—

The defendant transferred the applicant’s personal data to recipients established in the United States of America when the applicant visited the website ‘https://futureu.europa.eu’. The United States is a third country in respect of which the Commission has not adopted any adequacy decision.

—

A transfer of the applicant’s personal data to recipients established in the United States carried out on the basis of standard contractual clauses in accordance with Article 48(2)(b) of Regulation (EU) 2018/1725, in the absence of additional technical and organisational safeguards, does not constitute an appropriate safeguard ensuring an adequate level of protection in the United States.

—

The limitations on the applicant’s fundamental rights under Articles 7 and 8 of the Charter, resulting from the fact that US authorities are permitted under US law to access and use data transferred from the European Union to the United States, are not regulated in such a way as to fulfil requirements that would be essentially equivalent to those existing in EU law under the second sentence of Article 52(1) of the Charter.

—

Neither 50 US Code § 1881a (Section 702 FISA) nor Executive Order 12333 ensures that Union citizens have the opportunity or right to oppose access to their personal data or to enforce effectively their rights under Regulation (EU) 2018/1725.

—

The applicant’s right of access under Article 17(1) and (2) of Regulation (EU) 2018/1725 is an essential condition for the enjoyment of his fundamental rights under Article 7 and Article 8(1) of the Charter. The defendant is depriving the applicant of the possibility of enforcing his fundamental rights due to its failure to act on his request for information. The encroachment on the fundamental rights under Article 7 and Article 8(1) of the Charter which accompanied the defendant’s failure to act is therefore not justified.

—

US law does not provide for any possibility of judicial protection against access to Union citizens’ personal data by US security agencies and intelligence services.

—

In view of the surveillance programmes of the US security agencies and intelligence services — for example, PRISM and UPSTREAM — which are based on 50 US Code § 1881a (Section 702 FISA) and Executive Order 12333, neither Presidential Policy Directive 28 nor Executive Order 12333 grants data subjects actionable rights before the courts against the US authorities.

—

The defendant unlawfully failed to provide the applicant, following his request for information of 1 April 2022, with the information referred to in Article 17(1) and (2) of Regulation (EU) 2018/1725, in particular regarding the safeguards under Article 48 of Regulation (EU) 2018/1725, within the one-month period in accordance with the first sentence of Article 14(3) of Regulation (EU) 2018/1725.

—

The defendant unlawfully failed either to communicate to the applicant under the second sentence of Article 14(3) of Regulation (EU) 2018/1725 the reasons for a possible extension of the period for providing the information, or to inform the applicant under Article 14(3) and (4) of Regulation (EU) 2018/1725, within one month of receipt of the request, of the grounds for refusing to provide the information and of judicial and non-judicial remedies.