Europe's top court has crushed a data-sharing deal with the US which tech giants rely upon to transfer personal information of EU citizens to other parts of the world. The ruling, by the EU Court of Justice, saw the "EU-US privacy shield" invalidated due to concerns over the privacy of Europeans, with the court suggesting US surveillance laws were too far-reaching. The shield had made it legal for not just Facebook, but thousands of companies, including law firms and banks to transfer data from Europe to the US electronically. EU lawmakers had seemingly been moving towards siding with tech firms, after the court's adviser late last year issued a non-binding opinion saying the transfer should remain legal. However, today the court said it had now decided that the data-sharing deal no longer stands. In its ruling it said that "in respect of certain surveillance programmes", EU citizens are not given "actionable rights before the courts against US authorities". US citizens, on the other hand, are given protections. It also said EU data protection authorities needed to take firmer action when they received complaints over data transfers. Max Schrems, an Austrian lawyer and privacy activist, who brought the case first to Ireland's High Court and Supreme Court, before it went to the EU court, said: “I am very happy about the judgment. At first sight it seems the Court has followed us in all aspects. "This is a total blow to the Irish DPC and Facebook. It is clear that the US will have to seriously change their surveillance laws, if US companies want to continue to play a role on the EU market.” The ruling does not mean all data transfers outside the EU will stop, as the court decided so-called "standard contractual clauses" will still be valid, which is another legal mechanism that can be used by companies. Lisa Peets, a partner at Covington who represented the British Software Alliance, said: "The Court’s decision to invalidate the U.S.-EU Privacy Shield without hearing argument on the merits of the Shield will be disappointing to many." The move does, however, mean the US and EU will need to renegotiate their data privacy deal, and signals a tougher stance from European lawmakers on data privacy. Heather Burns, a fellow at policy group Coadec, warned that the move was a "shot across the bow" for the UK, which is in the process of looking at how it will share data with the EU after Brexit. Boris Johnson in February said the UK was planning to set up sovereign controls over its data and could diverge away from EU rules. Ms Burns said: "The Government needs to wake up and listen to the implications of this ruling today. It's a clear legal precedence which says, if you have a system which allows you to work to European protection standards and all that data still flows to a surveillance apparatus, that is a blocker to adequacy. "If the UK is smart, they would iron out these issues so that we wouldn't notice any change on January 1. If it's not, we'll all have to scramble to call lawyers to do contracts with complex clauses, to duct-tape workarounds around the fact that the UK Government and its surveillance apparatus cannot safeguard European's data to European standards."
No comments:
Post a Comment