The European Court of Justice (ECJ) has ruled that the ‘safe harbour’ agreement on data transfers between the EU and US is invalid, casting doubt on the extent to which US tech giants such as Facebook, Google and Apple can continue to collect data from their users in the EU. The ECJ’s ruling upholds the opinion of its advocate-general Yves Bot, who last month said the ‘safe harbour’ deal should be invalidated “because the surveillance carried out by the US is mass, indiscriminate surveillance,” leaving the data of European citizens unprotected in the US. The agreement has been in force since 2000 but has come under severe criticism following revelations of widespread US spying from former National Security Agency contractor Edward Snowden.
The ECJ was asked to rule on the safe harbour framework after an Austrian citizen, Maximillian Scherms, questioned whether it remained valid in the light of the snooping revelations. In particular, Scherms questioned the transfer of his data by Facebook from its servers based in Ireland to its operations in the US. The ECJ’s ruling means the Irish supervisory authority is now required to investigate the claims brought by Schrems. “At the conclusion of its investigation [the Irish supervisory authority] is to decide whether, pursuant to the directive, transfer of the data of Facebook's European subscribers to the United States should be suspended on the ground that the country does not afford an adequate level of protection of personal data," said the ECJ.
Although the ECJ’s decision doesn’t mean personal data transfers to the US are necessarily illegal, it gives national regulators the right to investigate transfers to all non-EU countries (including the US) and suspend them if they fail to guarantee sufficient protection. As a result of the decision, which is binding on all EU members states and can’t be appealed, some 4,000 US and European companies companies will have to implement new methods of transferring personal data legally. The ruling also gives European data protection regulators substantially enhanced powers to pursue companies for data transfer violations.
