US Supreme Court ruling threatens EU-US Data Privacy Framework

Due to a recent ruling by the US Supreme Court, the transfer of personal data from the EU to the United States is on shaky grounds. Max Schrems, Chairman of privacy advocacy group noyb, calls on the European Commission to withdraw the adequacy decision on the US.

For years, the EU and the US relied on the Safe Harbor Agreement to exchange personal data between the two continents. In 2015, the European Court of Justice ruled that this agreement didn’t provide sufficient safeguards to protect the privacy of Europeans.

In response, Brussels and Washington developed a new legal framework in 2016 to enable data sharing. This resulted in a new agreement called the Privacy Shield.

In the summer of 2020, the European Court of Justice also struck down this agreement. The court found that the US didn’t offer the same level of protection for citizens as is required by the EU.

After nearly three years of negotiating, a new data-sharing agreement was announced in 2023: the EU-US Data Privacy Framework.

For the EU-US Data Privacy Framework to function properly, an independent data protection authority (DPA) is needed to ensure that the data flow of personal information enjoys the same level of protection as in Europe. Up to this point, the US appointed the Federal Trade Commission (FTC) as its independent privacy regulator to meet the EU’s requirement for independent oversight.

However, a majority of the US Supreme Court recently ruled that the independence of the FTC is unconstitutional because the US President should have power over all executive bodies, including the competition authority.

According to noyb, the entire structure of the EU-US Data Privacy Framework has collapsed because the European Commission fully relied on the independence of the FTC.

The privacy advocacy group from Austria has sent a letter to the executive branch of the EU, asking it to take the appropriate steps to repeal the EU-US data transfer deal.

“Even in the European Commission’s logic, the basis for any EU-US data transfer deal is dead. We call upon the Commission to start an orderly exit from the US cloud, which is not easy, but unfortunately unavoidable. The Commission built a legal house of cards under industry pressure. Now that it clearly collapses, it has to take responsibility,” Schrems said in a statement on Monday.

To annul the EU-US Data Privacy Framework and renegotiate a new deal typically takes up several years.