European Commission responds as Safe Harbour comes under fire

23 Sep 2015

The European Commission (EC) has responded to the landmark option put forth by an adviser to the European Court of Justice (ECJ) regarding the Safe Harbour system between the EU and US.

The advocate general of the ECJ has advised national data protection bodies to overrule the Safe Harbour agreement if they feel European citizens’ rights are compromised.

Safe Harbour permits the free flow of user data to states outside of the EU, as long as they provide ‘adequate protection’ towards it, with the agreement basically a funnel for IT companies to send data across the Atlantic with little or no interference from resident states.

Yet ever since Edward Snowden revealed that this ‘adequate protection’ is nothing but an empty space where empty words once lived on an empty plain, many felt Safe Harbour was obsolete.

However, the European Commission (EC) doesn’t think so, with it still supporting the view that the US provides adequate protection.

But ECJ Advocate General Yves Bot, speaking ahead of the ECJ’s ruling on the Europe v Facebook case today (23 September), said this is no reason for state bodies to shy away from conducting their own investigation.

Back at #edw2015 I told some shocked delegates that #safeharbor was a zombie: dead but didn't know it. AG Bot just diagnosed it formally!

— Daragh O Brien (@daraghobrien) September 23, 2015

Slow and steady

The EC has been working hard on changing the current Safe Harbour parameters, in the wake of consecutive revelations surrounding “mass, indiscriminate surveillance” in the US, as said by Bot in his advice to the ECJ’s ultimate ruling.

But even though the EC came up with 13 recommended revisions to the scheme almost two years ago now, nothing has changed and the flow of data has continued.

“Intensive negotiations” with the US started in January last year, according to the EC’s statement in response to Bot’s opinion – which has yet to be ruled on by the ECJ.

Stronger rules

“The Commission has been working tirelessly with the US on the final details of a deal in the last weeks and we are confident that we can reach a positive conclusion soon,” the EC’s statement reads.

“A strengthened Safe Harbour would be another important step to better protect EU citizen’s data after we managed to finalise negotiations with the US on the ‘Umbrella Agreement’ earlier this month.

“Under this agreement all exchanges of personal data for law enforcement purposes will be governed by strong data protection rules. We need to achieve this also for other transfers of personal data from the EU to the US.”

Max Schrems: a worthy foe

The Europe vs Facebook case revolves around Austrian citizen Max Schrems’ realisation that his personal data was flowing right through Europe and on to the US, with scant protection of his personal privacy.

Following Snowden’s revelations, he took a case against the Irish Data Commissioner, which gradually moved up the ranks as nobody would go against Safe Harbour.

This ultimately led him to today’s position of a case at the ECJ, with his pleasure at hearing Bot’s opinion Tweeted immediately.

*YAY* AG at the #CJEU: #SafeHarbor is invalid. Irish #DPC has a duty to investigate. Further details as soon as we get the written version.

— Max Schrems (@maxschrems) September 23, 2015

Safe Harbour big for business

To clarify things, Safe Harbour is not the only way for data to be sent from the EU to the US.

As Schrems points out in his response to Bot’s opinion, if Safe Harbour from the US perspective is invalidated, companies certified to operate within that can use other, less streamlined forms of data transfers under Article 26 of the EC.

“The approach the advocate general has proposed is balanced and protects the fundamental rights of the users and the free flow of data,” said Schrems.

“I am sure lobby groups will again predict the ‘end of the internet’. In fact, this case only addresses outsourcing of data from a European to a US company if the data is shared for mass surveillance.”

And just like that…

Just as the ruling came in, companies began their defence of the current status quo.

“Disruption to international data flows could hurt the UK’s digital economy,” said Antony Walker, deputy CEO of techUK.

“The approach that Europe takes to how data flows in and out of the EU will impact the global ambitions of data-driven companies in the UK and right across Europe.”

Oh and the EC’s official response to Bot’s landmark opinion? “The Commission does not comment on the substance of pending court cases.”

So we will just have to wait for the full ruling from the ECJ.