EU – US agreement invalidated by European Justice

The European Court of Justice on Thursday considered invalid an agreement that allows the transfer of personal data between the European Union and the United States, the “Privacy Shield”. The European Court of Justice has ruled that this mechanism could threaten the protection of personal data.

European Justice has annulled on Thursday, July 16, a crucial mechanism for the transfer of personal data between the European Union and the United States, called the “Privacy Shield”, due to the risk that the US surveillance program entails to protect this data.

This decision was hailed as a victory by the Austrian lawyer Max Schrems, a person in the fight for data protection, who was behind the case via a complaint against Facebook.

“After a first reading of the ruling on privacy protection, it seems that we have won 100% – for our private lives”, wrote on Twitter one who had made himself known by already terminating in 2015 a similar agreement between the EU and the US.

“The United States will need to launch a serious surveillance reform to return to a ‘privileged’ status for US companies” that allows them to transfer data, “he added.

“Infringement of fundamental rights”

The European Court of Justice (CJEU) states in its judgment that the Privacy Shield “makes possible disturbances in the fundamental rights of the persons whose data is transmitted” to the United States, as the US authorities can access, without this being limited to what is absolutely necessary.

It also points out that these regulations do not provide “guarantees for potentially affected non-US persons” nor do they offer them “rights that can be enforced against US authorities in the courts”.

“This decision creates legal uncertainty for the thousands of small and large companies on both sides of the Atlantic that rely on the Privacy Shield for their daily transmission of commercial data,” said Alexandre Roure, CCIA, lobby for technology giants in Brussels.

“We hope that European and American decision-makers will quickly develop a sustainable solution, in accordance with European law, to ensure the continuation of data flows,” he added.

For its part, the United States on Thursday said it was “deeply disappointed” by the decision on European justice. Washington will continue to work with the European Commission and study the court’s ruling in detail to understand all the concrete effects, said Wilbur Ross, US Secretary of Commerce.

We hope to be able to limit the negative consequences for the transatlantic $ 7,100 billion economic relationship that are crucial to our respective citizens, businesses and governments.

Data transfer possible under conditions

The CJEU, on the other hand, considered validly another mechanism that allows data to be transferred from the EU to the rest of the world: standard contract clauses, a model agreement established by the European Commission, which companies can use to export their data, for example to a subsidiary, parent company or a third party.

Companies affected by the Privacy Shield Decision should refer to this mechanism.

The European Commissioner for Justice, Didier Reynders, had assured before the decision that the Commission had already predicted several “scenarios”.

“Depending on the content of the decision, we will see what tools – already prepared – to both consolidate fundamental rights and control the protection that the EU provides with data,” he told AFP.

“The ambition is to react together (…) on the European side as on the American side,” he said.

The relevant personal data (online behavior, geolocation …) is the “goldmine” for the digital economy, especially for giants such as Google, Facebook or Amazon.

The invalidity of the privacy protection constitutes a new rejection for Brussels after the interruption on Wednesday of its decision that Apple would repay 13 billion euros, previously considered inappropriate tax benefits.

With AFP