Brussels, 06/10/2015 (Agence Europe) - On Tuesday 6 October, the European Court of Justice set a veritable cat amongst the pigeons when it issued a ruling confirming the general conclusions drawn by Advocate General Yves Bot on 23 September about the Safe Harbour mechanism (see EUROPE 11395) governing the transfer since 2000 of private information about Europeans via US web giants.
The European Court of Justice said that the European Commission's decision that the United Sates provides a suitable degree of protection for Europeans' private information was “invalid.” It rules that the Court of Justice is the sole body with the power to declare EU legislation invalid, but national control authorities, when requested, may, even in the presence of a European Commission decision that a third country offers a suitable level of protection for the transfer of private information, examine whether the transfer of information to that country does in fact respect the requirements of EU legislation on the protection of private information. It says that these national authorities also have the power to take cases to national courts, on the same grounds as the individual in question, in order to examine the validity of this decision. In practice, it will now be for the Irish High Court to say whether or not it will suspend the Safe Harbour decision for the Facebook case launched by Austrian student Max Schrems.
The Austrian took a case to the Irish High Court, where Facebook has its headquarters, after the June 2013 revelations by Edward Snowden about the mass surveillance programmes of the United States intelligence services and how these services gain access to data passing through the, in theory, strictly commercial framework of Safe Harbour. On Tuesday morning, Edward Snowden himself, from his Twitter account, congratulated the Austrian student for making this court ruling possible which increases security for everyone, explained the former NSA agent. Max Schrems hailed the ruling and hoped it would set a precedent for digital privacy. In a press release, he said the ruling laid down a clear line and clarifies the fact that mass surveillance violates our fundamental rights. Reasonable appeals must be possible, he added. The ruling also clearly establishes that governments and companies cannot ignore our fundamental right to privacy, said Max Schrems.
The European Commission said that the decision boosted its position as the Commission launched a review in 2013 of the Safe Harbour decision which should in theory have been completed in the summer of last year. At a press conference, Commissioners Frans Timmermans and Vera Jourova said this was an important stage in the protection of fundamental rights in the EU and the Commission would continue to seek the best balance possible between respect of privacy and consideration of business interests, including European business interests, in the new Safe Harbour decision. Less officially, a source said on Tuesday that the Commission had been caught slightly unawares, not expecting a decision so soon (the ruling was issued less than a fortnight after the general conclusions) and hadn't really had time to prepare a response.
On Tuesday afternoon, Justice and Consumer Commissioner Vera Jourova explained that now that Safe Harbour is deemed invalid, transfers of personal information to the United States are continuing using other instruments. There are other transfer systems, such as standard contractual clauses and internal business rules for the transfer of information among subsidiaries. The 1995 EU directive on data protection, which is currently being revised, also foresees that data transfer to a non-EU country can be authorised in a number of cases, such as to ensure the completion of a commercial contract (a hotel reservation, for example, for which information is needed about the individual making the booking) or with the explicit consent of the internet user that his information may be transferred, or to ensure the respect of public interest objectives (tackling fraud and cartels, for instance) or to ensure a vital interest of an individual whose medical information needs to be sent to the United States as a matter of urgency if there is a specific danger to the individual's health.
The two Commissioners said they were preparing guidelines on the ruling for national data protection authorities to explain the scope of the ruling and the Article 29 group that meets at EU level will be examining the fallout of the court's ruling. The European Commission, said Jourova, is doing all it can to support companies seeking answers because they have data to transfer (4,400 US companies are covered by Safe Harbour, as are their European partners) but now face a legal vacuum. The Commissioner hoped the negotiations that began in 2013 on a new Safe Harbour would reach conclusion. This should have happened before the summer break, but the US seems to be dragging its feet on Recommendation 13 on the wording of exceptions for the surveillance authorities and how they can get round the rules for reasons of national security, a derogation that the EU wants to be limited to what is strictly necessary and proportionate.
Meanwhile, there was a flurry of reactions on Tuesday, some delighted, others disappointed. The association DigitalEurope said it is disappointed by the ruling because the immediate invalidation of Safe Harbour will create damage to the European data economy and negatively impact on consumers, staff and employers. DigitalEurope urges the two sides to finalise the new Safe Harbour system as soon as possible.
The chair of the European Parliament's civil liberties committee, Claude Moraes (UK), who called last year for suspension of Safe Harbour, is disappointed at the European Commission's initial reaction and urges it to shed full light on the ruling's legal implications. Moraes says the Commission's reaction was disappointing and lacking in factual information about what it is planning to do to replace Safe Harbour. According to AFP, Facebook has reacted that it is crucial for the EU and the US government to ensure reliable methods for the legal transfer of information. (Original version in French by Solenn Paulic)