Over the course of the past two months, three privacy groups in France and one in Ireland filed separate actions for annulment with the European Court of Justice seeking the invalidation of the EU-U.S. Privacy Shield Framework. The Privacy Shield honeymoon phase appears to be over, and the first year of the transatlantic relationship may prove to be the hardest. Although information is scarce, here’s what we know so far:
- Disloyal DPAs: Calling Into Question the Independence of the Irish DPA. On September 16, 2016, Digital Rights Ireland (DRI), an Ireland-based digital rights advocacy group, filed the first action for annulment, allegedly claiming that (1) Ireland contravened its obligations under the Data Protection Directive to properly implement the Directive and (2) the Irish Data Protection Commissioner is not independent from the Irish Government, as required under Article 8 of the Charter of Fundamental Rights. (See Case T-670/16).
- Surreptitious Surveillance: Schrems N’est-ce Pas? On October 25, 2016, three French privacy groups, La Quadrature du Net, French Data Network and the Federation FDN, sought the invalidation of Privacy Shield via a separate action for annulment. (See Case T-738/16). By contrast, here the parties took issue with the mass surveillance concerns that underscored the Schrems decision and argued that the European Commission violated Articles 7, 8, and 47 of the Charter of Fundamental Rights.
- Conflict Avoidance: The Article 29 Working Party Moratorium. You may recall that in an earlier blog post we noted that The Article 29 Working Party agreed to a moratorium on any Privacy Shield challenges until the annual review of Privacy Shield in August 2017.
Legal certainty was one of the selling points of the Privacy Shield framework and the Article 29 Working Party moratorium reinforced that promise. These two actions will call into question this very notion. As always, we’ll continue to monitor these updates as they unfold.