Background. Philippe Latombe, a French member of parliament, brought an action for annulment of the EU-US data transfer agreement (Transatlantic Data Protection Framework) before the General Court (the First Instance among the EU Courts). The CJEU (the second instance within the EU Courts) had previously ruled in “Schrems I” and “Schrems II” that the two prior agreements were illegal. Both were anulled. The new deal is structured almost identically to the old, illegal deals and hence likely illegal – especially if you consider the Trump administration's latest abuses of power in issuing executive orders. Since Latombe's case was brought as an action for annulment and not as a preliminary question by a national court, he not only had to prove that the deal was substantively wrong, but also that he was directly affected in order to be entitled to bring an action at all.
Latombe challenge not convincing for General Court. The team of Mr. Latombe chose a rather targeted and narrow challenge of the EU-US data deal. It seems that, overall, the General Court was not convinced by the arguments and points raised by Mr. Latombe. However, this does not mean that another challenge entertaining a broader set of arguments and issues with the deal wouldn't be successful. Mr. Latombe may also choose to appeal the decision to the CJEU, which (judging from the previous decisions in "Schrems I" and "Schrems II") may have a different view than the General Court.
Max Schrems: “This was a rather narrow challenge. We are convinced that a broader review of US law – especially the use of Executive Orders by the Trump administration should yield a different result. We are reviewing our options to bring such a challenge. While the Commission may have gained another year, we still lack any legal certainty for users and businesses.”
Ruling on DPCR departs from facts in the USA. As far as the first press release by the Court summarizes the case, it seems the General Court has massively departed from the CJEU ruling and also is not up to date on US law. The Court for example held, that the new "Data Protection Court of Review" (DPCR) would be independent - when such independence is only guaranteed by a Presidential Executive Order and not by law. Trump right now removes people even when their independence is guaranteed by law.
Max Schrems: "We right now see Trump remove 'independent' heads of the FTC or Federal Reserve. The Court in question is not even established by law, but just but an executive order of the President - and can hence be removed in a Second. It is very surprising that the EU Court would find that sufficient. Comparing this case with inner-EU cases such as on Poland or Hungary, it takes a lot of mental flexibility to accept this as an independent Court."
General Court massively departs from CJEU rulings. The protections under the new deal are almost 1:1 a copy/paste of the previous deals that the CJEU found to be unlawful in Schrems I and Schrems II. In some elements the protections are even worse than in the older Executive Order that were not sufficient for the CJEU. It is therefore surprising that the General Court would issue a different decision on the 3rd version of the EU-US deal compared to the previous two versions.
Max Schrems: "It is clear that the lower court here massively departs from the case law of the CJEU. We are very surprised about this outcome. It may be that the General Court did not have sufficient evidence before it - or it wants to make a point to depart from the CJEU. We will have to analyse the ruling in more detail the next days."
