Published on
A 2023 data transfer agreement between the EU and the US remains valid, the EU General Court has found, dismissing a French MEP’s complaint that it allows for disproportionate data collection, lacks transparency and adequate safeguards for Europeans’ personal information, and offers insufficient legal redress.
The case brought by French MEP Philippe Latombe was the first such challenge to an international agreement. He needed to convince judges that the deal affected him directly as an individual – but he failed to do so.
Over 2,800 US companies rely on the agreement to conduct business, and industry welcomed the decision. “This outcome provides stability and reassurance for businesses and consumers on both sides of the Atlantic who rely every day on trusted cross-border data flows,” wrote the Business Software Alliance.
Two earlier data transfer agreements, the Safe Harbour and the Privacy Shield, were invalidated in 2015 and 2020 respectively.
The decision comes against the backdrop of strained relations between Washington and Brussels over trade and digital regulation.
Speaking to Euronews before his March hearing, Latombe said he didn’t believe the geopolitical context would influence the outcome: “It might have an impact, I don’t know, it depends on the judges’ mood and how they see things. But logically, they should rule on the request as it was filed.” In other words, the judges only considered the situation as it stood in September 2023, when the complaint was lodged – a year before Trump’s re-election.
“The broader context of the transatlantic relationship is altogether different than when the past two rulings, in 2015 and then in 2020, struck out prior agreements. Back then both sides were eager to get to the negotiating table,” Joe Jones, director of research at the International Association of Privacy Professionals (IAPP), told Euronews.
“The consequences of disruption to data transfers are likely to be more acutely felt today, especially in so far as trade and technological development like AI model training are concerned,” he added, warning that it could lead to further escalation and possible retaliation from the United States.
Philippe Latombe may appeal to the EU Court of Justice. “Many eyes will now turn to whether the case will be appealed to the Court of Justice, which has traditionally taken a more expansive approach to data protection cases and has a two out of two strike rate against EU-U.S. data adequacy decisions. Perhaps more uncertainty awaits,” Jones said.
Less than a year ago, before the re-election of Donald Trump, the Commission deemed the agreement “adequate”. The next evaluation of its adequacy will be conducted in 2027.
