Sunday

5th Jul 2020

EU court invalidates EU-US data transfer pact

  • The ECJ ruled itself as final arbiter on whether or not a commission decision on Safe Harbour is valid (Photo: katarina_dzurekova)

Judges in Luxembourg on Tuesday (6 October) delivered a blow against a 15-year old EU-US data transfer pact.

The European Court of Justice (ECJ) rejected the so-called Safe Harbour agreement and declared it invalid.

Read and decide

Join EUobserver today

Support quality EU news

Get instant access to all articles — and 20 years of archives. 14-day free trial.

... or subscribe as a group

Privacy campaigner Max Schrems, whose complaint against Facebook Ireland initiated the case, said the judgment “clarifies that mass surveillance violates our fundamental rights".

He said the judgement makes it "clear that US businesses cannot simply aid US espionage efforts in violation of European fundamental rights".

The EU judges said Ireland’s court must now decide whether to suspend the transfer of data from Facebook to the United States.

The verdict also affects some 4,400 US firms that have signed up to the self-certification agreement.

Safe Harbour is supposed to provide an “adequate” level of protection whenever data from EU citizens is transferred to the US.

EU data protection authorities had no power to investigate compliance.

But the Luxembourg judges said national supervisors authorities “must be able to examine, with complete independence” the transfer of data to US.

The pact has come under intense scrutiny following 2013 media revelations of mass and indiscriminate spying by the US intelligence services on EU citizens.

The scandal revealed the Maryland-based National Security Agency (NSA) obtained access to data of EU citizens held by big US firms like Apple, Facebook, Google and others.

Known as Prism, the top-secret programme allowed NSA officials to collect search history, live chat, file transfers, and the content of emails.

The case stems from a complaint filed by Schrems to Ireland’s data protection authority against Facebook Ireland in June 2013.

Schrems argued Facebook does not protect his data given the secret Prism programme. Facebook’s Irish subsidiary servers are located in the US, where his data is stored.

Ireland’s data chief dismissed the case a month later because Facebook had signed up to Safe Harbour. Schrems appealed and the Irish High Court then asked the Luxembourg-based court to intervene.

Companies in the scheme declare they respect the data protection guidelines.

But their claims are not subject to any compulsory independent verification. Instead, the companies police themselves.

One study showed hundreds of the US companies lied about belonging to the programme.

So far, the US Federal Trade Commission (FTC) brought 37 cases for making false claims.

The US government enforcement body also has no oversight powers in sectors like financial services, transport, and telecommunications.

The European Parliament wants the agreement scrapped.

"Today's ECJ ruling is the nail in the coffin of Safe Harbour”, said Dutch liberal MEP Sophie In' t Veld.

German Green MEP Jan Phillip Albrecht, who steered the parliament's data protection reforms, said the [European] Commission and the Irish data protection commissioner must "immediately move to prevent any further data transfers to the US in the framework of Safe Harbour".

The Commission in 2014 threatened to suspend it, but then issued 13 recommendations to the US on how to improve it.

Almost two years later and talks are still ongoing, in part, because the US does not want to tinker with national security exemptions.

EU-US data sharing at risk

Future EU-US data sharing risks complications if the EU Court follows the opinion of Yves Bot, its attorney general, issued on Wednesday.

EU defends US data pact, as Facebook court case opens

An Austrian privacy campaigner vs Facebook over the future of data transfers to the US case opened at the European Court of Justice in Luxembourg on Tuesday. The European Commission, meanwhile, says the Privacy Shield pact is working fine.

EU imposes deadline for new US data pact

The European Commission is using the European Court of Justice ruling on Safe Harbour as a leverage to get a new deal with American authorities.

News in Brief

  1. EU grants Remdesivir conditional authorisation
  2. French prime minister and government resign
  3. France lied on Nato naval clash, Turkey claims
  4. EU highlights abuses in recent Russia vote
  5. Belgium bids to host EU mask stockpile
  6. France shamed on refugees by European court
  7. French and Dutch police take down criminal phone network
  8. EU launches infringement case on Covid-19 cancelled trips

Opinion

On toppling statues

The internationally-acclaimed author of King Leopold's Ghost, Adam Hochschild, writes on Belgium's problems with statues, in the wake of the Black Lives Matter movement.

Feature

The 150 random French citizens advising Macron

Some 150 randomly-picked men and women make up Emmanuel Macron's Citizens' Climate Convention. This week Macron invited them to the Élysée Palace and promised - nearly - all of their wishes would come true .

Stakeholders' Highlights

  1. Nordic Council of MinistersNEW REPORT: Eight in ten people are concerned about climate change
  2. UNESDAHow reducing sugar and calories in soft drinks makes the healthier choice the easy choice
  3. Nordic Council of MinistersGreen energy to power Nordic start after Covid-19
  4. European Sustainable Energy WeekThis year’s EU Sustainable Energy Week (EUSEW) will be held digitally!
  5. Nordic Council of MinistersNordic states are fighting to protect gender equality during corona crisis
  6. UNESDACircularity works, let’s all give it a chance

Join EUobserver

Support quality EU news

Join us