The European Commission announced on Tuesday 30 June that it will analyse the implications for the EU-US data transfer agreement of Monday’s ruling by the United States Supreme Court, which found the independence of US executive authorities, including that of the Federal Trade Commission (FTC), unconstitutional.
“We have taken note of the decision of the United States Supreme Court. We will now carefully analyse any implications it may have for the EU-US agenda,” Markus Lammert, the Commission spokesperson responsible for home affairs and justice, said at a press conference.
The spokesperson recalled that in July 2023, the Commission adopted an adequacy decision concluding that the United States ensures “an adequate level of protection for personal data transferred from the European Union under the EU-US Data Privacy Framework” (see EUROPE 13219/11). He also emphasised that “the main US legal instrument on which this framework is based, namely the United States presidential ‘executive order’, remains in force and continues to provide essential safeguards for data transferred from the European Union”.
“As with all adequacy decisions, the Commission is monitoring it to ensure that a high level of protection is maintained. It will continue to work closely with the US administration on this issue”, he added.
Asked about any measures the European Union might take, the European Commission’s chief spokesperson, Paula Pinho, stressed the need to examine the court ruling “more thoroughly”. Markus Lammert added that “the GDPR provides us with all the tools we need to respond to any potential developments”, referring to the General Data Protection Regulation (GDPR), currently under review as part of the European Commission’s simplification programme (see EUROPE 13897/15).
Legal challenge by Max Schrems, who is calling for “an orderly exit from the EU-US Data Privacy Framework”. In a letter addressed to European Commissioner for Justice Michael McGrath on 30 June, privacy advocate Max Schrems points out that, to ensure compliance with Article 16(2) of the Treaty on the Functioning of the European Union (TFEU) and Article 8(3) of the Charter of Fundamental Rights of the European Union, “the Commission has so far relied on the FTC as the equivalent of an independent supervisory authority in the European Union”. He urges the Commission to initiate “an orderly exit from the EU-US Data Privacy Framework”, accompanied by “a reasonable transition period”.
The European Center for Digital Rights, Noyb, Mr Schrems points out, also plans to challenge in court the adequacy decision adopted by the Commission in 2023. “It would be preferable for the European Commission to incorporate the issue of data transfers between the European Union and the United States into a political agenda, such as the recent ‘Tech Sovereignty Package’”, his letter states (see EUROPE 13880/1).
On 6 October 2015, in its Schrems I judgment, the Court of Justice of the European Union (CJEU) invalidated the European Commission decision finding the US data protection regime (‘Safe Harbor’) to be adequate. Then, in its Schrems II judgment, delivered in July 2020, the CJEU annulled the Commission decision on the ‘Privacy Shield’, finding that US surveillance programmes constituted an excessive infringement of fundamental rights, thereby rendering transfers of personal data based on this mechanism unlawful. (Original version in French by Ana Pisonero Hernández)