Facebook and Google could suffer as ECJ says US data transfer agreement does not protect European users
The European Court of Justice today said that the 'Safe Harbour' regime that allows US companies to transfer European users' personal data does not adequately protect the information.
The Safe Harbour agreement, in place since 2000, allows US firms like Google and Facebook to collect data on their European users and store it in the US as long as users are given adequate notice that it is being collected, as well as being told who can access it and how.
Advocate general Yves Bot said the current system was “invalid” as it failed to protect European citizen privacy, especially from the US security and surveillance services, and breached “fundamental rights of data protection.”
Activist lawyer Maximilian Schrems bought the case to the European data protection commissioner in 2014, arguing after launching a class action for 25,000 people against Facebook.
Now the advocate general has given his opinion to the ECJ a formal ruling will be made deciding the future of the Safe Harbour, which could cause problems for US firms. His opinion is not binding but tends to set the framework for a future ruling, and could spell a big change for the Facebook and its rivals.
Tanguy Van Overstraeten, global head of privacy and data protection at Magic Circle firm Linklaters said: “If the Court of Justice follows this opinion it will cause real headaches for many US businesses who are operating in the EU.
“The decision illustrates how privacy and data protection have become fundamental constitutional rights in the European Union.”