Privacy Shield Challenged in EU High Court

Irish privacy advocates challenged Privacy Shield in the European Court of Justice. Digital Rights Ireland v. Commission was filed in the ECJ General Court (number T-670/16). DRI said it couldn't comment, but a spokesman said the group has "a lot of background in the issue and these types of cases." The lawsuit, while not unexpected, is "a little premature" given that the trans-Atlantic personal data transfer arrangement isn't even three months into operation, said Hogan Lovells (London) data protection lawyer Eduardo Ustaran.

The Privacy Shield self-certification process opened Aug. 11 (see 1608010017). As of Oct. 19, more than 500 companies were listed, and Commerce Secretary Penny Pritzker said more than 1,000 applications were being processed (see 1610180016).

DRI has history for such challenges, its spokesman told us. It took on and won an ECJ case on EU data retention laws in 2014 and successfully argued in favor of striking down safe harbor in the lawsuit brought by Max Schrems, he said. DRI is contesting Ireland's data protection regime, he added. Some details of the Privacy Shield case will be published in the EU official journal "in the next few days," he said.

"It seems a little premature that not even three months into operation, the Privacy Shield's critics have taken the view that it isn't good enough and merits a full blown legal challenge," Ustaran emailed. This is all the more rushed since data protection authorities themselves were prepared to wait a year to see what the arrangement could deliver before taking any formal action, he said: The suit "seems to disregard the massive efforts made by the European Commission to agree [on] a realistic but solid legal framework for the protection of European data with the US government."

The challenge is likely based on the assumption Privacy Shield "cut some corners," but given the level of scrutiny the process received, it's "by no mean obvious" the arrangement doesn't meet the right standards, Ustaran said. All the legal filing does is "perpetuate the uncertainty" over how to ensure that data transfers to the U.S. are lawful, when "what we needed is a period of stability to build transatlantic privacy practices," he emailed.

There will be questions about the admissibility of the court challenge, and even if it goes ahead, it will probably not be decided until after the General Data Protection Regulation becomes fully applicable, said Ustaran. By then, the EC may already be in further talks with the U.S. to upgrade Privacy Shield, he said. If the ECJ had to decide on the adequacy of the agreement today, "I don't think that they would have enough evidence to show that it does not provide an adequate level of protection to the current EU data protection framework," he said.

The EC is aware of the application and doesn't comment on ongoing cases, a spokesman said. "As we have said from the beginning, the Commission is convinced that the Privacy Shield lives up to the requirements set out by the European Court of Justice, which have been the basis for the negotiations."