While most of the newspapers were distracting the public with the antics of Mark Zuckerberg, a European Union High Court raised 11 important questions regarding privacy (warning for PDF) that will affect large data-gathering operations like Facebook. The 11 questions have been passed upwards to the most senior EU court and are based on a current case started by Max Schrems.
The Irish High Court referral, published on Thursday and due to be submitted to the ECJ by the end of April, stems from a case brought by an Austrian privacy activist against the methods used by Facebook to store user data on U.S. servers following revelations in 2013 of mass U.S. surveillance practices.
[...] The High Court's five-page referral asks the Court of Justice of the EU (ECJ) if the Privacy Shield - under which companies certify they comply with EU privacy law when transferring data to the United States - does in fact mean that the United States "ensures an adequate level of protection".
Opponents can still appeal the court's referral any time until the end of the month. The proposed Privacy Shield legislation is the EU's follow up framework to cover transfers of personal data to outside the EU. It is being written as a replacement for the now invalidated International Safe Harbor Privacy Principles. The Safe Harbour agreement was brought down, after an earlier two-year lawsuit (Case C-362/14) by Max Schrems, because of its inadequate protections in light of the Snowden revelations.
From Reuters : EU's top court asked to probe Facebook U.S. data transfers
The Irish Times : High Court sets out 11 questions for ECJ on EU-US data transfers
Ars Technica : Facebook data transfers to be examined by EU court, Irish judge rules
See also an intial analysis, http://www.europe-v-facebook.org/sh2/PA-ref.pdf
Earlier on SN:
Austria Resident Max Schrems is Organizing a Privacy-Oriented Class-Action Suit Against Facebook
On its Way: A Google-Free, NSA-Free IT Infrastructure for Europe
Related Stories
This really wasn't in the script. All conquering, "disruptive" Silicon Valley companies were more powerful than any nation state, we were told, and governments and nations would submit to their norms. But now the dam that Max Schrems cracked last week has burst open as European companies seek to nail down local alternatives to Google, Dropbox and other Californian over-the-top players.
They don't have much choice, says Rafe Laguna, the open source veteran at Open Xchange.
What the Schrems vs Facebook decision in the European Court means, Laguna argues, is that any data protection guarantee that a US company makes in Europe is worthless, and so any business processing a European individual's data on US servers exposes them to lawsuits they can't win.
"Suppose I'm a German business, and I get an agreement from Google, which says everything is good, and I put that into my file. When a customer sues me, I go to court and find that agreement isn't worth a dime. Google cannot guarantee what they're guaranteeing.
"This takedown of Safe Harbor will be remembered as a historical event. It'll be patched, but it'll be a bad patch. The real patch is you do business with a trusted supplier operating in a country whose laws you trust. And that doesn't mean the over-the-top big boys from California," says Laguna.
Max Schrems is hoping for approval from the EU Court of Justice to bring an Austrian-style collective suit against Facebook. Unlike the earlier case in Ireland which dealt primarily with US mass surveillance, this Austria-based case focuses on the commercial misuse of personal data by Facebook. The lawsuit addresses alleged violations of privacy by Facebook through, for starters, its misuse of personal data and tracking of users on external pages. He is backed by his earlier case that the user data of EU citizens was not sufficiently protected when shipped to the U.S.
- Facebook Challenged by Activist Who Broke EU-U.S. Data Pact
- Austrian activist, 25,000 supporters seek right to bring class-action suit against Facebook
- Facebook Ireland fights Max Schrems over class action suit
An opinion is expected by November 7th from Advocate General Michal Bobek, a court advisor, the final judgment by the end of the year.
The case is C-498/16, Schrems.
Facebook is trying to block Schrems II privacy referral to EU top court. In an attempt to get Ireland's Supreme Court to decide about accepting their appeal, their lawyer has asked for the referral to the EU court to be delayed while at the same time asking for an unusal accelerated referral to Ireland's Supreme Court.
Facebook’s lawyers are attempting to block a High Court decision in Ireland, where its international business is headquartered, to refer a long-running legal challenge to the bloc’s top court.
[...] The case relates to a complaint filed by privacy campaigner and lawyer Max Schrems regarding a transfer mechanism that’s currently used by thousands of companies to authorize flows of personal data on EU citizens to the US for processing. Though Schrems was actually challenging the use of so-called Standard Contractual Clauses (SCCs) by Facebook, specifically, when he updated an earlier complaint on the same core data transfer issue — which relates to US government mass surveillance practices, as revealed by the 2013 Snowden disclosures — with Ireland’s data watchdog.
Also at Reuters : Facebook bids to keep data privacy case from EU's top court.
Earlier on SN:
High Court Sets Out 11 Questions for ECJ on EU-US Data Transfers
Austria Resident Max Schrems is Organizing a Privacy-Oriented Class-Action Suit Against Facebook
EU Top Court Rules Safe Harbour Treaty Invalid
The CJEU (Court of Justice of the European Union) issued its judgment on the Schrems II case, formally called Data Protection Commissioner v Facebook Ireland Limited, Maximillian Schrems (Case C-311/1). The gist is that US companies are now put back to an average status, same as most others, with no special access to EU data due to operating in the US. It will take a while before the decision is published at the government site. Max himself has also issued his first statement on the CJEU judgment, notably that the European Commission bowed to US pressure and that now reform of US surveillance is unavoidable:
US Surveillance reform is unavoidable - CJEU just says it out loud
The Court was clear that the far-reaching US surveillance laws are in conflict with EU fundamental rights. The US limits most protections to "US persons", but does not protect the data of foreign customers of US companies from the NSA. As there is no way of finding out if you or your business are under surveillance, people also have no option to go to the courts. The CJEU found that this violates the 'essence' of certain EU fundamental rights.
Schrems: "The Court clarified for a second time now that there is a clash between EU privacy law and US surveillance law. As the EU will not change its fundamental rights to please the NSA, the only way to overcome this clash is for the US to introduce solid privacy rights for all people – including foreigners. Surveillance reform thereby becomes crucial for the business interests of Silicon Valley."
(Score: -1, Offtopic) by Anonymous Coward on Friday April 13 2018, @03:02PM (8 children)
i bet there's lots of powdered wigs and harumphing
(Score: 2) by Thexalon on Friday April 13 2018, @03:51PM (7 children)
Based on this photo [legalcheek.com], I'd say no powdered wigs, which is mostly a British custom that is carried on in some of the Commonwealth countries to varying degrees.
This may come as a surprise to Americans, but the Brits aren't really representative of Europe as a whole. Heck, they recently decided they would really rather not be a part of Europe.
The only thing that stops a bad guy with a compiler is a good guy with a compiler.
(Score: 2) by looorg on Friday April 13 2018, @03:55PM (2 children)
I wonder where this idea of the red robed judges come from, it seems the standard otherwise is black robes. Is that a french/spanish/german thing?
(Score: 0) by Anonymous Coward on Friday April 13 2018, @04:44PM
Nobody expects the red robed judges!
(Score: 2) by janrinok on Friday April 13 2018, @04:44PM
Well it is the same in France, but might be a much wider tradition throughout Europe.
(Score: 4, Insightful) by janrinok on Friday April 13 2018, @04:51PM (3 children)
Er, no. Europe is a continent and the geographical location of both Europe and the UK will remain unchanged. The UK will still be in Europe. Europe has been Europe for a very long time. Unless the tectonic plates suddenly start to accelerate their movement it will be around for quite a bit longer yet.
However, the UK has decided to leave the European Union which is a more federal approach to government, business, legal matters and financial management among other things. This is the bit in which the UK no longer wishes to take part.
(Score: 0) by Anonymous Coward on Friday April 13 2018, @04:58PM
Is this diagram still helpful: https://en.wikipedia.org/wiki/File:Supranational_European_Bodies.png [wikipedia.org] ?
(Score: 2) by Thexalon on Friday April 13 2018, @05:09PM (1 child)
The Brits have frequently used those 20 miles of ocean between them and France to say "No, we're something different than the rest of the land in our area. You continentals do your thing, we'll do ours." They even do it in fiction, on a regular basis: Orwell made Britain part of the US-based Oceania rather than the Russian-based Eurasia, George R.R. Martin made Britain into Westeros, a very different place from the rest of the world known as Essos, etc.
That's in large part because many of the continental boundaries are pretty arbitrary. For example, the line between Europe and Asia, do you put Indonesia with Asia or Australia, and how are all the Pacific Islands classified?
The only thing that stops a bad guy with a compiler is a good guy with a compiler.
(Score: 2) by janrinok on Friday April 13 2018, @05:36PM
Every nation is different - they each have their own history and therefore culture, traditions and way of life. The UK wants to keep its laws, traditions and way of life and doesn't see the need to have the permission of 27 other countries before they can kick a convicted terrorist out of the country, or have to accept a quota of immigrants based on figures chosen by another government. Whether their choice proves to be a good one in the long term is something that we will have to wait and see. But it does not equate to ceasing to be a part of Europe.