The 15-year-old pact’s validity was questioned after an Austrian law student, Max Schrems, challenged the Irish Data Protection Commissioner to investigate several U.S. internet giants’ alleged collaboration with the NSA’s prism program (Ireland is the location of Facebook’s European headquarters).
Advertisement
The Irish authorities rejected the case pointing to the safe harbour agreement, which dates from 2000, but Schrems took the matter to the European Court Of Justice, which yesterday ruled the data sharing pact invalid. Many European countries have widely varying stances towards privacy. It includes a series of principles concerning the protection of personal data to which United States undertakings may subscribe voluntarily.
“The biggest casualties will not be companies like Google and Facebook because they already have significant data center infrastructure in countries like the Republic of Ireland, it will be medium-sized, data-heavy tech companies that don’t have the resources to react to this decision”. The ruling was not unexpected because as we wrote last month, the legal adviser to the court had deemed Safe Harbor invalid because of “mass, indiscriminate surveillance” by the U.S. But quashing the Safe Harbor Decision could open the floodgates to privacy investigations and lawsuits. Schrems argued that, based on information about the National Security Agency’s practices leaked by Edward Snowden in 2013, the U.S. does not actually provide sufficient protection of private data and that Facebook therefore acted illegally by transferring his private data to its servers in the US.
The relationship between the European Union and the U.S.is also certain to be affected by the rejection of the Safe Harbour legislation, with agreements ongoing regarding transatlantic data transfers and the Transatlantic Trade and Investment deal.
The statement noted that the ECJ’s advocate general “himself said that Facebook has done nothing wrong”.
“On the one hand you have fundamental rights which are hugely important but then you have legal certainties for companies”, he said.
The European Union has criticized the way the US handles data, and has been trying to renegotiate the Safe Harbor agreement for a few time.
First vice president for the European Commission Frans Timmermans, who is in charge of carrying out the ruling, assured business that they could still move date from European to the United States provided that certain measures at met. These companies will need to review their current contractual arrangements in order to determine the basis on which the transfer of personal data to the United States is being legitimised.
Advertisement
Now, global companies like Facebook and Google must rethink how to collect, manage, and analyze online information for millions of users in the EU’s 28 member states.
