A second Privacy Shield legal challenge increases threat to EU-US data flows

The Privacy Shield transatlantic data transfer deal is now caught in a pincer action: A week after it emerged that Irish digital rights activists had filed suit to annul the deal come reports that a French campaign group has begun its own legal action.

French civil liberties campaign group La Quadrature du Net filed suit against the European Commission, the European Union’s executive body, on Oct. 25.

Although the Court of Justice of the EU has not yet published details of the complaint, Brussels-based news agency Euractiv reported Thursday that La Quadrature’s goal is to annul the Commission’s decision that Privacy Shield provides adequate protection under EU law when the personal information of EU citizens is transferred to the U.S. for processing.

Digital Rights Ireland filed a similar suit against the Commission in September, it emerged last week. Details of that case have not yet been released either, and DRI declined to comment.

Privacy Shield entered effect in July, a replacement for the Safe Harbor framework that in October 2015 was overturned by a decision of the CJEU. Transatlantic commerce worth US$260 billion is reliant on the transfer of data that Privacy Shield enables, U.S. Secretary of Commerce Penny Pritzker has said, and its interruption would have consequences for many companies offering cloud services to consumers.

By going to the court directly rather than making its complaint through a national data protection authority, DRI must prove that Privacy Shield is “of direct and individual concern” to it. That will be “an uphill battle,” according to Aaron Tantleff, a privacy and information security lawyer at Foley & Lardner.

La Quadrature, as a campaigning body rather than a collection of individuals with personal privacy rights to defend, will presumably face the same difficulty.

Neither the European Commission nor La Quadrature responded immediately to requests for comment on the court filing, details of which will eventually be published in the EU’s Official Journal.