Bad News For 'Privacy Shield': As Expected, EU's Top Court Will Examine Legality Of Sending Personal Data To US

from the knock-on-effects-could-be-rather-serious dept

Last October, Techdirt wrote about an important decision by the Irish High Court in a case concerning data transfers from the EU to the US. The original complaint was brought by Max Schrems in the wake of revelations by Edward Snowden back in 2013 that the NSA had routine access to user information held by companies like Facebook. As the post explained, the judge found that there were important legal issues that could only be answered by the EU's highest court, the Court of Justice of the European Union (CJEU). The High Court said that it intended to refer various questions to the CJEU, but has done so only now, as Schrems explains in an update on the case (pdf). He points out that the eleven questions sent to the CJEU (found at the end of the document embedded below) go further than considering general questions of law:

While I was of the view that the Irish Data Protection Authority could have decided over this case itself, but I welcome that the issue will hopefully be dealt with once and forever by the Court of Justice. What is remarkable, is that the High Court also included questions on the 'Privacy Shield', which has the potential for a full review of all EU-US data transfer instruments in this case.

That more or less guarantees that the CJEU will rule definitively on whether the Privacy Shield framework for transferring EU personal data to the US is legal under EU data protection law. And as Mike noted in his October post, it is hard to see the CJEU approving Privacy Shield, which does little to address the court's earlier criticisms of the preceding US-EU agreement, the Safe Harbor framework, which the same court struck down in 2015. That would be a serious problem for companies like Facebook and Google whose data is routinely accessed by the NSA. As Schrems suggests:

In the long run the only reasonable solution is to cut back on mass surveillance laws. If there is no such political solution between the EU and the US, Facebook would have to split global and US services in two systems and keep European data outside of reach for US authorities, or face billions in penalties under the upcoming EU data protection regulation.

In theory, a ruling that Facebook has broken EU privacy laws by allowing the NSA to access the personal data of EU citizens would not necessarily be an issue for other companies not involved in these surveillance programs. However, there is a cloud on the horizon even for them. As Schrems explains, data transfers from the EU to the US typically use contract law in the form of "Standard Contractual Clauses" (SCCs) to lay down the legal framework. Schrems says he is fine with that approach, because the Irish Data Protection Commissioner (DPC) can use an "emergency clause", built in to SCCs, to halt dodgy data sharing in cases like Facebook. However:

The Irish Data Protection Commissioner took the view that there is a larger, systematic issue concerning SCCs. The DPC took the view, that as the validity of the SCCs is at stake the case should therefore be referred to the CJEU.

The danger with this decision to ask the CJEU to examine the validity of SCCs is that if it rules against them, it would affect every company using them, whether or not they were involved in NSA surveillance. Schrems has a theory as to why the DPC has taken this risky route:

I am of the view the Standard Contractual Clauses are perfectly valid, as they would allow the DPC to do its job and suspend individual problematic data flows, such as Facebook's. It is still unclear to me why the DPC is taking the extreme position that the SCCs should be invalidated across the board, when a targeted solution is available. The only explanation that I have is that that they want to shift the responsibility back to Luxembourg [where the CJEU sits] instead of deciding themselves.

Given the massive knock-on effects that the ruling could have on digital flows across the Atlantic, including political consequences, the desire for the Irish DPC to give that responsibility to someone else is plausible. The CJEU is unlikely to feel intimidated in the same way, which means that US companies must now worry about the prospect of SCCs being struck down along with Privacy Shield.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+


Reader Comments

Subscribe: RSS

View by: Time | Thread


  • identicon
    Anonymous Coward, 16 Apr 2018 @ 8:11pm

    Cloudy outlook indeed

    Facebook would have to split global and US services in two systems and keep European data outside of reach for US authorities

    Thanks to the recently enacted CLOUD Act, this is harder than it seemed a year ago. Where before it might have been sufficient for Facebook to commit to having EU data stored on servers in the EU, the CLOUD Act purports to give US authorities the ability to reach into such servers if it can find a US-based Facebook entity that can access those servers. If CJEU demands a split, it will need to be a pretty stark split to escape the intrusions of the CLOUD Act.

    reply to this | link to this | view in chronology ]

    • identicon
      Anonymous Coward, 16 Apr 2018 @ 9:19pm

      Re: Cloudy outlook indeed

      And the CLOUD act makes striking Privacy Shield and SCCs much more likely.

      reply to this | link to this | view in chronology ]

    • icon
      Jeff Green (profile), 17 Apr 2018 @ 2:26am

      Re: Cloudy outlook indeed

      Could quickly lead to an exodus of companies from the US, I bet the authorities in Vancouver are rubbing their hands, not too far up the same coast, only need to move "head office" and financial operations and become a fully fledged Canadian company and you can do business Worldwide. Stay put and be US only.

      reply to this | link to this | view in chronology ]

  • identicon
    Margaret, 17 Apr 2018 @ 1:14am

    Thank you very much for an interesting and useful review!

    reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 17 Apr 2018 @ 5:37am

    Wash, rinse, repeat

    When these agreements are stricken down they just rename them and continue on. Safe Harbor became Privacy Shield. Who wants to guess the next name?

    reply to this | link to this | view in chronology ]

    • identicon
      Anonymous Coward, 17 Apr 2018 @ 12:24pm

      Re: Wash, rinse, repeat

      let me take a stab at it...

      "Fuck, You... fuck you very much random citizen"... or something along those lines just with words designed to not look like they are saying that when the average ignorant person reads them.

      reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 17 Apr 2018 @ 8:37am

    "whether or not they were involved in NSA surveillance"?

    What does "whether or not they were involved in NSA surveillance" mean? Isn't everyone "involved" in some way, with the only question being whether they know they're involved?

    If some company doesn't help the NSA, we have plenty of documentation showing that the NSA (or GCHQ) will help themselves.

    reply to this | link to this | view in chronology ]


Add Your Comment

Have a Techdirt Account? Sign in now. Want one? Register here
Get Techdirt’s Daily Email
Use markdown for basic formatting. HTML is no longer supported.
  Save me a cookie
Follow Techdirt
Techdirt Gear
Show Now: Takedown
Advertisement
Report this ad  |  Hide Techdirt ads
Essential Reading
Techdirt Deals
Report this ad  |  Hide Techdirt ads
Techdirt Insider Chat
Advertisement
Report this ad  |  Hide Techdirt ads
Recent Stories
Advertisement
Report this ad  |  Hide Techdirt ads

Close

Email This

This feature is only available to registered users. Register or sign in to use it.