Sunday

3rd Jul 2022

EU court invalidates EU-US data transfer pact

  • The ECJ ruled itself as final arbiter on whether or not a commission decision on Safe Harbour is valid (Photo: katarina_dzurekova)

Judges in Luxembourg on Tuesday (6 October) delivered a blow against a 15-year old EU-US data transfer pact.

The European Court of Justice (ECJ) rejected the so-called Safe Harbour agreement and declared it invalid.

Read and decide

Join EUobserver today

Become an expert on Europe

Get instant access to all articles — and 20 years of archives. 14-day free trial.

... or subscribe as a group

Privacy campaigner Max Schrems, whose complaint against Facebook Ireland initiated the case, said the judgment “clarifies that mass surveillance violates our fundamental rights".

He said the judgement makes it "clear that US businesses cannot simply aid US espionage efforts in violation of European fundamental rights".

The EU judges said Ireland’s court must now decide whether to suspend the transfer of data from Facebook to the United States.

The verdict also affects some 4,400 US firms that have signed up to the self-certification agreement.

Safe Harbour is supposed to provide an “adequate” level of protection whenever data from EU citizens is transferred to the US.

EU data protection authorities had no power to investigate compliance.

But the Luxembourg judges said national supervisors authorities “must be able to examine, with complete independence” the transfer of data to US.

The pact has come under intense scrutiny following 2013 media revelations of mass and indiscriminate spying by the US intelligence services on EU citizens.

The scandal revealed the Maryland-based National Security Agency (NSA) obtained access to data of EU citizens held by big US firms like Apple, Facebook, Google and others.

Known as Prism, the top-secret programme allowed NSA officials to collect search history, live chat, file transfers, and the content of emails.

The case stems from a complaint filed by Schrems to Ireland’s data protection authority against Facebook Ireland in June 2013.

Schrems argued Facebook does not protect his data given the secret Prism programme. Facebook’s Irish subsidiary servers are located in the US, where his data is stored.

Ireland’s data chief dismissed the case a month later because Facebook had signed up to Safe Harbour. Schrems appealed and the Irish High Court then asked the Luxembourg-based court to intervene.

Companies in the scheme declare they respect the data protection guidelines.

But their claims are not subject to any compulsory independent verification. Instead, the companies police themselves.

One study showed hundreds of the US companies lied about belonging to the programme.

So far, the US Federal Trade Commission (FTC) brought 37 cases for making false claims.

The US government enforcement body also has no oversight powers in sectors like financial services, transport, and telecommunications.

The European Parliament wants the agreement scrapped.

"Today's ECJ ruling is the nail in the coffin of Safe Harbour”, said Dutch liberal MEP Sophie In' t Veld.

German Green MEP Jan Phillip Albrecht, who steered the parliament's data protection reforms, said the [European] Commission and the Irish data protection commissioner must "immediately move to prevent any further data transfers to the US in the framework of Safe Harbour".

The Commission in 2014 threatened to suspend it, but then issued 13 recommendations to the US on how to improve it.

Almost two years later and talks are still ongoing, in part, because the US does not want to tinker with national security exemptions.

EU-US data sharing at risk

Future EU-US data sharing risks complications if the EU Court follows the opinion of Yves Bot, its attorney general, issued on Wednesday.

EU defends US data pact, as Facebook court case opens

An Austrian privacy campaigner vs Facebook over the future of data transfers to the US case opened at the European Court of Justice in Luxembourg on Tuesday. The European Commission, meanwhile, says the Privacy Shield pact is working fine.

EU imposes deadline for new US data pact

The European Commission is using the European Court of Justice ruling on Safe Harbour as a leverage to get a new deal with American authorities.

Stakeholder

The CPDP conference wants multidisciplinary digital future

During the Computers, Privacy and Data Protection (CPDP) conference, many high-level discussions will touch upon the dynamics of decision-making in the design of new technologies, including the importance of inclusion, diversity, and ethics perspectives within these processes.

EU Commission won't probe 'Pegasus' spyware abuse

The European Commission says people should file their complaints with national authorities in countries whose governments are suspected of using an Israeli-made Pegasus spyware against them.

News in Brief

  1. EU Parliament 'photographs protesting interpreters'
  2. Poland still failing to meet EU judicial criteria
  3. Report: Polish president fishing for UN job
  4. Auditors raise alarm on EU Commission use of consultants
  5. Kaliningrad talks needed with Russia, says Polish PM
  6. Report: EU to curb state-backed foreign takeovers
  7. EU announces trade deal with New Zealand
  8. Russia threatens Norway over goods transit

Stakeholders' Highlights

  1. Nordic Council of MinistersNordic and Canadian ministers join forces to combat harmful content online
  2. Nordic Council of MinistersNordic ministers write to EU about new food labelling
  3. Nordic Council of MinistersEmerging journalists from the Nordics and Canada report the facts of the climate crisis
  4. Council of the EUEU: new rules on corporate sustainability reporting
  5. Nordic Council of MinistersNordic ministers for culture: Protect Ukraine’s cultural heritage!
  6. Reuters InstituteDigital News Report 2022

Latest News

  1. Nato's Madrid summit — key takeaways
  2. Czech presidency to fortify EU embrace of Ukraine
  3. Covid-profiting super rich should fight hunger, says UN food chief
  4. EU pollution and cancer — it doesn't have to be this way
  5. Israel smeared Palestinian activists, EU admits
  6. MEPs boycott awards over controversial sponsorship
  7. If Russia collapses — which states will break away?
  8. EU Parliament interpreters stage strike

Join EUobserver

Support quality EU news

Join us