Irish civil-rights lawsuit against Privacy Shield dismissed by EU court

Lock on keyboard

27 November 2017. By Vesela Gladicheva.

Supporters of Europe's Privacy Shield data-transfer accord with the US scored a victory after EU judges dismissed a court challenge to its validity.

Civil-rights group Digital Rights Ireland, which filed the suit in autumn 2016, didn't have the right to bring the action, the EU's lower-tier General Court said.

"The applicant does not have standing to act in the name of its members and supporters or on behalf of the general public," the Luxembourg court said in an order published today.

The Privacy Shield arrangement, which allows more than 2,500 companies to transfer personal information across the Atlantic between the US and EU states, entered into force in August 2016 and aims to improve the flow of personal data for commercial purposes.

The accord was drawn up to replace a predecessor agreement, Safe Harbor, which was struck down in 2015 by Europe's highest court for failing to safeguard EU citizens' personal data robustly enough.

In September 2016, Digital Rights Ireland asked the General Court to strike down Privacy Shield, arguing that it failed to protect EU citizens from mass surveillance by US intelligence services.

La Quadrature du Net, a collection of French civil-society groups, brought a separate action against Privacy Shield the following month, based on similar arguments to the Irish suit. The General Court has yet to rule on the admissibility of that case.

Digital Rights Ireland can appeal the court's order. A spokesman for the group told MLex that it would not comment on the order.

The case reference is T-670/16 Digital Rights Ireland.

Countdown to the GDPR