The MP who wants to cancel the data transmission agreement between the EU and the United States: Siècle Digital

When a user posts a message on Facebook, searches for an item on Amazon, or likes a video on Instagram, they create personal data. American tech giants record all this information and send it to their country. This transfer is governed by the new data transfer agreement, called the Data Privacy Framework (DPF), adopted in July. The MP Philippe Latombe (MoDem) and commissioner of the CNIL, presented on Wednesday 6 September an appeal to the Court of the European Union (EU) to suspend this framework.

The first agreements on the transfer of personal data between the EU and the United States date back to 1998

On July 11, Philippe Latombe deplored, in a tweet, the new framework adopted by the European executive “ The European Commission’s implementing decision under the EU-US data protection regulatory framework has just been issued. And with it my last illusions about the Commission’s ability to impose itself against the United States “. In early September, after working all summer with specialized lawyers, the MP appealed to the EU court to cancel the DPF.

Contacted by Siècle Digital, Philippe Latombe regrets the Treaty’s failure to respect previous decisions of the Court of Justice of the European Union (CJEU). In October 2015, the CJEU struck down Safe Harbor, a set of principles passed between 1998 and 2000 that allowed American companies to authorize transfers of personal data to the United States. A new agreement, called Privacy Shield, was signed in July 2016. 4 years later, it will finally be canceled by European justice. It revealed that the current data transfer regime was contrary to the EU Charter of Fundamental Rights and the General Data Protection Regulation (GDPR), adopted in 2018.

« Basically nothing has changed between the Privacy Shield and the DPF. The Privacy Shield was the copy of Safe Harbor and the DPF is the copy of the Privacy Shield » proclaims the deputy from Vendée. According to him, the only difference between the two texts is a decree signed by US President Joe Biden, to address the concerns of the CJEU. With this executive order, the United States established a judicial system to handle complaints from European citizens. Philippe Latombe says that this court is neither independent nor impartial, although it is mandatory in European law. “ The judge of this court is under the responsibility of the United States Minister of Justice who deals with appeals from citizens of the Old Continent. » he insists.

The deputy also confides” In the event of an appeal, the treaty does not require the judge to explain why a violation has or has not occurred. “. This lack of transparency constitutes a violation of the CJEU’s decision to annul the Privacy Shield. The European justice system, in fact, had specified that during a ” bulk collection » personal data, companies have to justify several questions: what type of data is collected, for what purpose, what are the retention periods, etc.

Two different strategies between Philippe Latombe and NOYB to reduce the DPF

In the history of the cancellations of Safe Harbor and Privacy Shield, the Austrian lawyer Max Schrems played a fundamental role. He initiated the lawsuit that led to the revocation of Safe Harbor and Privacy Shield. He then created the NOYB association which often initiates legal proceedings to enforce the GDPR. Philippe Latombe admitted that he had not communicated with the Austrian activist. “ We were stuck in time. We have two completely different procedures for the treaty. »

Philippe Latombe had two months to present his appeal to the European Court. “ It was a real race against time blows the deputy, who is now awaiting the admissibility of his request. European justice will have to issue its verdict by October 10th. If accepted, the court’s first decision will be whether or not to suspend the treaty to prevent the first data transfers.

On the NOYB side, the strategy is different. When the DPF was published, Max Schrems announced that he wanted to take legal action. Unlike the path of appeal chosen by the French deputy, the Austrian lawyer goes through a preliminary question. To simplify, the lawyer attacks a European company, Meta for example, for transferring data to the United States. If the CJEU validates the illegality of the transfer, it effectively validates the abrogation of the treaty. Either of these strategies could bring the barely adopted DPF to its final hours.