A higher European court ruled Thursday that companies that transfer personal data of EU users to other jurisdictions will have to provide the same protections granted within the bloc.
The ruling could affect how companies transfer data from European users to the United States and other countries, such as the United Kingdom.
The legal battle began in 2013, when privacy activist Max Schrems filed a complaint with the Irish Data Protection Commissioner. He argued that In light of Edward Snowden’s disclosures, US law did not offer sufficient protection against surveillance by public authorities.
Schrems filed the complaint against the social network Facebook that, like many other companies, was transferring their data and those of other users to the United States.
It reached the Court of Justice of the European Communities (ECJ), which in 2015 ruled that the then Safe Harbor Agreement, which allowed the transfer of data from European users to the US, was invalid and did not adequately protect European citizens.
As a result, companies operating in Europe switched to Standard Contractual Clauses, or SCCs, ensuring that they could still move data across the Atlantic. Meanwhile, the European Union and the United States developed a new agreement, the Privacy Shield framework, to replace the Safe Harbor agreement.
The ECJ ruled Thursday that these SCCs were a valid way to transfer data, but invalidated the use of the Privacy Shield framework.
In practical terms, this means that non-EU countries, or companies seeking to move European user data abroad, must guarantee a level of protection equivalent to strict European data laws.
“With respect to the level of protection required with respect to said transfer, the Court maintains that the requirements established for such purposes by the GDPR (General Data Protection Regulation) with respect to the appropriate guarantees, enforceable rights and effective legal remedies should be interpreted as meaning that data subjects whose personal data is transferred to a third country in accordance with standard data protection clauses must have a level of protection essentially equivalent to that guaranteed in the EU by the GDPR, “said the court on Thursday.
The GDPR regulation, introduced in 2018, has allowed European users to have a greater voice on how companies use their information.
“In these circumstances, the Court specifies that the assessment of this level of protection must take into account both the contractual clauses agreed between the data exporter established in the EU and the recipient of the transfer established in the third country in question and, in Regarding any access by the public authorities of that third country to the transferred data, the relevant aspects of the legal system of that third country, “added the court.
A new trade war?
Jonathan Kewley, co-chief technology officer for the law firm Clifford Chance, said the decision is a “bold move by Europe.”
“What we are seeing here looks suspiciously like a privacy trade war, where Europe says its data standards can be trusted, but those in the US. No. We can predict that the result could be further localization of data from Europe, with more data from customers hosted Europe as a result, “he added.
In addition to creating more tension between the United States and Europe, the ruling has consequences for many large companies.
Tanguy Van Overstraeten, a partner at the Linklaters law firm, said: “This is less beneficial to companies than meets the eye. Large companies have complex networks of data transfers to hundreds, if not thousands, of recipients abroad. The (ECJ) has made it clear companies cannot justify them using a ‘check box’ exercise to set SCCs in place. Instead, the risks associated with those transfers need to be properly assessed. “
“Similarly, this may encourage data protection regulators to repress international transfers more aggressively, with the possibility that transfers to jurisdictions with strong powers of state oversight become increasingly difficult,” he added.
.
