19th Mar 2018


Safe Harbour invalidation puts EU data in quarantine

The decision by the European Court of Justice (ECJ) on 6 October to invalidate the US-EU Safe Harbour Framework is the Smoot-Hawley tariff bill of the digital age.

Smoot-Hawley was the infamous American law in 1930 that hiked US tariffs and precipitated an international tariff war that contributed to the Great Depression.

Thank you for reading EUobserver!

Subscribe now for a 30 day free trial.

  1. €150 per year
  2. or €15 per month
  3. Cancel anytime

EUobserver is an independent, not-for-profit news organization that publishes daily news reports, analysis, and investigations from Brussels and the EU member states. We are an indispensable news source for anyone who wants to know what is going on in the EU.

We are mainly funded by advertising and subscription revenues. As advertising revenues are falling fast, we depend on subscription revenues to support our journalism.

For group, corporate or student subscriptions, please contact us. See also our full Terms of Use.

If you already have an account click here to login.

  • On 6 October the European Court of Justice declared the 15-year-old Safe Harbour data-sharing pact invalid (Photo: *n3wjack's world in pixels)

This is not to suggest that the ECJ itself was motivated by protectionism. The court has a history of strict application of the European Charter of Fundamental Rights and previously invalidated European legislation requiring telecommunications providers to retain data for three years so it can be available for government investigations.

In the Safe Harbour case, the court faulted the European Commission for failing to address US government surveillance even though the 1995 Data Protection Directive and other EU instruments themselves have exceptions for national security.

The impact of the decision, though, amounts to a quarantine of European data, and means the companies that depend on transatlantic data flows might as well be paying tariffs on transfers of data.

This effect is a stark contrast to the announcement on 5 October of a Trans-Pacific Partnership trade agreement among Asian nations and the US.

The nearly 5,000 companies that subscribe to the Safe Harbour framework now need new data transfer mechanisms.  This is not an easy overnight transition.

Separate evaluations of data flows

Unless the EU and US agree on a new framework rapidly, companies will have to evaluate separately the legality of each kind of data flow and choose from a menu that includes new contract provisions, revised privacy policies and business practices, reconfiguring networks, and applying to data protection authorities for approval of organisational rules for data protection and for approval of certain transfers.

They will need to do all of this without impairing service to customers – and with the prospect that many of these solutions will be challenged.

In the days after the decision, literally thousands of lawyers and privacy officers rushed to take part in webinars, seminars, and conference calls, producing hundreds of questions about what to do in response to the court’s decision.

Answering all these questions will take time and money, introducing new friction and costs into transatlantic data flows.

In turn, the data protection authorities that the ECJ has empowered to exercise authority over international transfers will be inundated with new proceedings and requests to approve alternative data transfer mechanisms.

The court has opened the floodgates.

In the meantime, transatlantic data flows have not ceased, putting thousands of companies into a position where they might be accused of non-compliance with European data protection law for doing what until 6 October was lawful.

The Article 29 Working Party, a committee of all EU data protection authorities, have a contentious two-day meeting along with the commission in an effort to prevent 28 or more different ways of treating international transfers of data.

These regulators gave an end-of-January deadline to iron out new mechanisms for transatlantic data transfers, whether these involve various provisions of the existing data protection directive or a new, strengthened Safe Harbour agreement with the United States.

Seize the initiative

This means the Commission cannot temporise over this new framework. The elements of an agreement are in place, and it needs urgently to seize the initiative so that the rules for data transfers are clear and do not lurch back and forth.

In the wake of the ECJ decision, Commission vice-president Timmermans and justice commissioner Jourová acknowledged the importance of maintaining transatlantic data flows, with the latter saying “they are the backbone of our economy.”

Fifty percent of the world’s GDP and about one-third of its trade flows between the United States and Europe.

These trade flows are supported by increasing flows of digital information in many sectors, for transactions, supply chain management, logistics, customer relations and workforce management.

At a time when the US and EU are seeking to reduce impediments to trade, the backbone of the European economy is far too important to be the object of quarantine and virtual tariffs.

Cameron F. Kerry was General Counsel and Acting Secretary of the US Department of Commerce from 2009-2013, and was the chief US interlocutor with the EU on data protection and the Safe Harbour agreement. He is currently Senior Counsel at Sidley Austin LLP

The EU-US data deal that isn't

The lack of any legal documents and content on the new transatlantic data transfer agreement is raising doubts about the deal struck on Tuesday.

EU gives thumbs up to US data pact

Commission gives 'thumbs-up' to controversial Privacy Shield deal with US on data sharing after a year's operation - but notes room for improvement.

EU imposes deadline for new US data pact

The European Commission is using the European Court of Justice ruling on Safe Harbour as a leverage to get a new deal with American authorities.

EU and US agree data 'Privacy Shield'

A new transatlantic agreement replaces the Safe Harbour deal with what the Commission says are increased guarantees for the protection of Europeans' personal data.

Column / Brussels Bytes

EU e-privacy proposal risks breaking 'Internet of Things'

EU policymakers need to clarify that the e-privacy should not apply to most Internet of Things devices. The current proposal require explicit user consent in all cases - which is not practical.

Stakeholders' Highlights

  1. Counter BalanceConmtroversial Turkish Azerbaijani Gas Pipeline Gets Major EU Loan
  2. World VisionSyria’s Children ‘At Risk of Never Fully Recovering', New Study Finds
  3. Macedonian Human Rights MovementMeets with US Congress Member to Denounce Anti-Macedonian Name Negotiations
  4. Martens CentreEuropean Defence Union: Time to Aim High?
  5. UNESDAWatch UNESDA’s President Toast Its 60th Anniversary Year
  6. AJC Transatlantic InstituteAJC Condemns MEP Ana Gomes’s Anti-Semitic Remark, Calls for Disciplinary Action
  7. EPSUEU Commissioners Deny 9.8 Million Workers Legal Minimum Standards on Information Rights
  8. ACCAAppropriate Risk Management is Crucial for Effective Strategic Leadership
  9. EPSUWill the Circular Economy be an Economy With no Workers?
  10. European Jewish CongressThe 2018 European Medal of Tolerance Goes to Prince Albert II of Monaco
  11. FiscalNoteGlobal Policy Trends: What to Watch in 2018
  12. Human Rights and Democracy NetworkPromoting Human Rights and Democracy in the Next Eu Multiannual Financial Framework

Stakeholders' Highlights

  1. Mission of China to the EUDigital Cooperation a Priority for China-EU Relations
  2. ECTACompetition must prevail in the quest for telecoms investment
  3. European Friends of ArmeniaTaking Stock of 30 Years of EU Policy on the Nagorno-Karabakh Conflict: How Can the EU Contribute to Peace?
  4. ILGA EuropeCongratulations Finland!
  5. EUobserverNow Hiring! Sales Associate With 2+ Years Experience
  6. EUobserverNow Hiring! Finance Officer With Accounting Degree or Experience
  7. UNICEFCyclone Season Looms Over 720,000 Rohingya Children in Myanmar & Bangladesh
  8. European Gaming & Betting AssociationEU Court: EU Commission Correct to Issue Guidelines for Online Gambling Services
  9. Mission of China to the EUChina Hopes for More Exchanges With Nordic, Baltic Countries
  10. Macedonian Human Rights MovementCondemns Facebook for Actively Promoting Anti-Macedonian Racism
  11. Nordic Council of MinistersGlobal Seed Vault: Gene Banks Gather to Celebrate 1 Million Seed Collections
  12. CECEIndustry Stakeholders Are Ready to Take the Lead in Digital Construction