The news is not wholly unexpected, as the opinion taps into widely held concerns about the US sector-based approach data protection, which stands in contrast to the European view of privacy as a fundamental human right. A final ruling by the European Court of Justice (ECJ) is expected in three months.
The High Court opinion stems from a case brought by an Austrian Facebook user against the Data Protection Commissioner for Ireland and rejects the original findings. Maximillian Schrems, an Austrian national living in Austria, has taken exception to a Facebook policy that requires EU citizens to allow some or all of their data to be transferred from Ireland (the location of FB EU servers) to its servers in the US.
But it is Edward Snowden, not Facebook, who was the catalyst for this complaint. Following Snowden revelations around US intelligence programs, Schrems in 2013 lodged a complaint with the Irish Data Commissioner, maintaining that US data protection schemes effectively offer no safeguards against unfettered “State Surveillance.”
The data commissioner dismissed the complaint as frivolous, noting there was no evidence to indicate that Facebook or the US intelligence agencies had accessed his data, and further deciding that US Safe Harbor scheme provided adequate data protection.
Schrems took his complaint to the European High Court for a preliminary ruling. The court agreed that Snowden revelations raised significant concerns about the “mass indiscriminate surveillance and interception” of data.
In the opinion of the Advocate General, Safe Harbor fails to provide adequate protection to EU citizens because there is no means to measure or monitor compliance (Safe Harbor is a voluntary certification program) and EU citizens have no voice in how their data is used. He called for an EU-style Data Protection Authority (DPA) as a potential remedy to ensure adequate controls.
- Await further news and developments. There will be no determination for at least three months, although we expect extended debate in the meantime. Safe Harbor remains intact; even if the High Court opinion stands, that does not signal the end to cross-border data flow. There are model contracts endorsed by the European Union that can be put in place to confer adequacy in US-EU data transfers.
- Review the high court opinion, which is available at http://curia.europa.eu/juris/document/document.jsf;?docid=168421&doclang=en