Europe throws out US data-sharing deal
Privacy ruling by the ECJ is ‘worst possible outcome’ for Facebook, digital trade and the UK post-Brexit
THOUSANDS of companies including Facebook are examining the implications of a surprise decision by Europe’s top court to throw out a US data-sharing deal that has underpinned transatlantic digital trade. The ruling by the European Court of Justice left the EUUS “privacy shield” invalidated due to concerns over the privacy of Europeans, with the court suggesting US surveillance laws were too far-reaching.
Bridget Treacy, data privacy partner at Hunton Andrews Kurth, said: “For businesses that transfer personal data from the EU to the US, this represents the worst of all possible outcomes.”
Facebook said it was studying the ruling and awaited regulatory guidance. “We will ensure that our advertisers, customers and partners can continue to enjoy services while keep- ing their data safe and secure,” said its associate general counsel Eva Nagle.
The landmark decision effectively ends the privileged access US companies had to personal data from Europe. It also could complicate the transfer of personal data outside the EU.
“It is likely to have implications for the UK’s hopes for a post-Brexit data protection adequacy ruling from the European Commission,” Ms Treacy added. “The UK can expect its surveillance laws to be subject to similar scrutiny to those of the US.” The case began after ex-CIA contractor Edward Snowden revealed in 2013 that the US government was snooping on people’s online data. The revelations included detail on how Facebook gave US security agencies access to the personal data of Europeans. Austrian activist Max Schrems filed a complaint against Facebook arguing that personal data should not be sent to the US because the data protection is not as strong as in Europe.
In its ruling, the court said that “in respect of certain surveillance programmes”, EU citizens are not given “actionable rights before the courts against US authorities”. US citizens, on the other hand, are given protections.
The ruling does not mean all data transfers outside the EU will stop, as the court decided so-called “standard contractual clauses” will still be valid, which is another legal mechanism that can be used by companies.
The ECJ decision does, however, mean the US and EU will need to renegotiate their data privacy deal and it is also likely to complicate UK-EU negotiations over a treaty that would allow continued data transfers between the UK and EU after the end of the Brexit transition period on Dec 31.
Boris Johnson in February said the UK was planning to set up sovereign controls over its data and could diverge from EU rules.
Mark Zuckerberg’s Facebook said it was studying yesterday’s ruling by Europe’s top court on data sharing with the US