EU regulators offer temporary reprieve on transatlantic data transfers

Europe’s privacy regulators said Wednesday that they will postpone a crackdown on transatlantic data transfers until they have reviewed the details of an eleventh-hour agreement struck this week, The Wall Street Journal reported Wednesday.

{mosads}“We are going to wait, but not too long,” said Isabelle Falque-Pierrotin, head of France’s data protection authority and chairwoman of a working group of the European Union’s 28 data protection authorities. “We have to see what is provided by the United States in terms of commitments.”

She said the group wants to review the documents by the end of this month and could make a decision as early as the end of March, according to the Journal.

The European Commission and the U.S. Department of Commerce on Tuesday brokered a deal that will permit Facebook, Google and thousands of other companies in various sectors to legally handle European citizens’ personal data.

The so-called EU-U.S. Privacy Shield replaces a similar pact brokered in 2000 that the EU high court struck down in October, claiming that the U.S. could not be seen to adequately protect privacy thanks to its mass surveillance practices.

The two governments had been rushing to craft a replacement, with Europe’s privacy regulators vowing to begin enforcement action this week.

While the over 4,000 businesses that had relied on the original pact may breathe a sigh of relief, the reprieve could be only temporary. Critics have long warned that the regulators may not accept any deal that Commerce and the commission struck.

Many say unless the U.S. undertakes a systemic overhaul of its privacy laws, there is no legal framework that can satisfactorily protect the personal data of European citizens — for whom privacy is a fundamental right under the EU Charter.

“We don’t know the exact legal structure yet, but this could amount to obviously disregarding the Court’s judgement,” said Max Schrems, the privacy advocate whose privacy complaint against Facebook ultimately brought down the original agreement.

The commission insisted yesterday that the Privacy Shield adequately protects EU citizens from surveillance by U.S. intelligence agencies.

“The U.S. has clarified that they do not carry out indiscriminate surveillance of Europeans,” Andrus Ansip, Vice President for the Digital Single Market on the European Commission, said Tuesday.

He cited “detailed written assurances by U.S. on the safeguards and limitations by surveillance” in the new agreement.

But some onlookers worry that the regulators’ working group will still struggle to reach a consensus on what transfer mechanisms adequately protect individual privacy — including the Shield — ultimately creating a patchwork of enforcement.

Although the group promised to take no collective action until it has reviewed the agreement, some countries’ watchdogs had already taken steps towards tightening regulations.  

In Germany, regulators announced an investigation into data transfers from companies such as Google and Facebook immediately following the high court’s decision.

“Anyone who wants to remain untouched by the legal and political implications of the judgment, should in the future consider storing personal data only on servers within the European Union,” Hamburg’s Data Protection Officer Johannes Caspar told the German magazine Der Spiegel.

Germany is seen as one of the toughest nations on privacy in the EU.

Supporters say adoption of the new deal — still contingent on approval from the 28 EU members states — is necessary to prevent a potentially catastrophic disruption to transatlantic trade.

But in the meantime, companies have a few more months to put alternative transfer mechanisms in place, in the event that the working group does decide the new Privacy Shield doesn’t fulfill the high court’s ruling.

“We want to receive documents in order to assess whether the Privacy Shield can answer the privacy concerns raised,” Falque-Pierrotin said, according to Reuters.