The Court of Justice of the European Union has dismissed a legal challenge brought by a French citizen seeking the annulment of the new framework governing the transfer of personal data between the EU and the United States In a ruling delivered Wednesday, the court determined that the United States provides an “adequate level of protection” for personal data transferred from the EU to organizations within the US
The plaintiff had argued that the US Data Protection Review Court (DPRC) lacked independence and that the data collection practices of US intelligence services were unlawful However, the court found that the appointment of DPRC judges and its operational procedures are subject to several safeguards and conditions designed to guarantee the independence of its members Furthermore, the court noted the European Commission retains the power to monitor the decision and to react appropriately should changes occur in US legal frameworks
Regarding the broad collection of personal data, the court highlighted the availability of subsequent judicial review through the DPRC It found no violation of requirements set out in previous rulings and affirmed that the level of legal protection in the United States is equivalent to that guaranteed by Union law (Case T-553/23)