Europe’s Privacy Shield faces a legal challenge from an Irish civil liberties group.
The Digital Rights Ireland (DRI) has brought a complaint against the Safe Harbour successor that governs the transfer of personal data between the European Union and the US.
It has asked the bloc’s General Court—which is the Court of Justice of the European Union’s lower court—to annul the framework, arguing that “it does not contain adequate privacy protections,” Reuters reported.
If the challenge succeeds, the 500 companies that currently depend on Privacy Shield to ensure their data transfers from the EU to the US comply with EU privacy laws will be placed in a difficult position. Either they will need to find alternative legal approaches—for example, using contracts—or they may be forced to keep all personal data of EU citizens within the 28-member-states’ bloc.
As Ars reported, Privacy Shield was introduced earlier this year to replace the similar Safe Harbour framework, which was struck down by the CJEU following a legal challenge by privacy activist Max Schrems.
On Thursday, Schrems told Ars that he wasn’t involved in the current request to the General Court.
DRI is bringing its legal action under Article 263 of the Treaty on the Functioning of the European Union, which allows the Court of Justice to review and annul the European Commission’s activities.
Carlo Piltz, a German legal expert on issues arising from technology, told Ars that he wasn’t surprised the challenge was being made, adding that “using the tool of action for annulment is perhaps a bit surprising.”
He said: “Most observers expected the first Privacy Shield review by the EU commission to take place and that afterwards perhaps an individual person in a member state would lodge a complaint to its [data protection authority] and this case would then be referred by a national court to the ECJ [EU Court of Justice].”
Piltz also noted that—by taking this route—DRI has to prove it fulfils the necessary requirements that the Privacy Shield framework is “of direct and individual concern” to the group:
“According to the case law of the ECJ, this requires that persons other than those to whom a decision is addressed (in the case of Privacy Shield, the member states) may claim to be individually concerned only if that decision affects them by reason of certain attributes which are peculiar to them or by reason of circumstances in which they are differentiated from all other persons, and by virtue of these factors distinguishes them individually just as in the case of the person addressed (the member states).”
“On lawyers orders we are saying very little about this right now,” DRI’s chairman, T J McIntyre, told Ars.
However, the group shouldn’t be underestimated. Its earlier legal action against the EU data retention directive resulted in the CJEU forbidding excessive metadata retention, a key judgment whose implications are still being explored.
As to what happens next in DRI’s new challenge, Piltz explained: “In general, an oral hearing can take place after the close of the written part of the procedure if a main party, like DRI, requests such a hearing.
“If there is no such request, the General Court may decide to rule on the action without an oral part of the procedure.”
The General Court may also request the opinion of an advocate general, as happens for the CJEU. According to Reuters, it will be a year or more before the court rules on the case.
Ars will be exploring the increasingly important area of data flows in an immanent feature.