European justice has invalidated Thursday, July 16 a crucial mechanism for the transfer of personal data between the European Union and the United States, called "Privacy Shield", because of the risk posed by American surveillance programs on the protection of those data.
This decision was greeted as a victory by Austrian lawyer Max Schrems, a figure in the fight for data protection, who was behind the case via a complaint against Facebook.
"After a first reading of the judgment on the Privacy Shield, it seems that we have won 100% - for our private life", wrote on Twitter one who had made himself known by already canceling in 2015 a similar agreement between the EU and the United States.
After a first read of the judgment on #PrivacyShield it seems we scored a 100% win - for our privacy
The US will have to engage in serious surveillance reform to get back to a "privileged" status for US companies.
More details here: https://t.co/t7LFgE7LmT#ThanksToEveryone!
"The United States will have to initiate a serious surveillance reform to return to a 'privileged' status for American companies" allowing them to transfer data, he added.
"Interference with fundamental rights"
The Court of Justice of the EU (CJEU) finds in its judgment that the Privacy Shield makes "possible interferences in the fundamental rights of the people whose data are transferred" towards the United States, because the American public authorities can there access, without this being limited to what is strictly necessary.
"This decision creates legal uncertainty for the thousands of small and large companies on both sides of the Atlantic who rely on the Privacy Shield for their daily transfer of commercial data," responded Alexandre Roure, of the CCIA, the lobby of the giants of tech in Brussels.
"We hope that European and American decision-makers will quickly develop a durable solution, in accordance with European law, to guarantee the continuation of data flows," he added.
Data transfer possible under conditions
The CJEU, on the other hand, considered valid another mechanism allowing the transfer of data from the EU to the rest of the world: standard contractual clauses, a model contract defined by the European Commission, which any company can use to export its data, for example to a subsidiary, its parent company or a third party.
Companies affected by the Privacy Shield decision should refer to this mechanism.
The European Commissioner for Justice, Didier Reynders, had assured before the decision that the Commission had already anticipated several "scenarios".
"Depending on the content of the decision, we will see what tools - already prepared - to use to both consolidate fundamental rights and verify that the protection given by the EU travels with the data," he explained to AFP.
"The ambition is to react together (...) on the European side as on the American side," he said.
The personal data concerned (online behavior, geolocation ...) constitute "the gold mine" of the digital economy, in particular for giants like Google, Facebook or Amazon.
The invalidation of the Privacy Shield constitutes a new disavowal for Brussels after the cancellation on Wednesday of its decision requiring Apple to reimburse 13 billion euros, previously considered as improper tax advantages.
With AFP
The France 24 week summary invites you to come back to the news that marked the week
I subscribeTake international news everywhere with you! Download the France 24 app
google-play-badge_FR