The European Union’s top court on Tuesday declared a data-sharing agreement with the United States invalid, arguing that it does not sufficiently protect the rights of EU citizens, in a case that could have significant consequences for the internet industry.
The case was brought by Austrian activist Max Schrems against the Irish data protection authority after it rejected his complaint over Facebook’s practice of storing user data in the United States. The European Court of Justice was asked to weigh in on the matter.
Schrems argued that US laws offer no real data protection, based on revelations in 2013 that Washington had carried out mass spying.
At issue is the Safe Harbor system, which has been in place for more than a decade to allow companies in the EU and US to exchange data, and specifying how US companies can handle the private data of European citizens.
The Luxembourg-based judges found that Safe Harbor does not offer adequate protection to EU citizens, despite arguments by the European Commission to the contrary.
“National security, public interest and law enforcement requirements of the US prevail over the Safe Harbor scheme,” the court said in a statement.
“US undertakings are bound to disregard, without limitation, the protective rules laid down by that scheme where they conflict with such requirements,” it added.
It also criticized the absence of channels for individuals to take legal action if their personal data is accessed, arguing that this “compromises the essence of the fundamental right to effective judicial protection.”
The Irish supervisors must now assess whether or not to suspend the transfer of European Facebook users’ data to the US in the case at hand, the court ruled. Facebook’s European operations are based in Ireland.
Safe Harbor was established in 2000, after the commission prohibited the transfer of data to non-European countries that did not adhere to stringent criteria.
Tuesday’s ruling follows the advice of an influential advisor to the court, Advocate General Yves Bot.
Ahead of the ruling, US officials had argued that Bot’s assessment was based on inaccurate assertions about Washington’s surveillance practices, arguing that access to private data is not unrestricted and is governed by stringent laws.
The decision could affect US internet giants such as Facebook and Google by making it harder for them to store the private data of EU citizens.
More than 4,400 companies rely on Safe Harbor “to transfer data necessary to support trans-Atlantic trade, the digital economy and jobs in both the EU and the US,” Robert Litt, the general counsel in the Office of the Director of National Intelligence, wrote in a guest article for the Financial Times on Monday.