Landmark EU court ruling strikes down US data-sharing deal

Landmark EU court ruling strikes down US data-sharing deal
By Helen Maguire
6 October 2015

Luxembourg (dpa) - The European Union's top court on Tuesday struck down a data-sharing scheme with the United States, arguing that it does not fully protect the rights of EU citizens, a landmark ruling carrying consequences for companies on both sides of the Atlantic.

The Safe Harbor system regulates how businesses in the EU and the US share data. More than 4,000 firms operate under the scheme, which has been in place for 15 years. The case was brought by Austrian activist Max Schrems against the Irish data protection authority after it rejected his complaint regarding Facebook's practice of storing user data in the US. The European Court of Justice was asked to weigh in on the matter.

Schrems' complaint came in the wake of revelations in 2013 by US whistleblower Edward Snowden that Washington had carried out mass spying on EU citizens. "This decision is a major blow for US global surveillance that heavily relies on private partners," Schrems said Tuesday, adding that it would pave the way for other legal challenges. "Thank you Europe," Snowden wrote on Twitter. "We are all safer as a result." He congratulated Schrems, telling him: "You've changed the world for the better."

The Luxembourg-based judges found that Safe Harbor does not adequately protect EU citizens' data, as US authorities could access it under given circumstances without granting Europeans any legal redress. "National security, public interest and law enforcement requirements of the US prevail over the Safe Harbor scheme," the court said in a statement. "US undertakings are bound to disregard, without limitation, the protective rules laid down by that scheme where they conflict with such requirements," it added.

Both the US Commerce Department and the White House said they were "disappointed" with court decision. Commerce Secretary Penny Pritzker said it would create "significant uncertainty" for US and European companies and consumers and "puts at risk the thriving trans-Atlantic digital economy."

The Commerce Department and White House defended the Safe Harbor framework, which the US says has helped foster economic growth and protect privacy. They called for it to be updated as soon as possible. The Irish supervisors must now assess whether or not to suspend the transfer of European Facebook users' data to the US, the court ruled. Facebook's European operations are based in Ireland, but the company said it had nothing to fear from the ruling. "This case is not about Facebook," a spokesperson said in a statement, noting that the social media giant "relies on a number of the methods prescribed by EU law to legally transfer data to the US from Europe, aside from Safe Harbor." Irish data protection officer Helen Dixon told the RTE public broadcaster that she had instructed legal officials "to take whatever actions are necessary to bring the case back as soon as practicable before the Irish high court."

Safe Harbor was established in 2000, after the European Commission prohibited the transfer of data to non-European countries that did not adhere to stringent criteria. Following Snowden's revelations, EU and US authorities began overhauling the system to make it more robust.

European Commission Vice President Frans Timmermans said the court ruling confirmed the efforts being undertaken with Washington "to make data transfers safer for European citizens." "In the meantime, trans-Atlantic data flows between companies can continue, using other mechanisms for international transfers of personal data available under EU data protection law," he added.

Nevertheless, European industry groups sounded the alarm, warning that a suspension of Safe Harbor would hurt the bloc's economy. "Today's court judgment gives rise to great legal uncertainty that must be remedied urgently," warned Markus Beyrer of the BusinessEurope employers' organization. "It is imperative that the EU does not become a disconnected island in a global digital economy," added Christian Borggreen of the Computer & Communications Industry Association.

But others welcomed the ruling. Monique Boyens of the European Consumer Organisation BEUC called it a "victory for the protection of European data privacy rights." Firms such as Google "will just have to guarantee an adequate level of protection," she said. EU lawmaker Helmut Scholz of the far-left GUE/NGL group said the verdict carries consequences for the mammoth free trade deal being negotiated by the EU and the US, describing data trade as "one of the centrepieces" of the Transatlantic Trade and Investment Partnership.

Source: dpa