Formal challenge to Privacy Shield pact published

Digital Rights Ireland is seeking an order for costs against the European Commission in its legal challenge against the Privacy Shield data transfer framework agreed between the EU and the US earlier this year. The organisation is taking the case claiming the Shield does not sufficiently protect the personal data of EU citizens. Details of the proceedings have been published in the EU's official legal journal.

The European Commission made a so-called “finding of adequacy” in relation to Privacy Shield, effectively certifying that firms signing up to it provide an equivalent level of protection for personal data to that provided in the EU.

DRI's proceedings lodged with the General Court of the European Union – the lower court of the Court of Justice – are an application under Article 263 of the Lisbon Treaty for an annulment of that decision.

The privacy lobby group is seeking a declaration from the court that the commission’s implementing decision of July 12th, 2016 “is a manifest error of assessment by the commission insofar as it finds an adequate level of protection in the US for personal data” concordant with the existing data protection directive.

It also seeks a declaration that the commission’s decision on Privacy Shield is “null and void” and an order for costs against the European Commission.

Ten pleas in law are set out in support of the action, including that the “privacy principles” set out in Privacy Shield do not constitute “international commitments” within the meaning of the EU’s data protection directive.

DRI also alleges that US legislation permits pubic authorities there to have “access on a generalised basis to the content of electronic communications” and consequently are not concordant with the Charter of Fundamental Rights of the European Union.

Among the legal authorities cited in DRI’s proceedings are the Schrems case before the Court of Justice of the European Union in October 2015.