Once again Europe challenges US privacy laws. Today, the Court of Justice of the European Union invalidated a EU-US pact that allowed for easy data transfers from the EU into the US. The decision will put more pressure on the US to tighten up its privacy laws. Privacy is a basic human right in the EU while most US states are still struggling to prohibit employers and schools from demanding passwords to employees'/students' social media accounts. In light of this latest Court decision, American companies such as Facebook and Google will have to restructure how they collect, use and store personal data collected from Europe.
Austrian graduate student brought that lawsuit. It alleged
that the Europeans’ personal data is unsafe in the US because the law of that
country inadequately protects it and the US Gov’t likes to spy on people’s
personal information. In particular mass
surveillance under NSA’s PRISM program raised serious concerns. U.S. intelligence services were able to
access people’s personal information in the databases of Facebook and other
tech giants. The lawsuit claims mass surveillance by US authorities violates
Europeans’ fundamental rights.
So, the Court of Justice of the European Union ruled that
the EU-US Safe Harbor agreement on the transfer of personal data is invalid.
The Safe Harbor agreement had been in place since 2000. What was the agreement
for?
EU law requires that companies exporting European citizens'
personal data can only do that to countries providing a similar level of legal
protection for that data. The Safe Harbor was the agreement that certified that
the US provided adequate protection. It was, thus, easy for thousands of US
companies to transfer data from the EU to US. All they had to do was to
self-certify that they comply with the acceptable privacy principles. More than
5,000 US companies took advantage of the convenient Safe Harbor arrangement to
facilitate data transfers.
But now that the Safe Harbor is invalid, Europeans’ personal
data can no longer be transferred to US businesses solely on the basis of the
Safe Harbor certification. Instead, to authorize data transfer, the parties
have to rely on other methods such as the "model contract clauses",
which set out the US business’s privacy practices and obligations. That would,
of course, be inconvenient and will create lots more administrative work for
the US companies.
The decision will put more pressure on the US to tighten up
its privacy laws. The US and EU have been negotiating to update the Safe Harbor
agreement for almost two years already but it’s still unclear whether the
parties are close to concluding the deal.
