Shifting sands: the US–EU data privacy framework in a changing political landscape

• Pages: 731-758
• Author: Xabier Orbegozo Miguel

— 731 —

SHIFTING SANDS: THE US–EU DATA PRIVACY FRAMEWORK

IN A CHANGING POLITICAL LANDSCAPE

XABIER ORBEGOZO MIGUEL.



Public University of Navarre (UPNA). Spain.

SUMMARY: 1. CONTEXT. 2. PERSONAL DATA AS AN ASSET. 3. THE

JUDGEMENT OF THE ECJ OF 16 JULY 2020 – “SCHREMS II”. 3.1. Prece-

dents and factual framework. 3.2. Arguments of the European Court in

Schrems II and legal framework applicable to the case.  Applicabi-

      

 -

   Validity of the

 3.3. Did US domestic law provide an equivalent

level of protection? 3.4. Schrems II judgement – conclusions of the Euro-

pean Court of Justice. 4. NEXT STEPS IN THE CASE. 5. THE DATA PRIVA-

CY FRAMEWORK. 5.1. Principles for US companies and self-certification.

5.2. Redress mechanisms – The  6. STATU

QUO OF THE DPF – THE EUROPEAN COMMISSION AND EDPB REPORTS.

7. THE  CASE AND “TRUMP EFFECT” – LEGAL UNCERTAIN-

TY RETURNS. 7.1.  case and the prospects of a “Schrems III” or

“” case. 7.2. Political instability with Trump Administration. 8.

CONCLUSIONS.

1. CONTEXT.

Back in the summer of 2022terrifying (for many) news hit the headlines

across Europe. “Europe faces Facebook blackout.1 That was the last chapter

1 https://www.politico.eu/article/europe-faces-facebook-blackout-instagram-meta-

data-protection/

XABIER ORBEGOZO MIGUEL

— 732 —

in a series of legal and political battles between the American multinational

Meta (Facebook and Instagram’s parent company) and the Irish data protection

authorities about the possibility of transferring personal data of EU Meta users

to the United States, following a complaint by Max Schrems, an Austrian lawyer

and activist for the protection of personal data.

This dispute arose in connection with the case 

       (Schrems II), decided on

16 July 2020. It stemmed from a request for a preliminary ruling by the High

Court of Ireland, which sought clarification on how the General Data Protection

Regulation (GDPR) and the Charter of Fundamental Rights of the European

Union applied to the matter. The controversy focused on certain US surveillance

programs that, under American law, permitted authorities to access the personal

data of individuals outside the EU. These practices were found to conflict with

the fundamental privacy rights and legal safeguards guaranteed to EU citizens, as

will be analysed in the following pages.

With this most expected3 judgement, the ECJ declared the so-called

“Privacy Shield Program” invalid.4 This instrument, administered by the US

Department of Commerce’s International Trade Administration (designed in

cooperation with the European Commission and the Swiss Administration),5

was supposed to create a common framework for the US, EU and Switzerland

regarding personal data protection standards, with the aim of enhancing

commerce between these territories and providing certainty to the users

or customers of the companies affected by the programme and registered

to participate in it.6 Indeed, the programme is based on the willingness of

companies to self-certify according to its principles.

From the European consumer protection perspective, the creation of the

“Privacy Shield” was supposed to guarantee compliance with EU standards on

both sides of the Atlantic. Its adequacy with EU law requirements was confirmed

by the European Commission with an Adequacy decision7 (“Privacy Shield

2 Judgment of the Court (Grand Chamber) of 16 July 2020. Data Protection Commissioner

v Facebook Ireland Limited and Maximillian Schrems. Case C-311/18. ECLI:EU:C:2020:559

3 COSTELLO, Róisin Á, “Schrems II: Everything Is Illuminated?”, European Papers, vol. 5,

2020, no. 2, pp. 1045-1059, p. 1046.

4 https://www.privacyshield.gov/welcome

5 On 8 September 2020 the Swiss Federal Data Protection and Information Commissioner

(FDPIC) of Switzerland issued an opinion that replicated the Irish Commissioners´ criteria,

considering CH-US Privacy Shield does not provide adequate level of data protection. https://www.

news.admin.ch/en/nsb?id=80318

6 The official website of the program publishes the list of companies, see: https://www.

privacyshield.gov/list

7 Commission Implementing Decision (EU) 2016/1250 of 12 July 2016 pursuant to

Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection