The most direct legal threat to the EU-US data transfer agreement, the Latombe case, could be rejected on procedural grounds, even if the agreement is no longer sound. But today’s hearing may indicate an unconventional third path.
The independence of US intelligence and commercial watchdogs enforcing the Trans-Atlantic Data Privacy Framework (DPF) has become questionable under Trump, but the Commission is not incentivised to provoke the US and disrupt the trillion-euro bilateral trade underpinned by the data transfer agreement.
More likely, the Court of Justice of the European Union (CJEU) will have to invalidate it, like in the Schrems I and Schrems II cases that took down the two previous agreements. That requires a case to land in the EU’s top court, the ECJ, which could take years.
French MP Philippe Latombe challenged the DPF less than two months after its conception, and his case will be heard in the lower-level CJEU General Court today.
“Having data transfers to unsafe third countries going on for years certainly is not in line with the goals envisioned when GDPR was put in place,” Thomas Bindl, who won €400 from the Commission in compensation for them causing a transfer of his personal data to the US, told Euractiv.
While Bindl is not impressed by the DPF, “especially given recent changes,” he worries the Latombe case might not be up to the task of invalidating it.
“I think the procedural hurdles are quite high,” he said, based on his own experience in a similar case.
“The main issue in [Latombe’s] case is standing, as the Court dismissed similar cases in the past,” Gabriela Zanfir-Fortuna, vice president for global privacy at the Future of Privacy Forum told Euractiv.
Latombe seems the annulment of the DPF based on its effects on EU fundamental rights, but the question is whether he has sufficient stake, or standing in legal speak, in transfers of data to the US to seek such a strong measure.
The unconventional path
“Usually matters of admissibility – like standing – are dealt with as preliminary threshold issues before any hearing takes place,” Joe Jones, director of research and insights at the International Association of Privacy Professionals (IAPP) told Euractiv.
However, “it is not clear whether [today’s] hearing will be limited to standing or whether it will include submissions and consideration on the pleadings themselves.”
If today’s hearing focus on more than standing, this suggests a possible scenario where the court could rule on the DPF whether Latombe has standing or not, according to Jones.
The Court “might be persuaded that the validity of the DPF is so significant to rule on it,” he said.
No matter the outcome, the ruling can be appealed to the ECJ, which will face similar dilemmas.