A top European lawyer made a decision this morning that could prove a massive headache for American tech companies in Europe.
Advocate General Yves Bot, an advisor to the European Court of Justice (ECJ) has said the “safe harbour” agreement for transferring data between the US and EU is “invalid,” because of concerns over US spying.
Bot’s opinion isn’t legally binding, and the ECJ judges will make a formal ruling in the coming months. But as The Irish Times notes, the judges follow such opinions “in most cases.”
But if the 15-year-old legal agreement between the EU and the US is suspended by the ECJ, it could have significant consequences for American tech companies in Europe. It would open them up to significantly more scrutiny from privacy watchdogs within Europe, some of which have the power, according to Bots, to “[suspend] the transfer of that data.”
Companies like Google and Facebook, if unable to satisfy local regulators’ demands, could potentially be faced with a local government demanding that all data held by its citizens by stored within the country, rather than the US. Such is currently the case in Russia: A law that went into effect on September 1 requires tech companies to store “personal data” on Russian citizens on Russian servers.
Bots’ opinion is the consequence of legal action taken against Facebook by Max Schrems in Ireland. In light of US surveillance programs initially revealed by whistleblower Edward Snowden, Schrems asked the Irish regulator to investigate whether the US was properly protecting data.
But the Irish regulator rejected Schrems’ case because it was bound by the Safe Harbor agreement — prompting him to appeal, which led to the current ECJ case.
“The surveillance carried out by the United States intelligence services is mass, indiscriminate surveillance,” Bots says. “In those circumstances, a third country cannot in any event be regarded as ensuring an adequate level of protection.”
In his opinion, Bots argues that agreements such as the 2000 Safe Harbor cannot supersede scrutiny at the national level. Such agreements “cannot eliminate or even reduce the national supervisory authorities’ powers … if the national supervisory authorities receive individual complaints, that does not in my view prevent them, by virtue of their investigative powers and their independence, from forming their own opinion on the general level of protection ensured by a third country and from drawing the appropriate conclusion when they determine individual cases.”
According to Bloomberg, negotiations between the EU and the US over data sharing and ensuring adequate protections have been going on for the last two years.
Europe, which is yet to produce a modern tech giant on the same scale as Google or Facebook, has an at times acrimonious relationship with American tech companies. Google in particular is the target of an ongoing anti-trust investigation on the Continent over allegations that it has abused its dominant position in the search market.