EU-US data transfer: framework survives legal challenge… for now

EU General Court rejects legal challenge to EU-US data transfer framework. Privacy uncertainties persist; the ruling may be appealed. Regulatory future remains complex and unclear.

The Key Points: The EU General Court rejected a legal challenge to the EU-US data transfer framework, brought by Philippe Latombe, but privacy uncertainties remain. The challenge was dismissed on its merits, not standing.

Why This Matters: The framework continues to provide a basis for data export between the EU and US, but activists and experts remain sceptical about its long-term viability. Legal clarity is still lacking for businesses and may be subject to further appeals.

What Might Happen Next: Mr. Latombe may appeal to the CJEU, and privacy groups, including Max Schrems, suggest broader challenges could follow. Changes in US oversight since the case began complicate matters further.

What You Should Be Doing: Continue to monitor legal developments and safeguard data operations. Prepare for further potential changes and ensure compliance with both the current framework and wider GDPR obligations.

ADDITIONAL INFORMATION:

Explanatory note from Lewis Silkin LLP on the decision

Max Schrems response to the ruling:  

This was a rather narrow challenge. We are convinced that a broader review of US law – especially the use of Executive Orders by the Trump administration should yield a different result. We are reviewing our options to bring such a challenge. While the Commission may have gained another year, we still lack any legal certainty for users and businesses.”