Thursday

21st Sep 2023

Opinion

Safe Harbour invalidation puts EU data in quarantine

The decision by the European Court of Justice (ECJ) on 6 October to invalidate the US-EU Safe Harbour Framework is the Smoot-Hawley tariff bill of the digital age.

Smoot-Hawley was the infamous American law in 1930 that hiked US tariffs and precipitated an international tariff war that contributed to the Great Depression.

Read and decide

Join EUobserver today

Become an expert on Europe

Get instant access to all articles — and 20 years of archives. 14-day free trial.

... or subscribe as a group

  • On 6 October the European Court of Justice declared the 15-year-old Safe Harbour data-sharing pact invalid (Photo: *n3wjack's world in pixels)

This is not to suggest that the ECJ itself was motivated by protectionism. The court has a history of strict application of the European Charter of Fundamental Rights and previously invalidated European legislation requiring telecommunications providers to retain data for three years so it can be available for government investigations.

In the Safe Harbour case, the court faulted the European Commission for failing to address US government surveillance even though the 1995 Data Protection Directive and other EU instruments themselves have exceptions for national security.

The impact of the decision, though, amounts to a quarantine of European data, and means the companies that depend on transatlantic data flows might as well be paying tariffs on transfers of data.

This effect is a stark contrast to the announcement on 5 October of a Trans-Pacific Partnership trade agreement among Asian nations and the US.

The nearly 5,000 companies that subscribe to the Safe Harbour framework now need new data transfer mechanisms.  This is not an easy overnight transition.

Separate evaluations of data flows

Unless the EU and US agree on a new framework rapidly, companies will have to evaluate separately the legality of each kind of data flow and choose from a menu that includes new contract provisions, revised privacy policies and business practices, reconfiguring networks, and applying to data protection authorities for approval of organisational rules for data protection and for approval of certain transfers.

They will need to do all of this without impairing service to customers – and with the prospect that many of these solutions will be challenged.

In the days after the decision, literally thousands of lawyers and privacy officers rushed to take part in webinars, seminars, and conference calls, producing hundreds of questions about what to do in response to the court’s decision.

Answering all these questions will take time and money, introducing new friction and costs into transatlantic data flows.

In turn, the data protection authorities that the ECJ has empowered to exercise authority over international transfers will be inundated with new proceedings and requests to approve alternative data transfer mechanisms.

The court has opened the floodgates.

In the meantime, transatlantic data flows have not ceased, putting thousands of companies into a position where they might be accused of non-compliance with European data protection law for doing what until 6 October was lawful.

The Article 29 Working Party, a committee of all EU data protection authorities, have a contentious two-day meeting along with the commission in an effort to prevent 28 or more different ways of treating international transfers of data.

These regulators gave an end-of-January deadline to iron out new mechanisms for transatlantic data transfers, whether these involve various provisions of the existing data protection directive or a new, strengthened Safe Harbour agreement with the United States.

Seize the initiative

This means the Commission cannot temporise over this new framework. The elements of an agreement are in place, and it needs urgently to seize the initiative so that the rules for data transfers are clear and do not lurch back and forth.

In the wake of the ECJ decision, Commission vice-president Timmermans and justice commissioner Jourová acknowledged the importance of maintaining transatlantic data flows, with the latter saying “they are the backbone of our economy.”

Fifty percent of the world’s GDP and about one-third of its trade flows between the United States and Europe.

These trade flows are supported by increasing flows of digital information in many sectors, for transactions, supply chain management, logistics, customer relations and workforce management.

At a time when the US and EU are seeking to reduce impediments to trade, the backbone of the European economy is far too important to be the object of quarantine and virtual tariffs.

Cameron F. Kerry was General Counsel and Acting Secretary of the US Department of Commerce from 2009-2013, and was the chief US interlocutor with the EU on data protection and the Safe Harbour agreement. He is currently Senior Counsel at Sidley Austin LLP

Disclaimer

The views expressed in this opinion piece are the author's, not those of EUobserver.

EU gives thumbs up to US data pact

Commission gives 'thumbs-up' to controversial Privacy Shield deal with US on data sharing after a year's operation - but notes room for improvement.

The EU-US data deal that isn't

The lack of any legal documents and content on the new transatlantic data transfer agreement is raising doubts about the deal struck on Tuesday.

EU and US agree data 'Privacy Shield'

A new transatlantic agreement replaces the Safe Harbour deal with what the Commission says are increased guarantees for the protection of Europeans' personal data.

EU imposes deadline for new US data pact

The European Commission is using the European Court of Justice ruling on Safe Harbour as a leverage to get a new deal with American authorities.

Latest News

  1. Report: Tax richest 0.5%, raise €213bn for EU coffers
  2. EU aid for Africa risks violating spending rules, Oxfam says
  3. Activists push €40bn fossil subsidies into Dutch-election spotlight
  4. Europe must Trump-proof its Ukraine arms supplies
  5. Antifascism and fascism are opposites, whatever elites say
  6. MEPs back Germany's Buch to lead ECB supervisory arm
  7. Russia to blame for Azerbaijan attack, EU says
  8. Fresh dispute may delay EU-wide migration reforms

Stakeholders' Highlights

  1. International Medical Devices Regulators Forum (IMDRF)Join regulators, industry & healthcare experts at the 24th IMDRF session, September 25-26, Berlin. Register by 20 Sept to join in person or online.
  2. UNOPSUNOPS begins works under EU-funded project to repair schools in Ukraine
  3. Georgia Ministry of Foreign AffairsGeorgia effectively prevents sanctions evasion against Russia – confirm EU, UK, USA
  4. International Medical Devices Regulators Forum (IMDRF)Join regulators & industry experts at the 24th IMDRF session- Berlin September 25-26. Register early for discounted hotel rates
  5. Nordic Council of MinistersGlobal interest in the new Nordic Nutrition Recommendations – here are the speakers for the launch
  6. Nordic Council of Ministers20 June: Launch of the new Nordic Nutrition Recommendations

Stakeholders' Highlights

  1. International Sustainable Finance CentreJoin CEE Sustainable Finance Summit, 15 – 19 May 2023, high-level event for finance & business
  2. ICLEISeven actionable measures to make food procurement in Europe more sustainable
  3. World BankWorld Bank Report Highlights Role of Human Development for a Successful Green Transition in Europe
  4. Nordic Council of MinistersNordic summit to step up the fight against food loss and waste
  5. Nordic Council of MinistersThink-tank: Strengthen co-operation around tech giants’ influence in the Nordics
  6. EFBWWEFBWW calls for the EC to stop exploitation in subcontracting chains

Join EUobserver

Support quality EU news

Join us