Europe’s highest court on Tuesday struck down a key legal principle that had enabled U.S. web giants to operate in the European Union and store and manipulate the personal data of people living there. The ruling could have far-reaching consequences for trans-Atlantic web businesses.
In his case brought against Facebook, Max Schrems, an Austrian law-student-turned-lawyer, challenged the social network’s practice of storing and processing personal data, which, he successfully argued, had violated European privacy law.
The Luxembourg-based court agreed, invalidating Safe Harbor, a fast-track legal method used by U.S. web businesses to comply with European privacy restrictions since the 1990s.
Under Safe Harbor, companies promised that the private data of E.U. citizens would be handled in the United States under the same privacy rules that apply in Europe.
But Mr. Schrems, who currently studies at the University of Vienna, challenged this fundamental guarantee of Safe Harbor, illustrating in minute detail how Facebook had collected, stored and manipulated his own personal data in violation of Austrian and E.U. law.
Experts said the immediate fallout from the European court’s ruling would be minimal and websites such as Facebook and Google would continue to operate. But over the long-term, U.S. tech giants such as Facebook and Google may have to reassess and revise how they store and transfer E.U. data.
“The Court of Justice declares that the Commission’s U.S. Safe Harbor Decision is invalid,” the court said in its decision, leaving no room for doubt. Legal experts said lawmakers on both sides of the Atlantic would be pressured to draft a new legal regime to ensure the trans-Atlantic flow of data.
Some analysts said new legal frameworks that are eventually developed for web businesses may be more costly and less efficient than Safe Harbor. The court ruling will likely have repercussions for many of the E.U.’s 500 million residents, who like Americans tend to favor U.S. web businesses such as Google, Facebook and Amazon for their online needs.
In a statement given to Handelsblatt Global Edition, Facebook said that it “like many thousands of European companies, relies on a number of the methods prescribed by E.U. law to legally transfer data to the U.S. from Europe, aside from Safe Harbor.”
“It is imperative that E.U. and U.S. governments ensure that they continue to provide reliable methods for lawful data transfers and resolve any issues relating to national security.”
Andreas Splittgerber, a Munich lawyer at Olswang who specializes in technology, told Handelsblatt Global Edition said the court’s verdict was unusually strong.
“The ruling has really smashed into the face of the U.S. and everyone who is exporting data to the U.S.,” he said.
“Safe Harbor is dead. This puts a lot of pressure on the (European) Commission, the Federal Trade Commission, and the U.S. government to agree on a new Safe Harbor.”
To continue reading this story, click here to go to Handelsblatt's Global Edition.