Europe’s highest court: safe harbor data sharing between EU, U.S. invalid

The Court of Justice of the European Union (CJEU) has ruled that U.S. companies are not allowed to transfer the personal data of European Union (EU) citizens outside its borders, meaning that technology conglomerates like Facebook, Twitter and Google have to keep EU data in the EU.

Prior to today’s ruling, U.S. businesses were protected by The Safe Harbor Agreement that was negotiated by the U.S. and the EU in 2000. The agreement says that if U.S. companies meet certain requirements, they can handle the personal information of EU citizens and move them to the U.S.

However, the agreement was challenged by an Austrian graduate student named Max Schrems who argued that personal data of EU citizens was misused by the National Security Agency’s Prism program. According to The Guardian, tech giants like Google, Facebook and Apple have been part of the program.

“This case is not about Facebook. The Advocate General himself said that Facebook has done nothing wrong,” says a Facebook spokesperson. “What is at issue is one of the mechanisms that European law provides to enable essential transatlantic data flows. Facebook, like many thousands of European companies, relies on a number of the methods prescribed by EU law to legally transfer data to the U.S. from Europe, aside from Safe Harbor.”

While today’s decision by EU’s highest court advocates privacy, Mike Zaneis, executive vice president of public policy and general counsel at the Interactive Advertising Bureau (IAB), thinks the ruling will jeopardize digital advertising marketplaces in the U.S. and EU. The regions represent a combined $84 billion in annual revenue, or nearly two thirds of global digital advertising revenues.

“For nearly 15 years, The Safe Harbor Agreement has provided IAB member companies with an efficient means to comply with EU privacy law. This robust digital advertising ecosystem has provided citizens across Europe with countless free digital services, including news, entertainment, email, and social networks,” says Zaneis.

“The weakening of The Safe Harbor Agreement limits European consumers’ access to valuable digital services and impedes trade and innovation. We urge the U.S. and EU to agree on new rules for the transatlantic transfer of data, taking into account the CJEU’s judgment,” he adds.

Christopher Oswald, vice president of advocacy at the Direct Marketing Association (DMA), also believes that the flow of consumer marketing information is essential to the global economy.

“Countries and consumers benefit from the ability of businesses to use data to create valuable products and services, enhance productivity, improve efficiency, deter fraud, and foster economic growth. Clear, interoperable data protection frameworks such as Safe Harbor are essential to foster innovation through the flow of data for responsible marketing use while assuring information security, and should be supported by government entities on both sides of the Atlantic and around the world,” says Oswald.

Multinational companies may not be immediately affected by today’s ruling. The European Commission will provide guidance in the coming days following this decision.

Homepage image via Shutterstock