EU Court Hears Arguments in Case Seeking Annulment of EU-U.S. Data Transfer Pact

Latombe is a long-standing advocate of European digital sovereignty and a commissioner of French privacy authority CNIL, Hogan Lovells noted in a legal analysis. He filed his case before the General Court in Sept. 2023, stressing that he was acting personally, not as a legislator or CNIL member.

The case centers on an article in the Treaty on the Functioning of the European Union that permits any natural or legal person to launch proceedings against "an act addressed to that person which is of direct and individual concern to them, and against a regulatory act which is of direct concern to them and does not entail implementing measures," the firm noted. For his challenge to be admissible, Latombe must meet the requirements of direct and individual concern.

If the criteria are met, "the procedure will offer the advantage of speed compared to the pre-judicial question procedure used in the past by [privacy activist] Maximilian Schrems," the firm wrote. Schrems' organization isn't involved in this case, but he told us earlier that he's happy about additional challenges to the DPF (see 2309130011).

The lawmaker based his request for annulment on several arguments, the firm noted. One was that U.S. surveillance authorities' bulk collection of personal data violates the data minimization and proportionality principles of the General Data Protection Regulation (GDPR). A second was that the U.S. hasn't guaranteed the right of Europeans to an effective remedy for data misuse, particularly because of a lack of transparency concerning the Data Protection Review Court procedure.

A third claim is that the U.S. lacks a framework governing automated decision-making, and that the DPF doesn't solve the risks of such processing occurring. Last, Latombe argued, there are no GDPR-required safeguards for securing processed data once it's transferred to the U.S.

The EC's arguments "largely echoed those already documented in its DPF adequacy decision, and confirmed in its first review of the functioning of the DPF, in particular confirming that 'U.S. authorities have put in place the necessary structures and procedures to ensure the DPF functions effectively,'" Hogan Lovells wrote.

Asked whether Latombe could have strengthened his case after President Donald Trump fired members of the Privacy and Civil Liberties Oversight Board (PCLOB) and FTC (see 2503250056), Hogan Lovells privacy attorney and analysis co-author Julie Schwartz emailed that the substantive arguments of the request couldn't be modified once it was filed.

Latombe was bound by the content of the request he filed Sept. 6, 2023, Schwartz added. He could, however, include the actions of the Trump Administration in his Monday arguments, but the fact that the first EC review of the DPF ended positively could counterbalance those arguments, she said.

Reported arguments from the EC at the hearing "included some considerations about the practical application of the DPF so far," Schwartz said. "No reference was made to the FTC powers and resources around the DPF" since Trump took office or to the PCLOB since the firing of three of its five board members in January, she said.

"These aspects may still be developed at a later stage," Schwartz said, either within the pending main proceeding or in any appeal by the lawmaker, the EC or any interested party, "or within another new proceeding (a future Schrems III?)."

The General Court is expected to rule in a few weeks or months, and it has the power to annul the DPF, the firm noted. It urged companies relying on the framework or other GDPR mechanisms for trans-Atlantic data flows to "closely monitor further developments."

A General Court annulment wouldn't be immediately enforceable until any appeals process before the ECJ is complete, the firm added. While the case heightens uncertainty about the future of data flows, any final action would take at least 18 months to take effect. Neither Latombe nor the Commission immediately commented.