US-EU Privacy Framework in Doubt Again

noyb, the Austrian privacy group headed up by activist lawyer Max Schrems, has called on the EU to begin an 'orderly withdrawal' from the framework by which US companies receive personal data from within its boundaries. Failure to do so will lead to a legal challenge in a matter of weeks.

noyb (None Of Your Business), whose pursuit of meaningful consumer privacy protection has led to the striking down of two previous data transfer frameworks, says the US Federal Trade Commission no longer has the independence required by the latest, 2022-3 framework, following a ruling by the US Supreme Court two weeks ago (Monday, June 29th). This decision, Trump v. Slaughter, found that the FTC's legally defined independence from presidential control - set out when the Commission was created in 1914 - is in fact unconstitutional.

The ruling rests on the 'unitary executive theory', under which the President must retain the power to remove every officer who exercises executive authority. Schrems says this interpretation has 're-written more than 90 years of US constitutional doctrine', and added in the recent media statement: 'Given that there are no independent authorities in the US anymore, we call on the European Commission to orderly withdraw the adequacy decision on the US.' noyb's call will be difficult to ignore since the European Commission's 2023 adequacy decision cites the FTC's independence more than 250 times in its proof that US oversight meets EU standards.

There is no immediate need for businesses to seek alternative authority for their transfers of data: the EU policy 'stays in force until it is repealed or annulled,' as Schrems acknowledges: however noyb expresses a preference for the Commission acting of its own accord, without the need for another trial, avoiding a 'compliance cliff'. The latter is a reference to the scramble caused by the two previous Schrems rulings, when the Court of Justice struck down Safe Harbor in 2015 and Privacy Shield in 2020.

noyb will file a lawsuit 'in the coming weeks' if the EC declines to act - this may lead to a decision sometime around 2028-29. The EC has not yet made a formal response, but given the first two outcomes it can't imagine noyb will either drop its demands or lose the case should it come to that.

The organisation, whose campaigning has also tackled privacy issues with Ryanair and Clearview AI, is online at www.noyb.eu .

More detail on this specific case at https://noyb.eu/en/us-supreme-court-just-blew-eu-us-data-transfers .