It’s a question that affects millions of people in Europe: what happens to all the data that Google, Amazon, Facebook and other American tech companies collect on the continent? Can they be transferred to the US? And are they protected there from arbitrary access by the many three-letter security agencies – CIA, NSA, FBI, for example?
The EU thinks yes. This week, the Commission approved the so-called Data Privacy Framework. It’s a deal that will enable the free flow of personal data across the Atlantic. America’s online platforms are thus allowed to store the information of European users on their home servers.
The European Court of Justice (ECJ) had declared the two predecessors of this agreement – Privacy Shield and Safe Harbor – invalid. Will attempt number three succeed? One should be skeptical.
also read
The Austrian lawyer Max Schrems brought down Privacy Shield and Safe Harbor. Now he also wants to sue the Data Privacy Framework, as he tells WELT. “We already have various legal options in the drawer,” says Schrems. He assumes that the case will end up before the ECJ early next year.
also read
The judges could suspend the new data agreement between Brussels and Washington for the duration of the proceedings. America’s tech giants would then have a problem. They keep emphasizing that doing business in the EU is only worthwhile if they are allowed to process the information of Internet users in the United States.
Some time ago, Facebook even threatened to leave Europe if it were no longer allowed to send data home. But that was probably a PR stunt; an attempt to put pressure on the Commission.
US tech in Europe is at stake
The earlier judgments of the ECJ are known as Schrems I and Schrems II. Schrems III should soon follow. And once again, a lot is at stake. In the end, the future of American tech companies in Europe and the privacy of EU citizens are at stake. Brussels and Washington have been negotiating for the new agreement for three years. It could have been in vain if the ECJ took the same view as Schrems.
“They say the definition of insanity is doing the same thing over and over again and expecting a different result,” says Schrems. The Data Privacy Framework is a copy of Privacy Shield. And Privacy Shield, in turn, is a copy of Safe Harbor. “The latest agreement is not based on material changes,” said Schrems, “but on short-term political thinking.”
also read
In 2015, the ECJ first declared Safe Harbor invalid, followed by the successor Privacy Shield in 2020. The promises of both agreements sounded good every time: a safe haven for personal data and a protective shield for privacy. But the reality was different.
The agreements, the judges found, did not adequately protect Europeans’ data. Above all, the ECJ criticized the fact that American secret services can siphon off masses of information without suspicion.
For the lawyer Max Schrems, the third data protection agreement with the USA is not sufficient either
Those: picture alliance/dpa/APA
Now, in deal number three, Brussels has certified that the US has “adequate” data protection. By this it is meant that the level of protection in the United States corresponds to European standards. According to the Commission, American secret services should only tap information from EU citizens if it is necessary for national security and proportionate.
New court for lawsuits in the USA
Schrems doesn’t see it that way. He thinks the US secret services still have too much access to Europeans’ data. They could continue to spy on people in Germany, Austria and other EU countries, just like that, without concrete suspicion or judicial approval. America, says Schrems, will give the word “proportionate” a different meaning than the ECJ.
Schrems is not alone in this assessment. A report by the European Parliament also states that the USA cannot be accorded any adequacy in terms of data protection. The level of protection in America still lags behind EU standards. The new deal also allows for the mass collection of personal data and does not adequately secure the privacy of Europeans. However, Parliament’s approval is not required for the agreement.
also read
EU Justice Commissioner Didier Reynders defended the Data Privacy Framework this week. He was confident that the agreement would stand up to scrutiny by the ECJ this time. Because it differs significantly from Privacy Shield and Safe Harbor, said Reynders.
For example, a new court will be created that will allow Europeans to sue in the US if they believe their data has not been tapped in a “proportionate” manner. Whether that is sufficient for the ECJ remains to be seen.
You can listen to our WELT podcasts here
In order to display embedded content, your revocable consent to the transmission and processing of personal data is required, since the providers of the embedded content as third-party providers require this consent [In diesem Zusammenhang können auch Nutzungsprofile (u.a. auf Basis von Cookie-IDs) gebildet und angereichert werden, auch außerhalb des EWR]. By setting the switch to “on”, you agree to this (which can be revoked at any time). This also includes your consent to the transfer of certain personal data to third countries, including the USA, in accordance with Art. 49 (1) (a) GDPR. You can find more information about this. You can withdraw your consent at any time via the switch and via privacy at the bottom of the page.
“Everything on shares” is the daily stock exchange shot from the WELT business editorial team. Every morning from 5 a.m. with the financial journalists from WELT. For stock market experts and beginners. Subscribe to the podcast at Spotify, Apple Podcast, Amazon Music and Deezer. Or directly via RSS feed.