The advocate-general of the EU Court of Justice has recommended that member states of the EU be allowed to suspend the transfer of personal data to the US by companies operating in the EU if they find that individual privacy may be threatened. The EU's existing Data Protection Directive allows data on EU citizens to be transferred outside the EU only if the recipient country has been granted 'safe harbour' status. The status is granted after a vetting by the European Commission of the foreign country's legal protections for personal data and privacy. While the US has long enjoyed safe harbour status, an Austrian citizen, Maximillian Scherms, questioned whether this is still valid following the revelations by Edwards Snowden of mass surveillance of personal data by US security services.
In particular, Scherms questioned the transfer of his data by Facebook from its servers based in Ireland to its operations in the US. The Irish data protection regulator rejected his initial complaint, citing the safe harbour status granted to the US in a Commission decision in 2000. Following Scherms appeal, the Irish High Court sought the opinion of the EU Court of Justice on the matter. The EU Court's advocate-general has now issued his opinion in the case, saying national regulators may ignore the Commission's decision under their obligation to uphold the EU's Charter of Fundamental Rights, which includes the right to a private life and personal data protection.
According to the advocate-general's opinion, the Commission does not have the power to restrict the authority granted to national regulators to uphold the Data Protection Directive. While the Commission's decision on safe-harbour status will play a strong role in the decisions of national authorities, they must examine each complaint on its merits, and not summarily reject a complaint based on the EC decision. If a national regulator finds systemic deficiencies in data protection in the third country to which the data is to be transferred, it may take the necessary measures to ensure the protection of personal privacy and the right to a private life, as enshrined in the EU Charter.
The advocate-general went further to say that the Commission's decision granting the US safe-harbour status should be declared invalid. "It is apparent from the findings of the High Court of Ireland and of the Commission itself that the law and practice of the United States allow the large-scale collection of the personal data of citizens of the EU which is transferred, without those citizens benefiting from effective judicial protection," the opinion reads. As a result, the Commission's decision does not satisfy the requirements of the Data Protection Directive or the Charter.
The US has acknowledged this issue itself already and proposed that EU citizens be granted the same rights in the US to judicial redress concerning potential misuse of their data as US citizens enjoy. US Attorney General Eric Holder said in June 2014 at a joint meeting of the EU and US Justice and Home Affairs ministers that the US government would look at extending the US Privacy Act to EU citizens, allowing Europeans subject to privacy violations by US companies or public bodies to seek redress in US courts.
The advocate-general is further concerned by the inability of EU citizens to be heard on the problem of mass surveillance and interception of their data by US intelligence services. Similar to the court's earlier ruling on the EU's own data retention directive, the advocate-general said the indiscriminate, mass collection of such data violates the principle of proportionality in EU law. The safe-harbour scheme and Commission decision provide no protection against such mass and generalised access to personal data, nor is there any independent authority in the US that can address any breaches of EU citizens' privacy occurring as a result of such collection of their data.
The opinion of the advocate-general is not binding on the EU Court. It must still issue its own opinion on the case, after which the Irish High Court will rule.
