BRUSSELS (Reuters) - A U.S.-EU commercial data-sharing deal faces a major test on Wednesday when an adviser to the European Union’s top court will say whether he believes it is still binding in light of allegations of mass U.S. spying.
The case stems from a complaint filed by 27-year-old Austrian law student Max Schrems against Facebook with the Irish data protection commissioner, who monitors compliance with privacy laws.
Schrems argued the company helped the U.S. National Security Agency (NSA) harvest email and other private data from European citizens by forwarding data to servers in the United States and asked the Irish watchdog to investigate whether the United States was providing adequate data protection.
The Irish regulator rejected the request on the grounds that it was bound by the EU Safe Harbour agreement of 2000 which allows companies to transfer EU citizens’ data to the United States because it is held to have sufficient privacy safeguards in place.
The Irish watchdog plays a central role because Facebook users in the EU enter an agreement with Facebook Ireland when they join the social network.
Schrems, who still uses Facebook and says he wants to improve it, appealed the decision in October 2013. Irish High Court Justice Gerard Hogan subsequently asked the European Court of Justice (ECJ) if the Irish regulator was still bound to follow the Safe Harbour decision given “gaping holes in contemporary U.S. data protection practice” and whether it could or should conduct its own investigation in light of allegations of mass U.S. surveillance programs.
Safe Harbour, which simplifies the everyday business of some 4,000 companies, came under fire in 2013 after fugitive ex-NSA contractor Edward Snowden leaked details of a U.S. mass electronic surveillance program, known as Prism.
The leaks showed the NSA used major web companies, including Apple, Google, Facebook and Microsoft, to gather user data.
Following the fallout the European Commission called for a review of the agreement and negotiations with Washington have been going on since January 2014.
Wednesday’s opinion to judges, who are expected to rule in a few months’ time, comes at a delicate time for the renegotiation of Safe Harbour.
“It could have an impact on the whole Safe Harbour system as a transfer solution,” said Tanguy Van Overstraeten, a partner specializing in data protection at law firm Linklaters.
ECJ Advocate General Yves Bot will deliver his opinion in Luxembourg on Wednesday at around 0930 CET. While the court’s judges are not bound by the opinion, they follow it in most cases.
“If the judges come to the situation where Safe Harbour is not valid then it could be reopening the whole story and that, for many thousands of U.S. companies, would be very difficult because that could mean that in fact the basis of the transfer of data by them would be invalid,” Van Overstraeten said.
Facebook declined comment.
Additional reporting by Georgina Prodhan in Frankfurt; editing by Philip Blenkinsop and Adrian Croft