In the Shadow of the European Court of Justice: The Luxembourg Conference on Transatlantic Data Transfers
By: Kenneth Propp (European Law Blog)
The EU-U.S. Data Privacy Framework (DPF), freshly in force, faces an early legal challenge at the Court of Justice of the European Union (CJEU). On September 7, 2023, French parliamentarian Philippe Latombe initiated a direct action seeking annulment of the European Commission’s adequacy decision concerning the DPF. Mr. Latombe’s request for interim measures, aiming to halt DPF application, was rejected by the CJEU. However, several aspects of the case, including the question of standing, remain unaddressed.
Adding to the legal landscape, Austrian privacy activist Max Schrems, renowned for his role in invalidating two prior EU-U.S. data transfer agreements, has publicly declared his intent to challenge the DPF in the coming months. Schrems contemplates an indirect action in a Member State court, potentially in Austria, setting the stage for a preliminary reference to the CJEU. Thus, the unfolding chapters of the transatlantic privacy drama seem poised to play out in Luxembourg over the ensuing years.
Amidst these developments, the Max Planck Institute for Procedural Law (MPI) in Luxembourg, situated near the CJEU, convened a timely conference on September 15, 2023. The conference, hosted by the outgoing director, Professor Burkhard Hess, and co-organized by the author of this blog post, delved into the EU-U.S. agreement within the context of European fundamental rights and data protection law. This post provides an overview of the proceedings.
The conference brought together key negotiators of the accord, judicial officials, scholars in data protection and national security law, representatives from civil society, and legal practitioners. An unusual aspect was the participation of European and American national security officials responsible for data privacy oversight within their agencies. This post encapsulates the key insights gleaned from the discussions…