The case of Max Schrems (left) got the ball rolling (Image: John Thys/AFP/Getty)
If you live in Europe, your online life changed this morning. The European Unionās highest court, the EU Court of Justice, has invalidated the legal agreement by which personal data can be moved from the EU to the US for processing.
Advertisement
The ruling against the 15-year-old law, known as Safe Harbour, threatens the business models of more than 3000 companies that use it to ship data to the US, including Google, Apple, Microsoft and Facebook.
The decision is the culmination of a case that Austrian lawyer Max Schrems brought against Facebook in 2013 for participation in US mass surveillance. It means that the Irish Data Protection Commission, which presides over Facebookās data-export operations, is unable to use Safe Harbour as a reason not to investigate Facebookās data-protection practices in the US. In a statement, the Irish Data Protection Commissioner confirmed that Schremsās case would be brought back before the Irish High Court āas soon as practicableā.
The ruling also removes the legal blanket that allowed companies to send data gathered in the EU to the US for processing. Itās not yet clear whether this will disrupt the day-to-day operation of major technology firms, but their ability to pool data from both sides of the Atlantic for analysis will be affected.
“”±č±č±ō±šās explicitly states that personal data collected for its iCloud service in the European Economic Area is shipped to Apple Inc in the US for processing via Cork in Ireland.
āItās quite a huge thing to say that one regionās set of laws is superior to that of the US,ā says Carly Nyst, a lawyer and privacy consultant based in London. āThatās the bigger implication of this ā the EU exerting its might over the US. Theyāre saying our standards are higher than yours, and you need to step up your game: the EU is not going to stand for the US doing whatever it wants.ā
Surveillance concerns
Although the courtās decision is ostensibly about data protection, it inevitably addresses surveillance. The ruling backs up the claim by Schrems that āthe law and practice of the United States do not offer sufficient protection against surveillance by the public authorities of the data transferred to that countryā. This claim must now be heard and decided upon by the Irish authorities.
The development will stretch US-EU relations, which are already misaligned over the right to be forgotten and net neutrality. āThe gap between American and European legislation on privacy is at breaking point,ā says Mark Skilton of the Warwick Business School in Coventry, UK.
Nyst adds that ābeyond it being a slap in the face to the US, it sets a great precedent for the legal challenges to mass surveillance happening in Europeā.
For all the internetās power to connect people globally, the ruling is a step towards an internet that takes local rights and laws into account.
Nyst says that data-protection standards are emerging around the world, providing a crucial component of an internet that is not only hugely useful, but also preserves the privacy of its users.
āLaw and technology are misfits,ā she says. āLaw is all about jurisdiction ā which area you commit a certain act in. Technology is all about breaking down those divisions.ā A global internet with standards for protecting our data may help bridge that gap.
Paul Bernal of the University of East Anglia in Norwich, UK, says the judgement makes it hard to see how it is legal for any personal data gathered in the EU to now be sent to the US for processing.
āThe ruling basically says US surveillance cannot be allowed to override our fundamental rights, but US law says surveillance must override fundamental rights,ā says Bernal. āThe EU court is largely saying that indiscriminate gathering of data is enough to interfere with fundamental rights, and therefore you shouldnāt be able to do it.ā
In on the ruling, Max Schrems said that āUS companies that obviously aided US mass surveillance may face serious legal consequences from this ruling when data protection authorities of 28 member states review their cooperation with US spy agenciesā.
He added that āthe average consumer will not see any restrictions in daily use, but will hopefully soon be able to use online services without potentially being subject to mass surveillanceā.
