Transatlantic data: Data Privacy Framework already challenged

On September 7, 2023, the French MP Philippe Latombe filed an appeal against the Data Privacy Framework (DPF) with the European Court of Justice (ECJ). A member of the center Modem party, and of the French data protection authority (Cnil), he did not do so in his professional capacity, but “as a simple citizen”. Presented by the European Commission on July 10, 2023, the DPF sets a new legal framework for data transfers between the European Union and the United States.

The two previous agreements on the issue, Safe Harbor and Privacy Shield, were both invalidated by the ECJ, in 2015 and 2020. Indeed, US law does not provide any protection guarantee when it comes to the personal data of Europeans. US authorities can access, with a court order, any data held by a US company, even if based outside the United States.

Since the situation has, in essence, not really evolved, the DPF does not seem more compliant with European regulation (particularly in regard to the GDPR) than its predecessors. Philippe Latombe thus spoke out against “deeply unbalanced measures, developed to the detriment of European law (…) and ultimately of European citizens.” The appeal is the first against the DPF. ECJ recognition could trigger a swift move to nullify the bill.