EU-US data share deal 'invalid' - ECJ advisor

The "Safe Harbor" framework, which eases transfer of data across the Atlantic, is invalid and does not offer enough privacy protection, Advocate General of the European Court of Justice (ECJ) Yves Bot said on Wednesday.

In a non-binding opinion, Bot said that the US agencies enjoy access to the data transferred from Europe, in such a way that it "constitutes an interference with the right to respect for private life and the right to protection of personal data."

The American intelligence services conduct "mass, indiscriminate surveillance," according to Bot.

The EU and the US created the "Safe Harbor" data sharing deal in 2000, after the European Commission deemed the level of privacy protection in the US to be adequate. As a result, thousands of companies now transfer data from the EU to the US, including digital giants such as Facebook, Apple and Google.

Verdict to come

The EU Commission should have suspended "Safe Harbor" after the revelations of former NSA employee Edward Snowden, Bot said on Wednesday.

The ECJ is considering a case stemming from a complaint by Austrian law student Max Schrems. The 27-year old Facebook user alleged that the social network was helping the NSA gather email and other private information by sending data on its European users to servers in the United States.

In most of the ECJ cases, the judges follow the recommendation of Advocate General, who is their main legal advisor. The court is due to announce their verdict in several months.

Vital data flow

"We are concerned about the potential disruption to international data flows if the Court follows today's opinion," said John Higgins, Director General of DIGITALEUROPE, whose members include Apple, Cisco, Ericsson and Google.

Many US companies say that "Safe Harbor" helps them with transferring vital data, including payroll and human resources information. The consequences of the court decision could be far-reaching for American businesses.

Advocate General Bot also said that national data protection authorities could suspend data transfers if they felt EU citizens' privacy was at risk, even if the EU commission considered the level of protection to be adequate.

dj/msh (Reuters, AFP)