Schrems demands suspension of EU-US data transfer agreement following US court ruling

Schrems justified his demand with the words: "Da sich die EU auf die 'Unabhängigkeit' der FTC als Datenschutzbehörde stützte, ist die gesamte Struktur des EU-US Data Privacy Framework gerade zusammengebrochen." The agreement enables the exchange of personal data between the EU and the United States and has been a central component of transatlantic data flows for years.

Background: The Data Privacy Framework

Specifically, Schrems demands that the Commission put the agreement out of force "in an orderly process." He said: "Da es in den USA keine unabhängigen Behörden mehr gibt, fordern wir die Kommission auf, die Angemessenheitsentscheidung für die USA in einem geordneten Prozess aufzuheben." With this, the activist, who has already successfully sued major tech corporations before the European Court of Justice several times, is once again attacking the system of data transfers to the United States.

The trigger is a proceeding before the Supreme Court concerning the dismissal of a senior FTC official. The court sided with Donald Trump in this case. Schrems interprets this decision as a signal that the independence of the authority can no longer be guaranteed. The ruling comes at a time when the Trump administration is already reorganizing the personnel of several independent supervisory agencies.

The Data Privacy Framework entered into force in 2023, after the EU Court of Justice had previously struck down two predecessor agreements, most recently the so-called Privacy Shield. The European Commission had justified the new agreement, among other things, by arguing that through a reform of its supervisory structures, the United States could ensure an adequate level of protection for European data. Schrems had already announced at the time that he would also have this agreement reviewed in court.

Potential consequences for companies

With the current demand, noyb is increasing the pressure on the Commission even before formal proceedings have been initiated. Should the Commission fail to act, noyb could, according to observers, once again turn to the European Court of Justice. In the "Schrems I" and "Schrems II" proceedings, the ECJ had already declared central foundations of transatlantic data transfers to be invalid.

Business associations in Europe and the United States are watching the development with concern. The Data Privacy Framework is the basis for numerous data flows between European and US companies, such as in cloud usage, customer support, or human resources. A suspension could trigger legal uncertainty in the short term and force companies to reorganize their data flows.

Reaction of the European Commission

The European Commission has so far not publicly commented on Schrems's demand. According to its own statements, it regularly reviews the functionality of adequacy decisions. Observers expect that the authority will first wait for a legal analysis of the Supreme Court ruling before deciding on how to proceed.

Schrems himself sees his initiative as a consequence of a long-standing dispute. With his organization noyb, he had already repeatedly pointed out weaknesses in the data transfer agreements in recent years and taken legal action against them. The current demand ties directly into the argumentation of the earlier proceedings, which dealt with the question of whether US authorities adequately protect European data.