SoylentNews

The European Court of Justice has just ruled that the Safe Harbour agreement, which is used by American startups to transfer data between the US and Europe, is invalid. As a result, companies such as Facebook and Twitter may now need to host European user data in Europe, rather than hosting it in the US and transferring it over.

"benoni" ,"exec", and others write:

This is a brushed up Google translation of nu.nl (http://www.nu.nl/internet/4139196/europees-hof-zet-streep-privacyverdrag-met-vs.html).

In the meantime this news is also coming through in English: http://www.ft.com/fastft/402791/eu-court-deals-blow-amazon-facebook-with-safe-harbour-ruling and http://uk.businessinsider.com/european-court-of-justice-safe-harbor-ruling-2015-10.

The European Court on Tuesday scrapped the so-called Safe Harbour treaty, which regulated the storage of European personal data in the United States.

Under the treaty enabled Internet companies like Facebook are allowed to store the data of Europeans in the US. However, the Court finds that the data in that country are inadequately protected and that therefore the treaty is invalid.

The ruling also made clear that, regardless of the European convention, it should have been possible for national regulators like the Dutch Data Protection Authority to prevent data from being sent to servers in the US. The Court follows with its judgment the recently expressed opinion of Advocate General Yves Bot.

The judgment has been done in a case between the Austrian student Max Schrems and Facebook. Schrems wanted the Irish privacy watchdog to investigate data protection in the United States, but because of the Safe Harbor treaty, the Irish watchdog refused to launch an investigation. Schrems also noted disclosures of whistleblower Edward Snowden in this case. NSA documents from Snowden showed that the intelligence agencies harvest private data from internet users on a large scale. According to Schrems this was a reason to keep European data from being processed in the US.

In the ruling, the Court points to a message from the European Commission to the European Parliament, in which the large-scale collection of private data by the US is named "unacceptable". In view of this communication, the Commission should immediately suspend the treaty.

Original Submission #1  Original Submission #2 

canopic jug writes:

Max Schrems is hoping for approval from the EU Court of Justice to bring an Austrian-style collective suit against Facebook. Unlike the earlier case in Ireland which dealt primarily with US mass surveillance, this Austria-based case focuses on the commercial misuse of personal data by Facebook. The lawsuit addresses alleged violations of privacy by Facebook through, for starters, its misuse of personal data and tracking of users on external pages. He is backed by his earlier case that the user data of EU citizens was not sufficiently protected when shipped to the U.S.

• Facebook Challenged by Activist Who Broke EU-U.S. Data Pact
• Austrian activist, 25,000 supporters seek right to bring class-action suit against Facebook
• Facebook Ireland fights Max Schrems over class action suit

An opinion is expected by November 7^th from Advocate General Michal Bobek, a court advisor, the final judgment by the end of the year.

The case is C-498/16, Schrems.

Original Submission

canopic jug writes:

While most of the newspapers were distracting the public with the antics of Mark Zuckerberg, a European Union High Court raised 11 important questions regarding privacy (warning for PDF) that will affect large data-gathering operations like Facebook. The 11 questions have been passed upwards to the most senior EU court and are based on a current case started by Max Schrems.

The Irish High Court referral, published on Thursday and due to be submitted to the ECJ by the end of April, stems from a case brought by an Austrian privacy activist against the methods used by Facebook to store user data on U.S. servers following revelations in 2013 of mass U.S. surveillance practices.

[...] The High Court's five-page referral asks the Court of Justice of the EU (ECJ) if the Privacy Shield - under which companies certify they comply with EU privacy law when transferring data to the United States - does in fact mean that the United States "ensures an adequate level of protection".

Opponents can still appeal the court's referral any time until the end of the month. The proposed Privacy Shield legislation is the EU's follow up framework to cover transfers of personal data to outside the EU. It is being written as a replacement for the now invalidated International Safe Harbor Privacy Principles. The Safe Harbour agreement was brought down, after an earlier two-year lawsuit (Case C-362/14) by Max Schrems, because of its inadequate protections in light of the Snowden revelations.

From Reuters : EU's top court asked to probe Facebook U.S. data transfers
The Irish Times : High Court sets out 11 questions for ECJ on EU-US data transfers
Ars Technica : Facebook data transfers to be examined by EU court, Irish judge rules

See also an intial analysis, http://www.europe-v-facebook.org/sh2/PA-ref.pdf

Earlier on SN:
Austria Resident Max Schrems is Organizing a Privacy-Oriented Class-Action Suit Against Facebook
On its Way: A Google-Free, NSA-Free IT Infrastructure for Europe

Original Submission

canopic jug writes:

The CJEU (Court of Justice of the European Union) issued its judgment on the Schrems II case, formally called Data Protection Commissioner v Facebook Ireland Limited, Maximillian Schrems (Case C-311/1). The gist is that US companies are now put back to an average status, same as most others, with no special access to EU data due to operating in the US. It will take a while before the decision is published at the government site. Max himself has also issued his first statement on the CJEU judgment, notably that the European Commission bowed to US pressure and that now reform of US surveillance is unavoidable:

US Surveillance reform is unavoidable - CJEU just says it out loud

The Court was clear that the far-reaching US surveillance laws are in conflict with EU fundamental rights. The US limits most protections to "US persons", but does not protect the data of foreign customers of US companies from the NSA. As there is no way of finding out if you or your business are under surveillance, people also have no option to go to the courts. The CJEU found that this violates the 'essence' of certain EU fundamental rights.

Schrems: "The Court clarified for a second time now that there is a clash between EU privacy law and US surveillance law. As the EU will not change its fundamental rights to please the NSA, the only way to overcome this clash is for the US to introduce solid privacy rights for all people – including foreigners. Surveillance reform thereby becomes crucial for the business interests of Silicon Valley."

canopic jug writes:

Ireland's Data Protection commissioner has ordered Facebook not to send any more personal data from Europe to the US. The regulator has the authority to fine Facebook up to 4% of its global turnover, should non-compliance be an issue.

The order, described to Independent.ie by people close to the situation as "well progressed", is the result of a European Court decision in July, which struck down the transatlantic 'Privacy Shield' treaty.

It means that the validity of 'standard contractual clauses' (SCCs) used by thousands of Irish and European companies to transfer data, is now closer to being cancelled.

However, the process is only about half over. The order is only preliminary, so far, and Facebook is doing what it can to appeal or subvert the ruling. The NYOB post links to three letters which provide background on the matter between Data Protection Commission and Facebook.

Previously:
(2020) CJEU Issues Judgment on Schrems II Case
(2018) Privacy Expert Schrems Files GDPR Complaints Against Google, Facebook, Instagram and WhatsApp
(2018) ICANN's Pre-Emptive Attack on the GDPR Thrown out by German Court
(2018) Facebook is Trying to Block Schrems II Privacy Referral to EU Top Court
(2015) EU Top Court Rules Safe Harbour Treaty Invalid

Original Submission