Further to our last blog post, two separate challenges have been launched against the EU-US Privacy Shield. “Digital Rights Ireland” and “La Quadrature du Net” have separately begun proceedings to annul the European Commission’s approval of the adequacy decision of the Privacy Shield framework.
To recap, Privacy Shield provides a framework for EU-US personal data transfers and was approved by the European Commission (the “Commission”) in July 2016. This approval marked the end of a process which began when the predecessor scheme, “Safe Harbour”, was struck down as unlawful by the CJEU in Maximillian Schrems v Data Protection Commissioner.
In proceedings which formally began on 16 September 2016, the group Digital Rights Ireland has asked for, amongst other things, a declaration from the CJEU that the relevant implementing decision be declared null and void on the grounds that the Commission has made a “manifest error of assessment” in determining that the Privacy Shield framework provides an adequate level of protection for personal data transferred between the EU and US.
Digital Rights Ireland is of the view that the privacy principles set down in the Framework are “international commitments” which are not yet binding on the United States. It raised the concern that by virtue of the Foreign Services Intelligence Act, US public authorities will still have “secret access” to the content of electronic communications. Finally, it argued that the failure to transpose the relevant provisions of The Data Protection Directive (EU Directive 95/46/EC) into the adequacy decision is in contravention of the rights of EU citizens under the European Charter of Fundamental Rights where their personal data is transferred to the US.
In separate proceedings, the French digital rights group, La Quadrature du Net is challenging the effectiveness of the Privacy Shield US Ombudsman in dealing with complaints. It argues that "[t]he fact that it relies on so-called 'independent' instruments is in no way sufficient to consider it an independent judicial entity".
At present it is unclear how long it will take the CJEU to hear these cases. It is likely to take some time. Privacy Shield will remain in force in the interim period.