Facebook suffers major legal setback as top European court strikes down US-EU data sharing pact
The European Union’s Court of Justice has invalidated an agreement that allowed Facebook and other tech firms to transfer data from EU states to the US. The ruling calls for better privacy protections.
The ruling invalidated a US-EU data flow agreement called ‘Privacy Shield’ after finding that safeguards put in place to protect internet users’ information from surveillance were insufficient and incompatible with EU law.
“The requirements of US national security, public interest and law enforcement have primacy, thus condoning interference with the fundamental rights of persons whose data are transferred to that third country,” the court argued.
Washington said it was “deeply disappointed” by the decision.
Thursday’s decision also called on EU data protection authorities (DPAs) to ensure that privacy regulations are fully enforced.
The case dates back to 2013, when National Security Agency contractor Edward Snowden revealed that the US government was sifting through people’s online communications and data. The explosive leaks included details about an arrangement in which Facebook granted US intelligence agencies access to the personal data of the social media platform’s European users.
As a result, Austrian activist Max Schrems filed a complaint against Facebook with the Irish Data Protection Commission (DPC). The issue was later litigated, with the Court of Justice deciding in 2015 that the US-EU pact used to facilitate data transfers, known as ‘Safe Harbor’, did not adequately guarantee the protection of Europeans’ personal data.
Schrems then challenged the predecessor of Safe Harbor, Privacy Shield, which was struck down in Thursday’s ruling.
“I am very happy about the judgment. It seems the Court has followed us in all aspects. This is a total blow to the Irish DPC and Facebook. It is clear that the US will have to seriously change their surveillance laws, if US companies want to continue to play a major role on the EU market,” Schrems said in response to the decision against Privacy Shield.
The ruling creates uncertainty about how Facebook and other firms can legally transfer commercial data from the EU. However, the court said that its decision would not affect “necessary” data flows, such as flight and hotel reservations or other contracts.
“The requirements of US national security, public interest and law enforcement have primacy, thus condoning interference with the fundamental rights of persons whose data are transferred to that third country,” the court argued.
Washington said it was “deeply disappointed” by the decision.
Thursday’s decision also called on EU data protection authorities (DPAs) to ensure that privacy regulations are fully enforced.
The case dates back to 2013, when National Security Agency contractor Edward Snowden revealed that the US government was sifting through people’s online communications and data. The explosive leaks included details about an arrangement in which Facebook granted US intelligence agencies access to the personal data of the social media platform’s European users.
As a result, Austrian activist Max Schrems filed a complaint against Facebook with the Irish Data Protection Commission (DPC). The issue was later litigated, with the Court of Justice deciding in 2015 that the US-EU pact used to facilitate data transfers, known as ‘Safe Harbor’, did not adequately guarantee the protection of Europeans’ personal data.
Schrems then challenged the predecessor of Safe Harbor, Privacy Shield, which was struck down in Thursday’s ruling.
“I am very happy about the judgment. It seems the Court has followed us in all aspects. This is a total blow to the Irish DPC and Facebook. It is clear that the US will have to seriously change their surveillance laws, if US companies want to continue to play a major role on the EU market,” Schrems said in response to the decision against Privacy Shield.
The ruling creates uncertainty about how Facebook and other firms can legally transfer commercial data from the EU. However, the court said that its decision would not affect “necessary” data flows, such as flight and hotel reservations or other contracts.