The European Court of Justice (ECJ) has finally handed down their Safe Harbor ruling. And that’s making waves for folks on both sides.
The European Union’s highest court struck down the pact used by thousands of companies to transfer Europeans’ personal information to the U.S. on the grounds that it exposes European citizens’ data and privacy rights to the allegedly indiscriminate surveillance by the U.S. government. And though it’s been a long time coming, it means some immediate and immense moves by a whole lot of parties.
The agreement has been around since 2000, and until now it allowed companies based in the U.S. to store personal data collected on European citizens—everything from payroll records to social media data—on U.S. servers without running afoul of Europe’s strict privacy rules. While the ECJ’s decision doesn’t nullify the agreement immediately, but it does open up to national regulators the right to investigate personal-data transfers, and suspend them if they don’t provide sufficient protections.
And that calls for immediate action, says Jetty Tielemans, Monika Kuschewsky, Dan Cooper, Mark Young and Kristof Van Quathem of Inside Privacy:
- Organizations relying on Safe Harbor to transfer personal data to the U.S. will have to consider alternative transfer mechanisms in order to transfer personal data lawfully to the U.S. Immediate short-term alternatives are likely to include standard contractual clauses and, in more limited instances, consent and possibly other statutory derogations (Article 26 (1) of the EU Data Protection Directive). Binding Corporate Rules are another alternative, but would require more time to put in place.
- Negotiations on the revised EU-U.S. Safe Harbor framework are still under way (see our earlier postshere and here). It will be interesting to observe the impact that the CJEU’s findings have on these negotiations. The European Commission is determined to continue these negotiations, as Commissioner for Justice, Consumers and Gender Equality Věra Jourová confirmed in a press conference today (the full statement is available here).
It’s not like this decision came out of nowhere, after all. The case has been pending for over a year, and just two weeks ago Advocate General Bot issued his opinion to the ECJ advising them to consider the agreement invalid.
As Hunton & Williams wrote on their Privacy and Information Security Blog at the time:
According to the Advocate General, the U.S.-EU Safe Harbor Framework also does not provide sufficient guarantees against such mass and indiscriminate surveillance as no independent authority in the U.S. is able to monitor breaches of the Safe Harbor principles committed by public authorities, such as U.S. security agencies. Therefore, the Advocate General concluded that the European Commission should suspend the application of the Safe Harbor Decision, as the level of protection provided by the U.S. for data transferred under the U.S.-EU Safe Harbor Framework is no longer adequate.
And though companies are most concerned with the determination that Safe Harbor is invalid (which is, understandably, the more pressing change), that part of the Advocate General’s opinion is likely to be a major sticking point in the long-term—and may not change in the event of renegotiation and the creation of a Safe Harbor II, says Susan Foster of Privacy & Security Matters:
A few days ago, some commentators suggested that Safe Harbor II would save Safe Harbor-dependent companies because it would remedy the faults that the ECJ might find with the original Safe Harbor. But now we know that even if the Commission endorses a Safe Harbor II, it can be attacked on a country-by-country basis. Furthermore, the ECJ has effectively raised the bar for Safe Harbor II – in future judicial assessments of Commission decisions, the ECJ will take a strict approach to reviewing such decisions (see Para. 78 of Schrems). To achieve a Safe Harbor II that meets the ECJ’s stringent requirements, the Commission will, effectively, need to “ensure” that the US’s national security laws don’t allow the gathering of data beyond that strictly necessary to achieve their objectives (that is, objectives that the ECJ thinks are legitimate) and contain adequate safeguards for EEA individuals. Taken in its strongest form, this could include a right to know their data has been processed by intelligence services, a right to find out what data has been gathered about them, and a right to have incorrect or incomplete data rectified (see Para. 90 of Schrems), all of which would be, to say the least, in tension with the fundamentals of intelligence work.
That fragmentation is likely to create a whole lot of confusion. Many of the bigger software companies like Microsoft, Google, Amazon, and more have already put standards in place in case of a decision like this. But it’s likely that European business customers are going to notice at least a little disruption initially, with a possibility to extend beyond that.
As of press time there’s no timeline for when consumers and businesses can expect a new pact with the U.S. It’s helpful to remember that this worst-case scenario is a transition period, and for now there are other tools in cloud companies quiver to manage the loss. While it may have felt like a massive agreement got undone overnight, a new agreement won’t be built up in one.