Post-Assad Syrian Christians Rise Up to Celebrate Christmas
The Details Are in on How the Feds Are Blowing Your Tax Dollars
Here's the Final Tally on How Much Money Trump Raised for Hurricane Victims
Here's the Latest on That University of Oregon Employee Who Said Trump Supporters...
Watch an Eagles Fan 'Crash' a New York Giants Fan's Event...and the Reaction...
A Second US Navy Fighter Almost Got Shot Out of the Sky
Not Quite As Crusty As Biden Yet
Poll Shows Americans Are Hopeful For 2025, and the Reason Why Might Make...
Legal Group Puts Sanctuary Jurisdictions on Notice Ahead of Trump's Mass Deportation Opera...
Here's Why Texas AG Ken Paxton Sued the NCAA
Of Course NYT Mocks the Virgin Mary
What Is With Jill Biden's White House Christmas Decorations?
Jesus Fulfilled Amazing Prophecies
Meet the Worst of the Worst Biden Just Spared From Execution
Celebrating the Miracle of Light
Tipsheet

EU Court Overturns US Data-sharing Arrangement, Says U.S. Violates Privacy Rights

(AP Photo/Jeff Chiu)

U.S. companies who operate in the EU will have to adjust to a new datamining system after a Court of Justice (CJEU) ruling on Thursday overturned the U.S.-EU “Privacy Shield” agreement. “Privacy Shield” was developed by the U.S. Department of Commerce and the European Commission (EC) in 2016 to replace a contested “Safe Harbor” system.

Advertisement

“We will continue our work to ensure the continuity of safe data flows,” said EC Vice-President Jourová.

The Schrems' lawsuit overturned “Safe Harbor” in 2015 and instituted “Privacy Shield” instead, a system many privacy activists, including the American Civil Liberties Union, have criticized as “weak” and “cumbersome.”

Privacy advocate Max Schrems drove both data shields before the CJEU. Disturbed by the revelations of Edward Snowden in 2013 involving U.S. surveillance overreach, Schrems challenged Facebook as an alleged “prism” of the U.S. program. 

Over 5,000 companies participate in the "Privacy Shield," a mechanism for protecting the data of European users when exported to a third-party country like the United States. They rely on Standard Contractual Clauses (SCCs), essentially terms of use, to regulate the kinds of data that companies can transfer from European users to data centers in the U.S.

“We welcome the decision of the Court of Justice of the European Union to confirm the validity of Standard Contractual Clauses for transfers of data to non-EU countries,” said Facebook spokesperson Eva Nagle.

The court ruled that current SCC and Privacy Shield mechanisms do not effectively shield data when the third country, in this case the U.S., does not enforce equally stringent data protections. Finding U.S. surveillance laws that allow for access to otherwise protected data on the grounds of national security concerns too broad, the court determined that the Privacy Shield permitted U.S. violation of European “fundamental rights.” 

Advertisement

Regional regulators, many of whom are already overstretched, have a legal obligation to analyze and suspend data transfers that don’t comply with EU protections.

Secretary of Commerce Wilbur Ross expressed his disappointment at the court’s decision. “As our economies continue their post-COVID-19 recovery, it is critical that companies … be able to transfer data without interruption, consistent with the strong protections offered by Privacy Shield.”  

Thomas Boue of the Business Software Alliance, told the Financial Times: “We are relieved that SCCs remain valid, which is a positive outcome. But today’s Privacy Shield decision just removed from the table one of the few, and most trusted, ways to transfer data across the Atlantic.”

Microsoft also affirmed that data transfers for commercial customers are still possible via SCCs, but noyb interprets the court ruling to read that SCCs do not protect from U.S. surveillance policy: “This is also not a 'half win,' as 100 percent of the outsourcing that may be subject to US surveillance is not allowed - no matter if under Privacy Shield or SCCs.”

Marieke Gehrmann and Fritz Ulli-Pieper at TaylorWessing explain that while the SCCs are “valid in principle,” companies “in individual cases” must ensure an “adequate level of protection.”

Last year, the EC met with the Department of Homeland Security to discuss methods of modernizing SCCs. 

Advertisement

EC leaders reassured constituents that it plans to work with the European Data Protection Board and American agencies to develop a satisfactory data transfer mechanism. 

Analysts and representatives from firms that deal in personal data admit that the implications of the ruling are still ambiguous. It could mean large tech companies like Facebook and Apple will have to establish data centers in Europe or retract their services from the region entirely. At minimum, companies will have to overhaul existing data transfer processes to ensure compliance with the EU’s stricter privacy protection guidances, disrupting and perhaps contracting their European operations. Some data flows that involve explicit user consent, such as information given to book a hotel room, will not be affected.

Join the conversation as a VIP Member

Recommended

Trending on Townhall Videos

Advertisement
Advertisement
Advertisement