Share This Article
The Advocate General of the European Court of Justice Yves Bot issued his opinion on the Facebook case raising concerns on the adequacy of the Safe Harbor privacy principles for the transfer of personal data to the United States leading to considerable issues for not only social media, but for any business.
The facts of the case
The opinion of the Advocate General of the European Court of Justice is based on a complaint lodged by Mr. Maximilian Schrems, a Facebook user, before the Irish data protection authority. The Austrian citizen challenged the fact that Facebook transfers its EU subscribers’ personal data from the servers located in Ireland to the US company, which is “Safe Harbor” certified. The Irish privacy authority dismissed the complaint in light of the fact that transfer of personal data is only allowed in case the receiving country ensures an adequate level of protection, which was recognized to the US companies like Facebook that had committed to comply with the Safe Harbor principles.
Mr. Schrems was not happy with the position taken by the Irish data protection authority and escalated the matter to the High Court, which then invited the European Court of Justice to clarify whether a Commission decision (such the one upholding the Safe Harbor principles) has the effect of preventing a national supervisory authority from investigating complaints alleging that the third country does not ensure an adequate level of protection and from suspending the contested transfer of data.
What are the Safe Harbor principles?
The Safe Harbor principles are a framework of principles aimed at ensuring the compliance of US companies with the European Union standard of protection of personal data. They were approved by the EU Commission which deemed that US companies committing to such principles were offering an adequate level of protection to personal data and for instance no consent from individuals would be necessary in order to allow such data transfer.
The position on Safe Harbor privacy principles
The Advocate General in his opinion held that the power of investigation of national supervisory authorities’ shall remain intact and the supervisory authorities are therefore entitled to suspend the transfer of the personal data to the US, irrespective of the general assessment made by the Commission whose decision is, per the Advocate General position, dated.
The Advocate General stressed the importance of the national supervisory authorities independence and, considering the Safe Harbor scheme invalid, requested the Commission to rethink the cross border transfer of personal data to the US entering into negotiations with the US.
What are the consequences of the opinion?
The opinion itself has no consequences as it is not binding on the European Court of Justice which might take a completely different view. However, should the European Court of Justice follow this position the impact on businesses could be relevant. In fact, the companies adhering to the scheme are more than 5,000, including almost all the major multinational companies.
Should the position of the Advocate General be confirmed, these companies would have to find another legal basis to transfer data from the EU to the US e.g. by way of the Binding Corporate Rules or Standard Contractual Clauses. And the adoption of such measures will not exempt the receiver of the data to ensure a high level of protection to personal data through for instance a privacy by design approach. Also, if the national supervisory authorities are recognized the power to investigated and suspend the transfer of personal data irrespective of the Commission decision, the EU framework might result particularly fragmented. And this happens during a crucial time for technologies relying on the usage of personal data such as big data and Internet of Things devices.
With regard to Italy, the Italian DPA has never challenged the consistency of the Safe Harbor Commission decision, however if the decision of the European Court of Justice follows the opinion of the Advocate General the whole business between the EU and the US might be considerably disrupted not only for social media, but for any company whose business is based on the processing of personal data which includes almost any company in the world.
