Tech companies like Facebook could be prevented from sending data back to the US, after the latest ruling in a long-running European legal saga found that there are not enough protections against snooping by US intelligence agencies.
The ruling of the court of justice of the European Union (CJEU) does not immediately end such transfers, but requires data protection authorities (DPAs) in individual member states to vet the sending of any new data to make sure people’s personal information remains protected according to the EU’s data protection laws (GDPR).
The complaint, which goes back to October 2014, was lodged by Austrian privacy activist Max Schrems. He argued, following the Snowden revelations, that the privacy of European citizens could not be guaranteed if their data was sent to the US, given the evidence of widespread eavesdropping by the country’s National Security Agency (NSA), and the fact that the US legal system only protected the rights of US citizens.
Schrems’ initial complaint led to the overturning of the EU/US “safe harbour”, which had governed data transfer between the two regions, and the creation of a new treaty, the EU/US “privacy shield”. This latest ruling has overturned that policy too.
“At first sight it seems the court has followed us in all aspects,” Schrems said in a statement. “This is a total blow to the Irish DPC [data protection commission] and Facebook. It is clear that the US will have to seriously change their surveillance laws if US companies want to continue to play a role on the EU market.”
“The court is not only telling the Irish DPC to do its job after seven years of inaction, but also that DPAs have a duty to take action and cannot just look the other way,” he added. “This is a fundamental shift going far beyond EU-US data transfers. Authorities like the Irish DPC have so far undermined the success of the GDPR. The court has clearly told the DPAs to get going and enforce the law.”
The ruling is not a total halt on data transfers between the EU and US, said Lisa Peets, a partner at Covington, which represented the UK’s software industry in the case. The court upheld the use of “standard contractual clauses” (SCCs) to transfer personal data between Europe and US, allowing companies to seek specific consent from users for data to be exported.
“Data flows between Europe and the United States are an integral part of the European economy and of the day-to-day lives of millions of European consumers, and the SCCs are the backbone for many of those data transfers,” Peets said. “As for the privacy shield, the European commission will be highly focused on finding a resolution and will be actively working work with the US government to identify a path forward.”
With the end of the Brexit withdrawal agreement on the horizon, the ruling also poses new problems for the UK in defining its future relationship with the EU. Without a new replacement for the privacy shield, the UK could be forced to pick between frictionless data transfers with the US or EU on 31 December, warned Toni Vitale, partner and head of data protection at JMW Solicitors.
“Post Brexit, the UK could be deemed to have inadequate protection given the lack of judicial oversight over the security forces,” Vitale added, “and this could this lead to a ban on exports of data from the EU to the UK in the future.”
