December 3, 2021

Volume XI, Number 337

Advertisement
Advertisement

December 03, 2021

Subscribe to Latest Legal News and Analysis

December 02, 2021

Subscribe to Latest Legal News and Analysis

December 01, 2021

Subscribe to Latest Legal News and Analysis
Advertisement

Challenge to EU-U.S. Privacy Shield Lands at EU Court

On September 16, 2016, Digital Rights Ireland (“DRI”), a digital rights advocacy group, lodged an action with the EU General Court for annulment of the European Commission’s Decision on the EU-U.S. Privacy Shield arrangement. While the existence of the application has only recently become public knowledge, it was widely-expected that the Privacy Shield would face a legal challenge.  It is also unsurprising that DRI have brought the action (given its objections to the Privacy Shield before it was agreed and its intervention in the Safe Harbor case).

Background

The Privacy Shield was agreed earlier this year, replacing the Safe Harbor framework that was invalidated by the Court of Justice of the EU (“CJEU”) in Schrems.  The Privacy Shield provides a legal basis for transfers of personal data from the European Economic Area to Privacy Shield-certified companies in the U.S.  To date, over 600 companies have certified to the Privacy Shield.  The Privacy Shield contains a much more robust set of commitments than those underpinning the Safe Harbor and will provide stronger protections to data subjects in the EU than its predecessor.

DRI’s action

As yet, little is known about the action and the General Court case file says only that DRI have lodged an “action for annulment.”  An application for annulment is a direct action contesting the validity of an EU act for any number of reasons, including that: (i) the EU institution(s) adopting the measure lacked competence to do so; (ii) the adoption of the measure infringes an essential procedural requirement; (iii) the measure infringes the Treaties or of any rule of law relating to their application; or (iv) adoption of the measure is a misuse of powers.

The General Court will declare the Privacy Shield adequacy decision void (a declaration of nullity) if it finds that any of the above reasons are well-founded.

Generally, applications for annulment are first heard by the General Court acting as a court of first instance.  Decisions of the General Court can be appealed to the CJEU.

Next steps

A summary of DRI’s action will be published in the Official Journal in the coming weeks.  It is unlikely that the General Court will issue its decision until late-2017 or 2018.

Unless and until the General Court orders otherwise, the Privacy Shield arrangement remains fully operational as a legal means by which transatlantic data transfers can be effected.

© 2021 Covington & Burling LLPNational Law Review, Volume VI, Number 301
Advertisement

About this Author

Joseph Jones, Covington, Copyright and trademark attorney
Associate

Joe Jones is an associate in the technology and media practice group, having joined the firm as a trainee solicitor in 2014.

Mr. Jones advises emerging and leading companies on data protection and intellectual property issues, including cybersecurity, copyright, trademarks, and e-commerce. He has experience advising companies in the technology, pharmaceutical, and media sectors. His practice encompasses regulatory compliance and advisory work. He regularly provides strategic advice to global companies on complying with data protection laws in Europe and the UK....

44 20 7067 2193
Advertisement
Advertisement
Advertisement