EU-US data agreement invalidated

A CRUCIAL data arrangement between Europe and the US was invalidated on Thursday, throwing trans-Atlantic big tech into legal limbo.

The decision stemmed from a legal complaint by Austrian activist Max Schrems, who in 2015 scuppered a previous EU-US deal on which tech giants depend to do business.

Schrems’ legal assault began after the revelations by Edward Snowden of mass digital spying by US agencies, which the EU court at the time said were incompatible with European norms on privacy.

The previous decision struck down a deal called “Safe Harbour” that allowed for data transfers between Europe and US servers, throwing trans-Atlantic business into legal limbo.

Its replacement “Privacy Shield”, which is currently used by over 5,000 US companies, has now been invalidated as well.

The judges said even though the deal requires that the US must comply with EU privacy laws, the deal’s provisions “do not grant Europeans actionable rights before the courts against the US authorities”.

However, the court said another arrangement, known as standard contractual clauses, could stand, giving companies an alternative framework.

The case decided on Thursday originally focused on these complex clauses, an EU invention in which companies outside Europe commit to meeting EU laws on data and privacy.

But the arrangements are far more legally cumbersome for companies than a bilateral deal such as “Privacy Shield”.

During the hearings, judges turned their focus to “Privacy Shield” and a legal adviser to the court warned that it may be illegal.