This article is from the source 'nytimes' and was first published or seen on . It last changed over 40 days ago and won't be checked again for changes.

You can find the current article at its original source at http://www.nytimes.com/2015/10/07/technology/european-union-us-data-collection.html

The article has changed 11 times. There is an RSS feed of changes available.

Version 0 Version 1
Data Transfer Pact Between U.S. and Europe Is Ruled Invalid Data Transfer Pact Between U.S. and Europe Is Ruled Invalid
(about 2 hours later)
Europe’s highest court ruled on Tuesday that a widely used international agreement for moving people’s digital data between the European Union and the United States was invalid.Europe’s highest court ruled on Tuesday that a widely used international agreement for moving people’s digital data between the European Union and the United States was invalid.
The decision, by the European Court of Justice, throws into doubt how global technology giants like Facebook and Google can collect, manage and analyze online information from their millions of users in the 28-member bloc. The court decreed that the data-transfer agreement was invalid as of Tuesday’s ruling. The decision, by the European Court of Justice, throws into doubt how seamlessly global technology giants — the likes of Amazon, Apple, Facebook and Google — can continue to collect, manage and analyze online information from their millions of users in the 28-member bloc. The court decreed that the data-transfer agreement was invalid as of Tuesday’s ruling.
The court is the highest legal authority in the European Union, and its decision cannot be appealed. It was not clear how companies would be able to immediately comply with the ruling. Although most big multinational companies and their lawyers have already secured side agreements with the European Union, which should allow them to continue moving data for now, the court’s ruling could hold significant implications down the road. It will empower data-privacy regulators in each of the bloc’s nations to evaluate how data is moved from their countries to the United States, and it will permit national authorities to impose tougher restrictions on specific data transfers.
In its ruling, the court said that the data-sharing agreement allowed American government authorities to gain routine access to Europeans’ online information. Such access infringes on Europeans’ rights to privacy established under the region’s tough data protection rules, the court said. Europe’s privacy watchdogs remain divided over how to police American tech companies. France and Germany, where companies like Facebook and Google have huge numbers of users and have already been subject to other privacy rulings, are among the countries that have sought more aggressive protections for their citizens’ personal data.
The European Court of Justice is the highest legal authority in the European Union, and its decision cannot be appealed.
In its ruling, the court said that the broad-based data-sharing agreement — known as Safe Harbor — was flawed because it allowed American government authorities to gain routine access to Europeans’ online information. Such access infringes on Europeans’ rights to privacy established under the region’s tough data protection rules, the court said.
“Legislation permitting the public authorities to have access on a generalized basis to the content of electronic communications must be regarded as compromising the essence of the fundamental right to respect for private life,” the European Court of Justice said in a statement on Tuesday.“Legislation permitting the public authorities to have access on a generalized basis to the content of electronic communications must be regarded as compromising the essence of the fundamental right to respect for private life,” the European Court of Justice said in a statement on Tuesday.
The legal decision is expected to be felt, in some degree, by any company that relies on trans-Atlantic transfers of data — whether in people’s online search habits or in employees’ payroll information. Many technology companies regularly move online data between regions to run their operations, particularly in support of online advertising, which is central to their business models. The legal decision is expected to be felt, in some degree, by any company that relies on trans-Atlantic transfers of data — whether in people’s online search habits or in employees’ payroll information. Many tech companies regularly move online data between regions to run their operations, particularly in support of online advertising, which is central to their business models.
The data-sharing agreement has been in place since 2000, enabling American technology companies to compile data generated by their European clients in web searches, social media posts and other online activities. “This is extremely bad news for E.U.-U.S. trade,” said Richard Cumbley, a tech lawyer at Linklaters in London. “Thousands of U.S. businesses rely on the Safe Harbor as a means of moving information. Without Safe Harbor, they will be scrambling to put replacement measures in place.”
Under the deal, called a safe harbor agreement, more than 4,000 European and American companies — both tech and nontech businesses — have been expected to treat the information moved outside the European Union with the same privacy protections the data had inside the region. The data-sharing agreement has been in place since 2000, enabling American tech companies to compile data generated by their European clients in web searches, social media posts and other online activities.
But European privacy campaigners have balked at those activities, contending that American data protection rules do not offer the same protections to individuals that are available in Europe. Under the deal, more than 4,000 European and American companies — both tech and nontech businesses — have been expected to treat the information moved outside the European Union with the same privacy protections the data had inside the region.
The United States government had lobbied aggressively in Brussels to keep the Safe Harbor agreement in place.
But European privacy campaigners have balked at those activities, contending that American rules do not offer the same data protections to individuals that as Europe’s.
In its ruling, the European court added that the region’s 500 million citizens did not have the right to bring legal cases in United States courts if they believed their privacy had been infringed by American companies or by the United States government. A bill to provide this legal recourse is being debated in Congress, though analysts said it was unlikely to become law before the American elections next year.
By mandating that companies can no longer move data about their European customers to the United States, the European Court of Justice said that national data protection regulators also had the right to review how these companies share data between regions. The national regulators could limit such data-sharing activities if they believed their citizens’ data could be used in ways not guaranteed under European law, the court said.By mandating that companies can no longer move data about their European customers to the United States, the European Court of Justice said that national data protection regulators also had the right to review how these companies share data between regions. The national regulators could limit such data-sharing activities if they believed their citizens’ data could be used in ways not guaranteed under European law, the court said.
In response, companies like Google and Facebook might now have to store the information solely within their European operations. Those two companies already operate data centers in Europe.In response, companies like Google and Facebook might now have to store the information solely within their European operations. Those two companies already operate data centers in Europe.
The ruling was foreshadowed two weeks ago, when an adviser to the court called the data pact insufficient. In anticipation of the ruling, many companies tasked teams of lawyers with figuring out how to continue their operations largely unimpeded. For large technology companies, other data transfer methods, including internal company agreements and clauses inserted into people’s terms and conditions, could allow them to continue moving data to the United States. The ruling was foreshadowed two weeks ago, when an adviser to the court called the data pact insufficient. In anticipation of the ruling, many companies tasked teams of lawyers with figuring out how to continue their operations largely unimpeded. For large tech companies, other data transfer methods, including internal company agreements and clauses inserted into terms and conditions of service, could allow them to continue moving data to the United States.
The implications of the ruling are unclear. Some privacy lawyers said that the court’s judgment could give national privacy watchdogs, particularly in countries like France and Germany, which have taken a hard line toward the N.S.A. revelations, greater say over who has access to their citizens’ data and to where that information can be sent. The implications of the ruling are unclear. Some privacy lawyers said that the court’s judgment could give national privacy watchdogs greater say over who has access to their citizens’ data and to where that information can be sent. A number of European data protection authorities, for example, have already started their own investigations into whether Facebook’s new terms and conditions violate national privacy rules. Privacy experts say such ad hoc investigations could now become more frequent.
“Companies may not be able to move people’s data until domestic data protection authorities give their approval,” said Marc Dautlich, a privacy lawyer at Pinsent Masons in London. “In some of Europe’s 28 countries, that is not going to be easy.”“Companies may not be able to move people’s data until domestic data protection authorities give their approval,” said Marc Dautlich, a privacy lawyer at Pinsent Masons in London. “In some of Europe’s 28 countries, that is not going to be easy.”
Smaller companies, though — with fewer legal resources to comply with Europe’s tough privacy rules — may not be able to respond quickly to the decision.Smaller companies, though — with fewer legal resources to comply with Europe’s tough privacy rules — may not be able to respond quickly to the decision.
The United States and the European Union have worked for roughly two years on reaching a new safe harbor agreement. The court’s ruling now puts pressure on negotiators to complete an agreement. The United States and the European Union have worked for roughly two years on a new Safe Harbor agreement. The court’s ruling now puts pressure on negotiators to complete an agreement.
Any new deal is expected to give Europeans greater say over how their online information is collected, transferred and managed by tech companies. But the talks have stalled over what type of access American intelligence agencies should be given to European data, according to several people with direct knowledge of the matter, who spoke on the condition of anonymity. Any new deal would be expected to give Europeans greater say over how their online information is collected, transferred and managed by tech companies. But the talks have stalled over what type of access to European data American intelligence agencies should be given, according to several people with direct knowledge of the matter, who spoke on the condition of anonymity.
The European Commission, the executive arm of the European Union that will be charged with carrying out the ruling, said it would hold a news conference in Brussels on Tuesday afternoon to discuss the ruling. The European Commission, the executive arm of the European Union that will be charged with carrying out the ruling, said it would hold a news conference in Brussels on Tuesday.
A spokeswoman for the United States mission to the European Union declined to comment on the court’s ruling. The United States Commerce Department is expected to issue a response later on Tuesday.
DigitalEurope, a trade body that represents many American tech companies, said on Tuesday that it was disappointed by the court’s decision, which the group said may harm consumers and companies by limiting how they can gain access to online services.
“We urgently call on the European Commission and the United States government to conclude their long-running negotiations to provide a new Safe Harbor agreement as soon as possible,” said Peter Olson, DigitalEurope’s president.
Before the court’s ruling, the United States mission to the European Union had criticized proposals to invalidate the trans-Atlantic data agreement, saying that it would jeopardize Europe’s business and diplomatic relations with other countries, including the United States.Before the court’s ruling, the United States mission to the European Union had criticized proposals to invalidate the trans-Atlantic data agreement, saying that it would jeopardize Europe’s business and diplomatic relations with other countries, including the United States.
The lengthy negotiations highlighted the different approaches to online data protection by the United States, where privacy is viewed as a consumer protection issue, and Europe, where it is almost on a par with such fundamental rights as freedom of expression.The lengthy negotiations highlighted the different approaches to online data protection by the United States, where privacy is viewed as a consumer protection issue, and Europe, where it is almost on a par with such fundamental rights as freedom of expression.
Those differences became more pronounced after Edward J. Snowden, a former contractor for the National Security Agency, revealed how American and British intelligence agencies had seemingly unfettered access to people’s online activities.Those differences became more pronounced after Edward J. Snowden, a former contractor for the National Security Agency, revealed how American and British intelligence agencies had seemingly unfettered access to people’s online activities.
“The United States safe harbor scheme thus enables interference, by United States public authorities, with the fundamental rights of persons,” the judges said in a statement on Tuesday, referring to access to European data by American intelligence agencies.“The United States safe harbor scheme thus enables interference, by United States public authorities, with the fundamental rights of persons,” the judges said in a statement on Tuesday, referring to access to European data by American intelligence agencies.
The case reviewed by the European Court of Justice related to a complaint brought by Max Schrems, a 27-year-old Austrian graduate student, who argued that Europeans’ online data was misused when Facebook was said to have cooperated with the N.S.A.’s Prism program.The case reviewed by the European Court of Justice related to a complaint brought by Max Schrems, a 27-year-old Austrian graduate student, who argued that Europeans’ online data was misused when Facebook was said to have cooperated with the N.S.A.’s Prism program.
That program is reported to have given the American agency significant access to data collected by several American technology companies, including Facebook and Google. That program is reported to have given the American agency significant access to data collected by several American tech companies, including Facebook and Google.
Mr. Schrems, who is pursuing a separate civil class-action lawsuit against Facebook in an Austrian court, said the N.S.A.’s access to information about Facebook’s users in Europe broke the region’s privacy rules. He has also argued that the data-sharing agreement between Europe and the United States does not give Europeans sufficient recourse if their data is misused by companies or national governments.Mr. Schrems, who is pursuing a separate civil class-action lawsuit against Facebook in an Austrian court, said the N.S.A.’s access to information about Facebook’s users in Europe broke the region’s privacy rules. He has also argued that the data-sharing agreement between Europe and the United States does not give Europeans sufficient recourse if their data is misused by companies or national governments.
Facebook denies that the United States government had unlimited access to its users’ data.Facebook denies that the United States government had unlimited access to its users’ data.
“The U.S. is miles away from the privacy laws we have in Europe,” Mr. Schrems said in an interview before the court’s decision. “There’s been so much talk about the N.S.A. surveillance program. It would be cool if we finally saw some consequences from it.” “This judgment draws a clear line. It clarifies that mass surveillance violates our fundamental rights,” Mr. Schrems said in a statement released on Tuesday. “Governments and businesses cannot simply ignore our fundamental right to privacy, but must abide by the law and enforce it.”