EU court declares Safe Harbour decision invalid

The Safe Harbour deal was made between the EU and the US in 2000 to provide an easier, more cost-effective way for US firms to transfer data from the EU without breaking its rules: the EU does not allow data to be transferred to and processed in parts of the world that do not provide adequate privacy protections.

Safe Harbour was intended as a way of allowing US firms to self-certify that they were carrying out the necessary steps.

But the ECJ has now declared, following a complaint by Austrian Maximillian Schrems, that the deal is ‘invalid’. Schrems’ complaint was against the Irish supervisory authority (the Data Protection Commissioner) with regard to the transfer of data from Facebook’s Irish subsidiary to servers located in the US. He claimed that in light of Edward Snowden’s revelations against the NSA that “the law and practice of the United States do not offer sufficient protection against surveillance by the public authorities of the data transferred to that country”. The Commission had rejected the complaint on the grounds that under the Safe Harbour scheme, the US does ensure an adequate level of protection.

The ruling concluded: “This judgment has the consequence that the Irish supervisory authority is required to examine Mr Schrems’ complaint with all due diligence and, at the conclusion of its investigation, is to decide whether, pursuant to the directive, transfer of the data of Facebook’s European subscribers to the United States should be suspended on the ground that that country does not afford an adequate level of protection of personal data.”