- Apr 24, 2013
- 1,200
In a key case before the European Union's highest court, the Court of Justice of the European Union (CJEU), the European Commission admitted yesterday that the US-EU Safe Harbor framework for transatlantic data transfers does not adequately protect EU citizens' data from US spying. The European Commission's attorney Bernhard Schima told the CJEU's attorney general: "You might consider closing your Facebook account if you have one," euobserver reports.
The case before the CJEU is the result of complaints lodged against five US companies—Apple, Facebook, Microsoft, Skype, and Yahoo—with the relevant data protection authorities in Germany, Ireland, and Luxembourg by the Austrian privacy activist Max Schrems, supported by crowdfunding. Because of the important points of European law raised, the Irish High Court referred the Safe Harbor case to the CJEU.
The referral was prompted by Edward Snowden's revelations about the Prism data-collection program, which show that the US intelligence community has ready access to user data held by nine US Internet companies, including the five named in Schrems' complaints. The EU's Data Protection Directive prohibits the transfer of personal data to non-European Union countries that do not meet the EU's "adequacy" standard for privacy protection. To aid US companies operating in the EU, the Safe Harbor Framework was introduced, which allows US organizations to self-certify their compliance with the adequacy provision when they transfer EU personal data back to the US.
Schrems' complaint claims that the existence of the Prism program, which sees personal data of EU citizens held by US Internet companies passed on to the intelligence agencies, means that the protection cannot be considered "adequate" and that therefore the Safe Harbor agreement no longer applies.
As a post on the International Association of Privacy Professionals site reports, the European Commission admitted in yesterday's court hearing that "it cannot guarantee adequate protection of EU citizen data at the moment." But it claimed that "Safe Harbor is a politically and economically necessary framework that is still under negotiation and is best left in the hands of the commission to work toward a better protection of EU citizen rights." That negotiation has been underway for nearly 18 months, with no signs of an agreement.
If it is ultimately found that the PRISM program removes the ability of US companies to self-certify, they could still apply to transfer data out of the EU even without the "privileged" status that Safe Harbor otherwise confers. However, as a background document on Schrems' Europe-v-Facebook site explains: "a number of companies (e.g., Twitter in its recent Annual Report) expect that it may become harder for US companies to retrieve data from the European Union and it may be necessary to invest in secure European data centers."
The court's decision is also politically important, because a new EU Data Protection Directive is being drawn up. Lack of certainty about the legal status of the Safe Harbor framework is making it even harder to find a consensus between companies that want unimpeded data flows covered by self-certification and privacy advocates calling for stricter limits that keep personal data on servers located with the EU.
Further complicating matters are two global trade agreements, the Transatlantic Trade and Investment Partnership and the Trade in Services Agreement, currently being negotiated. Both are expected to contain chapters on data flows, but it will be hard for the EU to commit itself in this area without the new Data Protection Directive in place. The CJEU is due to issue its opinion on June 24.
