So. Are Europeans just a whining bunch of data protection hypocrites?
'We’re fixing oversight. When will you?' - USA
Analysis Does this week’s Safe Harbour 2.0 restore confidence in US-European data flows - or does it change absolutely nothing? Either way, the European Court needs to produce better argued and more robust judgements, reckons one of the UK’s top data protection experts, Dr Ian Walden, a Professor of Information and Communications Law at Queen’s Mary’s.
Walden, who has worked with several European institutions advising them on legal freeform, says in recent cases the CJEU, Europe’s "Supreme Court" produced popular verdicts that were poorly argued - and the ruling for privacy campaigner Max Schrems in the 'Facebook' suit against the DPA was an example. He adds that US oversight of data will be better than what some European member states can offer their own citizens.
It invites charges of hypocrisy which Walden thinks are justified, because not every EU member state has Swiss levels of data protection and oversight. And it also sort of raises the question: "When will you stop pointing the finger at the USA, and sort out your own mess?" Impatience with what Americans regard as posturing was evident when a senior Texan senator successfully tacked amendments onto the Judicial Redress Act last week, inhibiting Europeans' ability to sue the United States government.
Privacy Shield – a hollow win?
On Monday, negotiators declared victory in agreeing on a successor to the Safe Harbour legal agreements that the CJEU had ruled unsafe in October in the Schrems case. The privacy activist had doubted whether Facebook was a safe custodian of his personal data, because that data was transferred to the United States. The Irish DPA had refused to consider this question, and Schrems took the DPA to the European Court, which sided with Schrems. That effectively invalidated the 2001 legal arrangement between the USA and Europe, knows as the Safe Harbour agreement.
With “Privacy Shield”, Europe’s robo-Commissioner Andreas Ansip claimed that “[o]ur people can be sure that their personal data is fully protected,” but few share his confidence; the deal has hurdles to pass before becoming law, and even then will face legal scrutiny.
The Article 29 Working Party (WP29), the committee of national data protection authorities, says it hasn’t even seen the small print yet, and wants to see them by the end of this month. (pdf)
Walden opined that the CJEU in the Schrems case had failed to analyse the legal framework the US uses to govern its law enforcement agencies' access to personal data, and “simply took what was published in the newspapers by Edward Snowden" and didn't proceed to a full legal analysis of his allegations. This isn’t saying Snowden is wrong, he points out, merely that the supporting analysis of the US legal framework that should have been there was entirely missing from the CJEU Schrems decision.
“If we’re to have a ‘Supreme Court’, it has to have an outstanding obligation to make law rigorously, thoughtfully and thoroughly.” In his opinion, it didn’t do so in the 2014 Data Retention decision, or in Schrems (pdf).
There’s another aspect that’s overlooked too, he notes. The Court has no competency over national security: no European institution does. It’s left to the EU’s member states.
There are signs the US thinks Europe is being deliberately provocative or protectionist, and is retaliating economically.
The US has two measures designed provide oversight of data access in the US: the USA Freedom Act 2015 and the Judicial Redress Act 2014 (HR 1428), providing civil remedies for Europeans. While HR.1428 isn’t yet law, Walden thinks it provides better oversight than many Europeans already enjoy. You can request to see data being used by US law enforcement, amend that data, and even sue the US government.
That’s better than what many European countries offer their own citizens. But some US politicians are getting tired of being singled out by the Europeans, and the Texan Republican senator John Cornyn threw in amendments that restricted the ability of Europeans to sue Uncle Sam.
One European security expert told us the Safe Harbour successor didn’t assure him: “I’m not impressed, but it’s going to be the best we can get without starting a trade war with the USA. This is a classic model of American negotiations: give us what we want, or we’ll impose import duties.”
Europe won a significant increase in American defence spending this week, which was not a complete coincidence, he thought.
“We’re in a deadlock,” says Walden. “This has left the realm of law and is now in the realm of politics.” ®