The EU’s highest court could change how data on Europeans held by US companies like Facebook is handled and accessed by security services.
The European Court of Justice has begun hearing the case of Austrian law student Max Schrems, who raised concerns with Facebook in 2011 over how data wasn’t being handled in accordance with European privacy laws.
The current ‘Europe vs Facebook’ lawsuit will eventually rule on whether the current ‘Safe Harbour’ agreement between the EU and the US needs to be revised. Safe Harbour, signed in 1999, is criticised in the case for not properly ensuring that data on European citizens is properly safeguarded once it reaches the States, meaning there’s nothing to stop information from being collected by non-EU intelligence services.
The agreement covers all US-based companies that do business within the EU, which means Google, Yahoo, Skype and several others could potentially be subjected to a new, more robust agreement.
Schrems’ assertion is that data isn’t being handled securely while it is being exported from Europe to the United States, which contravenes European law, and given the fact that Facebook’s European headquarters is in Dublin, he believes the company should fall under the jurisdiction of the EU.
The law states that the export of data is only legal if the country or territory handling it can ensure “an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.”
The Austrian’s initial complaint, made to the Irish High Court, wasn’t pursued as it was supposedly covered by the “Safe Harbour” agreement, signed by both the EU and US, which pledges to protect the private data of EU citizens.
Schrems wasn’t satisfied by the Irish High Court’s decision, however, and opted to bring the case before the highest court in the land, seeking the end of the “Safe Harbour” deal and a full audit of the current exchange of information by the Irish Data Protection Commission.
If the case is successful, it would see companies, such as Google, Twitter and Facebook, forced to build costly European data centres, in order to comply with any potential ruling.
The CJEU’s Advocate General, Yves Bot, is expected to publish his opinion on the case on June 24 2015, ahead of a full and final ruling, which is likely to come in October.
Leave a Reply