ECJ overturns 'Safe Harbor' deal

In a landmark ruling, the European Court of Justice (ECJ) in Luxembourg on Tuesday declared the Safe Harbor data-sharing deal as invalid.

The agreement, signed in 2000 between Brussels and Washington, enables companies and international networks to easily transfer personal data to the United States without having to seek prior approval, a potentially lengthy and costly process.

"The Court of Justice declares that the (European) Commission's US Safe Harbour Decision is invalid," it said in a decision on a case brought against Facebook by Austrian law student Max Schrems.

Schrems launched the case following revelations two years ago by former US National Security Agency contractor Edward Snowden about the spy agency's surveillance programs.

Data privacy concerns

Schrems complained to the data protection commissioner in Ireland, where Facebook has its European headquarters, that US law doesn't offer sufficient protection against surveillance of data transferred by the social media company to servers in the United States.

Irish authorities initially rejected the complaint, pointing out that under the Safe Harbor deal, the US ensures data protection.

But the Irish data commissioner will now be required to examine Schrems' complaint "with all due diligence," the ECJ said in a summary of its ruling.

Once it has concluded its investigation, the authority must "decide whether ... transfer of the data of Facebook's European subscribers to the United States should be suspended on the ground that that country does not afford an adequate level of protection of personal data," the court said.

"YAY," Schrems tweeted after the judgment. He later said in a statement that the decision was a "milestone when it comes to online privacy."

"It clarifies that mass surveillance violates our fundamental rights. This decision is a major blow for US global surveillance that heavily relies on private partners," he added.

However, Schrems noted that the ruling doesn't bar data transfers from the EU to the US, but rather allows national data protection authorities to review individual transfers.

Repercussions

Nevertheless, the verdict has far-reaching implications for US tech giants such as Facebook and Google doing business in Europe, by making it harder for them to store the private data of EU citizens.

The case comes amid widespread tensions between Brussels and Washington on issues of regulation, with several EU anti-trust probes currently underway into US tech firms.

"This is extremely bad news for EU-US trade," said Richard Cumbley, Global Head of technology, media and telecommunications at law firm Linklaters. "Without Safe Harbor, (businesses) will be scrambling to put replacement measures in place."

But Sophie in 't Veld, a leading Liberal lawmaker in the European Parliament, welcomed the ruling and called the "safe harbor" decision "a travesty of legality."

"We need clear rules to govern the transfer of personal data to the US and other non-EU countries," she said. "But they must be legally watertight, provide real and meaningful protection, and there must be proper enforcement."

While there was no immediate reaction to the ruling from Washington, the US last month said an opinion by the EU court's top legal counsel which reached similar conclusions was based on "inaccurate assertions."

Facebook said it couldn't immediately comment on the court ruling.

sri/uhe (Reuters, dpa, AP, AFP)