EU-US data pact skewered in court hearing

The panel of judges were discussing the implications of US-led mass surveillance on the 15-year old data transfer agreement that is supposed to “ensure an adequate level of [data] protection” whenever the personal data of EU nationals is transferred to firms based in the US.

Safe Harbour underpins a multi-billion euro business for big tech firms like Google and Facebook, which need and use the data to target online ads for people living in EU countries.

But the agreement - signed off by the European Commission - has come under intense scrutiny following the 2013 media revelations that spy hubs in the US and UK had, among other things, siphoned off data transfer flows by tapping directly into under sea cable networks.

Edward Snowden, the former National Security Agency (NSA) contractor, says the spy agency had also used a programmed dubbed “Prism” that granted them data access to US tech firms like Facebook.

This led Austrian national Max Schrems to lodge a complaint with Ireland’s data protection commissioner on the transfer of personal data to the United States from Facebook Ireland.

Schrems says the protection of personal data transferred by the company to the US cannot be guaranteed in light of the Snowden revelations.

But Ireland’s commissioner turned down the claim and refused to investigate, noting that there was no evidence Facebook wasn’t complying with the Safe Harbour principles.

Schrems appealed to Ireland’s High Court, which found that the US had “mass and undifferentiated” access to the data. The High Court adjourned the case and is now asking the ECJ to help clarify the data transfer rules.

A number of member states spoke out in defence of Schrems.

A lawyer representing the Austrian government told the judges that Safe Harbour is better suited for “pirates” than the protection of data of EU citizens.

“Safe Harbour is not in fact for the data of EU citizens, but is at best a safe harbour for data pirates,” said Austrian government lawyer Gerhard Kunnert.

A lawyer for Poland’s government also said data protection commissioners should be allowed to suspend flows “when an individuals’ rights may be infringed”.

The commission, for its part, had already declared the pact was riddled with problems two years ago and then issued the Americans 13 recommendations to ensure an “adequate” protection of privacy.

Those talks are still ongoing, casting doubt on whether the European Commission is serious in its efforts despite calls from the European Parliament to scrap Safe Harbour altogether.

It is up to the European Commission - via so-called adequacy decisions - to determine whether US domestic law and international commitments offer Europeans sufficient data protection safeguards.

Asked by the judge if the protection of personal data in the charter of fundamental rights is applied when the commission issues an adequacy decision, the commission lawyer said “No”.

“The decision of the adequacy cannot become invalid from one day to another because of new developments,” added the lawyer.

He noted that so long as talks with the Americans are on-going, then the power of national data protection authorities to possibly suspend data transfers in individual cases is limited.

He also said that the Brussels executive is unable to guarantee “adequate” safeguards are respected.

The revelation provoked an outcry from Max Schrems who told this website that it was the most striking thing he heard.

No harm done

Lawyers for Ireland’s data commissioner said there is no evidence that the transfer of Schrems’ data to the US has caused him any harm.

“That is not surprising given that the National Security Agency is not currently interested in essays written by law students in Austria,” said the Irish lawyer.

“The fact that he is not being harmed at the moment may be what allows you [ECJ] to give the commission some further time to conclude its negotiations.”

The Court’s advocate general is set to issue an opinion on 24 June.