The European Court of Justice, Europe’s highest court, has just ruled that the Safe Harbor, an arrangement between the European Union and the United States allowing for the transfer of personal data, is legally invalid. Few non-specialists have heard of the Safe Harbor. Even so, this ruling is going to send shock waves through both Europe and the United States. Here’s how it happened (we talk about the implications in a separate post).
The Safe Harbor is the cornerstone of transatlantic e-commerce
Over the last 15 years, major U.S. e-commerce firms, such as Facebook, Google, Microsoft and Amazon, have developed big markets in Europe. They all rely on an arrangement called “Safe Harbor” to export personal data from Europe to the United States. The Safe Harbor was negotiated between Europe and the United States after a previous transatlantic dispute in which Europe threatened to stop transatlantic data flows. Europe has comprehensive legislation guaranteeing the privacy of E.U. citizens and preventing businesses from using their personal information in various potentially harmful ways. The United States does not have comprehensive privacy legislation (although it does protect the data of U.S. citizens against government intrusions, and provides some protections, e.g. for health data).
In the 1990s, European officials feared that businesses could take data on E.U. citizens out of Europe, and do whatever they wanted with it abroad. They tried to push the United States to introduce new laws protecting the information of European citizens. The United States wasn’t willing to do this. However, after difficult negotiations (which one of us describes here), they came up with a compromise: the Safe Harbor. Businesses that want to export data can commit to the “principles” of the Safe Harbor, which are watered down versions of European privacy law. If they break their commitments, they may be liable to sanctions from a self-regulatory organization or the Federal Trade Commission.
This complex arrangement has not worked nearly as well as people hoped. It was already being renegotiated by the European Union and the United States. The new court decision has fundamental consequences. It not only invalidates Safe Harbor, but makes it clear that any new arrangement has to be fundamentally different from the old one. It not only has to protect European citizens better against U.S. e-commerce firms, but has to protect them against the U.S. state.
Read the full piece at The Washington Post.
- Publication Type:Other Writing
- Publication Date:10/06/2015