EU-US data sharing may represent a breach to privacy rights

The final verdict on this case could have far-reaching consequences for EU-US diplomatic and trade relations, as well as ongoing talks on a transatlantic free-trade agreement.

If the court follows its advocate general, it could also mean radical change for how the Irish DPC supervises US high-tech multinationals based in Ireland, including Facebook.

Under close questioning by the court in March, however, the European Commission conceded that it cannot guarantee EU citizens’ fundamental right to privacy when their data is transferred to the US under ‘Safe Harbour’. Counsel for the EU executive added that the US was under no legal obligation to meet European privacy standards, nor did Brussels have any means of insisting that it did so via 15-year-old ‘Safe Harbour’ provisions.

In his assessment, the advocate general criticised the commission for not examining how the Safe Harbour provisions were implemented in practice, and for allowing data transfers to continue while it negotiated new data transfer rules with US authorities.

Permitting EU citizen data to be fed into US mass surveillance systems contradicted both the standards of the EU’s own data protection directive and the EU Charter of Fundamental Rights.

The advocate general also called for greater rights for national data protection commissioners to investigate complaints by EU citizens that their data protection and privacy rights are being breached.