserted violations of the Charter of Fundamental Rights of the European Union in four pleas:

1. generalised nature of the collections allowed under the US regulatory regime,
2. no level of fundamental rights protection equivalent to EU standards, as data processing in the USA is not limited to what is absolutely necessary,
3. lack of effective remedy in the US regulatory regime,
4. no level of protection of fundamental rights equivalent to EU standards, due to lack of provision of independent monitoring under the US regulatory regime.

On the other side, large companies such as Microsoft, as well as representatives of the governments of Great Britain, France and Germany, are supporting the agreement.

The decision of the ECJ is still pending. Since a large part of the data processing between the USA and the EU is carried out via the Privacy Shield and not via the EU standard contract clauses, binding corporate rules or an explicit declaration of consent, a success of the complaint would have far-reaching consequences for the international transfer of data.