EU-US Data Privacy Framework challenge rejected by EU General Court

The EU’s General Court has dismissed an application for interim relief by a member of the French Parliament who sought to annul the EU-US Data Privacy Framework (DPF), a mechanism that allows the transfer of personal data from the EU to the US for commercial purposes.

The DPF was adopted by the European Commission in July 2023, following the invalidation of the previous EU-US Privacy Shield by the Court of Justice of the European Union (CJEU) in July 2020.

The DPF is based on a set of principles and commitments that aim to ensure an adequate level of protection for personal data transferred from the EU to the US.

The challenge against the DPF

The applicant, Philippe Latombe, argued that the DPF did not provide sufficient safeguards for the protection of his personal data, especially in light of US surveillance laws and practices. He requested the court to suspend the operation of the DPF until the final judgment on the annulment action.

However, the court rejected the application for interim relief, finding that the applicant had not demonstrated the urgency of the measures requested. The court noted that the applicant had not shown how the DPF would cause him serious and irreparable harm, as he had only described the general effects and negative aspects of the DPF without explaining the nature of the damage he would suffer personally.

The court also observed that the applicant had not provided evidence that he used certain IT tools (such as Microsoft 365, Google and Doctolib) that would involve the transfer of his data to the US, or that he could not use other transfer mechanisms, such as standard contractual clauses or binding corporate rules, to ensure an adequate level of protection for his data.

The court concluded that the mere demonstration of a prima facie case, even a particularly serious one, could not compensate for the lack of urgency, and therefore dismissed the request for interim relief without examining the merits of the case or the balancing of interests.

The impact of the decision

The decision of the court does not affect the validity of the DPF, which remains in force until the final judgment on the annulment action. However, the DPF is also subject to an opinion by the European Data Protection Board (EDPB). This is expected to be issued soon and, while the EDPB’s opinion is not binding, it may influence the outcome of the annulment action.

Our views

UK businesses that rely on the DPF to transfer personal data to the US can continue to do so, subject to complying with the conditions and requirements of the framework. However, it will be important to monitor the developments of this case and be prepared to adopt alternative transfer mechanisms if the DPF is eventually invalidated by the court.