EU court backs latest data transfer deal agreed by US and EU

By Foo Yun Chee and Sudip Kar-Gupta

BRUSSELS (Reuters) -A data transfer deal agreed by the European Union and the United States two years ago to replace two previous pacts rejected by a higher tribunal was given the green light by Europe's second-highest court on Wednesday.

The ruling will provide legal certainty to thousands of companies, ranging from banks to tech companies to drugmakers and car manufacturers, that transfer personal data across the Atlantic for commercial use such as payroll purposes and cloud infrastructure.

The case comes at a time of tension in EU-U.S. relations following an EU crackdown on Big Tech and threats of retaliation by U.S. President Donald Trump.

The European Commission, which negotiated the accord on behalf of the 27 EU member states in 2023, had said it offered an adequate level of protection for Europeans' personal data transferred to the U.S.

French lawmaker Philippe Latombe subsequently sued the EU executive, saying there were inadequate guarantees of respect for private and family life in the agreement because of the widespread and bulk collection of personal data.

He criticised the new U.S. appeal body to which Europeans could resort, saying it was not an independent tribunal and did not offer guarantees similar to those required by EU law.

The Luxembourg-based General Court sided with the Commission.

"The General Court dismisses an action for annulment of the new framework for the transfer of personal data between the European Union and the United States," it said in a ruling.

"On the date of adoption of the contested decision, the United States of America ensured an adequate level of protection for personal data transferred from the European Union to organisations in that country."

Judges dismissed privacy concerns about U.S. surveillance.

"In the present case, it is apparent from the file that, under U.S. law, signals intelligence activities carried out by US intelligence agencies are subject to ex post judicial oversight by the DPRC," they said, referring to the U.S. Data Protection Review Court.

Latombe can appeal to the Court of Justice of the European Union (CJEU) - Europe's highest - on matters of law.

The CJEU scuppered the previous two deals after challenges by Austrian privacy activist Max Schrems because of concerns about U.S. intelligence agencies' accessing European citizens' private data.

Schrems said he still had concerns about the pact despite the ruling, suggesting a broader review of U.S. law would yield "a different result".

The case is T-553/23 - Latombe v Commission.

(Reporting by Foo Yun Chee and Sudip Kar-Gupta, Editing by Timothy Heritage)