Europe’s top court declares EU-US data deal invalid

In a far-reaching verdict that could affect thousands of companies such as Facebook and Google, Europe’s highest court has ruled that a 15-year-old pact that allows data transfers between the US and EU is invalid.
Symbolbild Facebbok Datenschutz

In a landmark ruling, the European Court of Justice (ECJ) in Luxembourg on Tuesday declared the Safe Harbor data-sharing deal as invalid.

The agreement, signed in 2000 between Brussels and Washington, enables companies and international networks to easily transfer personal data to the United States without having to seek prior approval, a potentially lengthy and costly process.

Watch video
DW TV interviews plaintiff Max Schrems

“The Court of Justice declares that the (European) Commission’s US Safe Harbour Decision is invalid,” it said in a decision on a case brought against Facebook by Austrian law student Max Schrems.

Schrems launched the case following revelations two years ago by former US National Security Agency contractor Edward Snowden about the spy agency’s surveillance programs.

Data privacy concerns

Schrems complained to the data protection commissioner in Ireland, where Facebook has its European headquarters, that US law doesn’t offer sufficient protection against surveillance of data transferred by the social media company to servers in the United States.
Google Daten Zentrum Data Center Oregon USA Safe Harbor allows US tech firms to store data of EU citizens on servers in the US Irish authorities initially rejected the complaint, pointing out that under the Safe Harbor deal, the US ensures data protection. But the Irish data commissioner will now be required to examine Schrems’ complaint “with all due diligence,” the ECJ said in a summary of its ruling.

In a far-reaching verdict that could affect thousands of companies such as Facebook and Google, Europe’s highest court has ruled that a 15-year-old pact that allows data transfers between the US and EU is invalid.

In a landmark ruling, the European Court of Justice (ECJ) in Luxembourg on Tuesday declared the Safe Harbor data-sharing deal as invalid.

The agreement, signed in 2000 between Brussels and Washington, enables companies and international networks to easily transfer personal data to the United States without having to seek prior approval, a potentially lengthy and costly process.

Watch video

DW TV interviews plaintiff Max Schrems

“The Court of Justice declares that the (European) Commission’s US Safe Harbour Decision is invalid,” it said in a decision on a case brought against Facebook by Austrian law student Max Schrems.

Schrems launched the case following revelations two years ago by former US National Security Agency contractor Edward Snowden about the spy agency’s surveillance programs.

Data privacy concerns

Schrems complained to the data protection commissioner in Ireland, where Facebook has its European headquarters, that US law doesn’t offer sufficient protection against surveillance of data transferred by the social media company to servers in the United States.

Google Daten Zentrum Data Center Oregon USA Safe Harbor allows US tech firms to store data of EU citizens on servers in the US

Irish authorities initially rejected the complaint, pointing out that under the Safe Harbor deal, the US ensures data protection.

But the Irish data commissioner will now be required to examine Schrems’ complaint “with all due diligence,” the ECJ said in a summary of its ruling.

Once it has concluded its investigation, the authority must “decide whether … transfer of the data of Facebook’s European subscribers to the United States should be suspended on the ground that that country does not afford an adequate level of protection of personal data,” the court said.

“YAY,” Schrems tweeted after the judgment. He later said in a statement that the decision was a “milestone when it comes to online privacy.”

“It clarifies that mass surveillance violates our fundamental rights. This decision is a major blow for US global surveillance that heavily relies on private partners,” he added.

DW recommends

EU court likely to slam Facebook on data privacy

This Tuesday, the European Court of Justice will release a much-anticipated judgment on whether private European data stored on servers in the US are secure. Difficult times could await Facebook and other companies. (05.10.2015)

Europeans allowed to sue over privacy breaches in new EU-US data agreement

Data sharing deal between EU and US ‘invalid,’ ECJ advisor says

Internet.org – Free access or digital prison?

However, Schrems noted that the ruling doesn’t bar data transfers from the EU to the US, but rather allows national data protection authorities to review individual transfers.

Repercussions

Nevertheless, the verdict has far-reaching implications for US tech giants such as Facebook and Google doing business in Europe, by making it harder for them to store the private data of EU citizens.

The case comes amid widespread tensions between Brussels and Washington on issues of regulation, with several EU anti-trust probes currently underway into US tech firms.

“This is extremely bad news for EU-US trade,” said Richard Cumbley, Global Head of technology, media and telecommunications at law firm Linklaters. “Without Safe Harbor, (businesses) will be scrambling to put replacement measures in place.”

But Sophie in ‘t Veld, a leading Liberal lawmaker in the European Parliament, welcomed the ruling and called the “safe harbor” decision “a travesty of legality.”

“We need clear rules to govern the transfer of personal data to the US and other non-EU countries,” she said. “But they must be legally watertight, provide real and meaningful protection, and there must be proper enforcement.”

While there was no immediate reaction to the ruling from Washington, the US last month said an opinion by the EU court’s top legal counsel which reached similar conclusions was based on “inaccurate assertions.”

Facebook said it couldn’t immediately comment on the court ruling.

Once it has concluded its investigation, the authority must “decide whether … transfer of the data of Facebook’s European subscribers to the United States should be suspended on the ground that that country does not afford an adequate level of protection of personal data,” the court said.

“YAY,” Schrems tweeted after the judgment. He later said in a statement that the decision was a “milestone when it comes to online privacy.”

“It clarifies that mass surveillance violates our fundamental rights. This decision is a major blow for US global surveillance that heavily relies on private partners,” he added.
DW recommends
EU court likely to slam Facebook on data privacy

This Tuesday, the European Court of Justice will release a much-anticipated judgment on whether private European data stored on servers in the US are secure. Difficult times could await Facebook and other companies. (05.10.2015)
Europeans allowed to sue over privacy breaches in new EU-US data agreement
Data sharing deal between EU and US ‘invalid,’ ECJ advisor says
Internet.org – Free access or digital prison?

However, Schrems noted that the ruling doesn’t bar data transfers from the EU to the US, but rather allows national data protection authorities to review individual transfers.

Repercussions

Nevertheless, the verdict has far-reaching implications for US tech giants such as Facebook and Google doing business in Europe, by making it harder for them to store the private data of EU citizens.

The case comes amid widespread tensions between Brussels and Washington on issues of regulation, with several EU anti-trust probes currently underway into US tech firms.

“This is extremely bad news for EU-US trade,” said Richard Cumbley, Global Head of technology, media and telecommunications at law firm Linklaters. “Without Safe Harbor, (businesses) will be scrambling to put replacement measures in place.”

But Sophie in ‘t Veld, a leading Liberal lawmaker in the European Parliament, welcomed the ruling and called the “safe harbor” decision “a travesty of legality.”

“We need clear rules to govern the transfer of personal data to the US and other non-EU countries,” she said. “But they must be legally watertight, provide real and meaningful protection, and there must be proper enforcement.”

While there was no immediate reaction to the ruling from Washington, the US last month said an opinion by the EU court’s top legal counsel which reached similar conclusions was based on “inaccurate assertions.”

Facebook said it couldn’t immediately comment on the court ruling.