The EU General Court has released its judgment dismissing an action to annul the European Commission’s USA adequacy decision, confirming that at the time of the adequacy decision the USA ensured an adequate level of protection for personal data transferred from the EU to the USA.

On 10 July 2023, the European Commission adopted an adequacy decision which allowed personal data to be transferred between the EU and USA without further authorisation.

French lawmaker MEP Philippe Latombe brought an action for the annulment of the EU-USA adequacy decision on the basis that:

• The US’ Data Protection Review Court (DPRC) is not independent or impartial, and
• The bulk data collection by US intelligence agencies is not adequately subject to judicial oversight

This action has been dismissed by the EU General Court on both counts.

Key takeaways

• The DPRC, including appointment of its judges, was held to be subject to adequate safeguards ensuring its independence.
• The Commission is required to monitor the legal framework which the adequacy decision is based on and may suspend or amend such decision if that framework changes.

US intelligence agencies’ bulk collection of personal data is subject to ex-post judicial review by the DPRC, therefore is compatible with EU law.

What next?

For now, data flows between the EU and USA may continue on the basis, and subject to, the European Commission’s 10 July 2023 adequacy decision. However, the decision may be subject to further consideration should MEP Latombe elect to appeal the same to the Court of Justice.

The Court's press release relating to this decision can be found here.