Luxembourg – The European Union’s second-highest court, the General Court based in Luxembourg, on Wednesday endorsed a new data transfer agreement between the EU and the United States, replacing two earlier deals rejected by a higher tribunal, reports 24brussels.
This new framework aims to ensure that the US provides an adequate level of protection for personal data transferred from the EU to the US, following the invalidation of previous arrangements by higher courts.
What is the general court’s role in this decision?
“The General Court dismisses an action for annulment of the new framework for the transfer of personal data between the European Union and the United States,”
the court stated in its ruling.
“In so doing, it confirms that, on the date of adoption of the contested decision, the United States of America ensured an adequate level of protection for personal data transferred from the European Union to organisations in that country,”
the General Court added.
The agreement affects thousands of companies, including banks, tech firms, drugmakers, and automakers, that transfer personal data for commercial purposes, such as payroll processing.
What concerns led to the rejection of previous pacts?
Earlier frameworks, including the EU-US Privacy Shield, faced significant scrutiny and legal challenges. They were deemed insufficient because US law allowed government authorities to access transferred data without providing EU citizens a reasonable avenue for judicial redress.
The upper court nullified the previous EU-US data transfer agreements due to concerns that the US did not provide adequate protection for the personal data of EU citizens transferred to its territory.
The European Court of Justice highlighted its worries over US government surveillance of European personal data and the lack of adequate protections ensuring compliance with EU Data Protection standards, particularly concerning GDPR requirements.
What are some other examples of data transfer agreements between the US and EU?
Historically, there have been several significant data transfer agreements between the EU and the US. Notably, the Safe Harbour Agreement was the first major legal framework allowing US companies to self-certify adequate data protection to transfer EU personal data. However, in 2015, the Court of Justice of the EU (CJEU) invalidated Safe Harbour following revelations about extensive surveillance by US intelligence agencies.