A data transfer deal agreed by the European Union and the US two years ago to replace two previous pacts rejected by a higher tribunal was given the green light by Europe's second-highest court today.
The ruling will provide legal certainty to thousands of companies, ranging from banks to tech companies to drugmakers and car manufacturers, that transfer personal data across the Atlantic for commercial use such as payroll purposes and cloud infrastructure.
The case comes at a time of tension in EU-US relations following an EU crackdown on Big Tech and threats of retaliation by US President Donald Trump.
The European Commission, which negotiated the accord on behalf of the 27 EU member states in 2023, had said it offered an adequate level of protection for Europeans' personal data transferred to the US.
French lawmaker Philippe Latombe subsequently sued the EU executive, saying there were inadequate guarantees of respect for private and family life in the agreement because of the widespread and bulk collection of personal data.
He criticised the new US appeal body to which Europeans could resort, saying it was not an independent tribunal and did not offer guarantees similar to those required by EU law.
The Luxembourg-based General Court sided with the Commission.
"The General Court dismisses an action for annulment of the new framework for the transfer of personal data between the European Union and the United States," it said in a ruling.
"On the date of adoption of the contested decision, the United States of America ensured an adequate level of protection for personal data transferred from the European Union to organisations in that country," it said.
Judges dismissed privacy concerns about US surveillance.
"In the present case, it is apparent from the file that, under US law, signals intelligence activities carried out by US intelligence agencies are subject to ex post judicial oversight by the DPRC," they said, referring to the US Data Protection Review Court.
Latombe can appeal to the Court of Justice of the European Union (CJEU) - Europe's highest - on matters of law.
The CJEU scuppered the previous two deals after challenges by Austrian privacy activist Max Schrems because of concerns about US intelligence agencies' accessing European citizens' private data.
Schrems said he still had concerns about the pact despite the ruling, suggesting a broader review of US law would yield "a different result".
