In a landmark ruling, the European Court of Justice this week struck down the 2016 EU-US Privacy Shield, a method of transferring data across the Atlantic, over concerns regarding the safety of European citizens’ data in the United States. The ruling cannot be appealed.
The ECJ’s decision risks legal uncertainty for thousands of businesses in, or dependent on, the transatlantic data economy and could potentially lead to punitive tariffs from the Trump administration.
Today’s ruling goes back to 2013, when Austrian privacy activist Max Schrems filed a privacy complaint against Facebook in the Irish courts following the Edward Snowden revelations, arguing that European citizens’ data, which US tech companies stored in US-based data centres, were not safe from the US security services. The case led to the ECJ overturning the Privacy Shield’s predecessor, known as the Safe Harbour agreement, in 2015.
Yet, in today’s ruling, the judges of the EU’s highest court ruled that “the limitations on the protection of personal data arising from the domestic law of the United States on the access and use by US public authorities” are incompatible with the privacy protections enjoyed by EU citizens under GDPR and the European Charter of Fundamental Rights. In addition, the court further added that the US Government’s surveillance programmes “are not limited to what is strictly necessary” and that data subjects do not have actionable rights before the courts against the US authorities, despite an Ombudsperson mechanism.
The Ombudsperson mechanism was specifically designed to create compatibility with GDPR and ensure judicial oversight. However, the ECJ assessed that the Ombudperson mechanism “does not provide data subjects with any cause of action before a body which offers guarantees substantially equivalent to those required by EU law.”
The Court’s ruling in favour of Mr. Schrems and against the European Commission’s Safe Harbour and Privacy Shield raises significant questions over the legality and viability of future transatlantic data transfer regimes.
In effect, the ruling has the power to stop almost all transatlantic data transfers, a billions of dollars industry also critical to the EU’s post-coronavirus recovery plan, unless the Commission and US administration manage to agree on an updated, GDPR-compliant regime in the very near future.
Crucially however, the ECJ’s ruling on the two data regimes indicates that any future transatlantic data transfer agreement will be measured against the same benchmark: can US security services access EU citizen’s data without their knowledge? If so, the ECJ can be expected to strike down future agreements over and over again.
In what is sure to lead to increased tension with the administration of US President Donald Trump, the European Court of Justice, essentially, calls on the United States to significantly reform its domestic privacy, surveillance and national security regimes in exchange for US digital service companies to continue operating their current business model.
Meanwhile, the ruling is also expected to significantly affect the European Commission’s current assessment of the United Kingdom’s post-Brexit data protection and processing regimes in light of sweeping surveillance powers available to UK security services.
Today’s ruling and threat to the viability to the transatlantic data economy will undoubtedly be seen by President Trump as yet another attack on US digital companies and further increase his attacks on the European Union. In recent weeks, his administration had already attacked the EU’s GDPR, accusing it of covering cybercriminals and harming US economic interests.
The most recent attacks come after the administration’s Trade Representative Robert Lighthizer launched Section 301 investigations into several countries’ plans to introduce Digital Services Taxes and presented tariffs of $1.3 billion on French luxury goods which will be deferred until next year.
The rising trade tensions between the world’s two largest trading blocs over the last few years, including most recently the US administration’s threats to significantly increase tariffs on European automobiles, looks set to continue.