Microsoft says it is trying to help the European Commission see off a legal threat to the EU-US Data Privacy Framework agreement – relied on by organizations to legally move data between the bloc and the US
In a weekend blog post, the software biz confirmed the Court of Justice of the European Union had granted its application to formally intervene in a case challenging the framework, which has supported data between the two economic super-powers since 2023
Microsoft thinks the case before the court will determine whether its enterprise customers — of which there are many — can continue under the existing pact
“Companies across the globe rely on data flows to manage their people, produce their goods and services, and distribute products to their customers. We understand that data flows trigger questions about differences in legal traditions.”
In Redmond’s blog post, Jon Palmer, Microsoft corporate veep and chief legal officer, and Cari Benn, chief privacy officer, say the Court found Microsoft has a direct and existing interest in the result, allowing it to intervene in the case
“As an intervener, we can now file legal briefs in support of the European Commission, participate in oral hearings, and share our perspective on the importance of upholding a framework that directly benefits the European economy,” the pair write
The case before the court is an appeal against an earlier ruling which struck down a challenge to the EU-US Data Privacy Framework
In September last year, the EU General Court’s judgment confirmed the data sharing agreements’ validity, ruling against the challenge from French parliamentarian Philippe Latombe. He brought the case by arguing the Data Protection Review Court (DPRC) — the US body set up to hear issues related to the Framework — lacked independence. A presidential executive order could disregard the DPRC, he argued. But the General Court disagreed
“It is apparent from the file that the appointment of judges to the DPRC and the DPRC’s functioning are accompanied by several safeguards and conditions to ensure the independence of its members,” the Court said at the time
Max Schrems, the lawyer and campaigner behind two successful challenges to EU data sharing rules, Safe Harbor (2015) and Privacy Shield (2020), pointed out that Latombe had chosen a targeted and narrow challenge to the current deal. Another challenge based on a broader set of arguments might prove successful, he said
“This was a rather narrow challenge. We are convinced that a broader review of US law – especially the use of Executive Orders by the Trump administration – should yield a different result. We are reviewing our options to bring such a challenge. While the Commission may have gained another year, we still lack any legal certainty for users and businesses,” Schrems said in a blog post
Latombe announced plans to appeal in October last year, although the basis for the appeal is still to be made public
According to law firm WilmerHale, the ECJ has historically been more skeptical than the General Court in assessing US surveillance practices and the adequacy of redress mechanisms. Its prior decisions in the so-called Schrems I and II rulings invalidated frameworks that had also been endorsed by the European Commission, and Latombe’s appeal puts another framework before the European Court of Justice for consideration
Clearly, Microsoft feels the appeal’s chances of success are sufficient for it to step in. ®
