The civil rights advocacy group, Digital Rights Ireland, has filed a widely anticipated challenge to the EU-US Privacy Shield agreement (Privacy Shield). As we previously reported, the Privacy Shield, is the solution to a major challenge to transatlantic data transfers following the invalidation of the Safe Harbor programme by the Court of Justice of the European Union (CJEU). It intends to facilitate the free-flow of cross-border transfers of personal data between Europe and the US and has already been subscribed to by over 500 companies.

The agreement purports to address the inadequacies of the Safe Harbour Agreement by (amongst other improvements) appointing a US ombudsman devoted to protecting the data of European businesses and increasing government oversight of data processing activities. Digital Rights Ireland has challenged the EU's adoption of the Privacy Shield, arguing that it does not contain adequate privacy protections.

While the challenge was lodged by Digital Rights Ireland in September, it may take at least 12 months before the European General Court, the lower court of the CJEU, will rule on the matter. Digital Rights Ireland will also need to demonstrate that it has adequate legal standing to take the case. Generally, an act of the EU may only be challenged before the EU courts by those directly concerned, and it is arguable here that Digital Rights Ireland is not directly affected.