Luxembourg (AFP)
Defenders of individual freedoms declared victory Thursday after the invalidation by the European justice of a crucial mechanism of transfer of personal data on line between the EU and the United States, considered too unprotective vis-a-vis the American programs of surveillance.
This eagerly awaited decision will weaken companies operating in the EU that transfer or host data across the Atlantic, now plunged into legal uncertainty.
It was applauded by Austrian lawyer Max Schrems, a figure in the fight for data protection, who was behind the case via a complaint against Facebook.
"It seems that the Court has followed us on all aspects", reacted the one who had made himself known by already obtaining the resounding cancellation, in 2015, of a similar agreement between the EU and the United States.
"It is clear that the United States will have to make serious changes to its surveillance laws if American companies are to continue to play a major role in the European market," he added.
The Court of Justice of the EU (CJEU) considers in its judgment that the EU-USA agreement - dubbed "Privacy Shield" (editor's note) - makes "possible interferences in the fundamental rights of the people whose the data is transferred ", because the American public authorities can have access to it, without it being limited" to what is strictly necessary ".
It also points out that these regulations do not provide "guarantees for potentially affected non-American persons", nor do they offer them "rights enforceable against American authorities before the courts".
- "Legal uncertainty" -
"This decision creates legal uncertainty for the thousands of small and large companies on both sides of the Atlantic," said Alexandre Roure, of the CCIA, the lobby of tech giants in Brussels.
The European Commissioner for Justice, Didier Reynders, had assured before the decision that the Commission had already prepared several "scenarios".
"Depending on the content of the decision, we will see what tools - already prepared - to use to both consolidate fundamental rights and verify that the protection given by the EU travels with the data," he explained to AFP.
"The ambition is to react together (...) on the European side as on the American side," he said.
The 5,000 American companies - 70% of which are SMEs - that use the "Privacy Shield" could quickly fall back on another mechanism allowing the transfer of data from the EU to the rest of the world: the "standard contractual clauses".
It is a model contract defined by the European Commission, which any company can use to export its data, for example to a subsidiary, its parent company or a third party.
- "Overwhelming defeat" -
The CJEU ruled this mechanism valid on Thursday, but recalled that data protection authorities in EU countries should suspend or prohibit transfers if the laws of the destination country are not sufficiently protective.
The personal data concerned (online behavior, geolocation ...) constitute "the gold mine" of the digital economy, in particular for giants like Google, Facebook or Amazon.
But a company that transfers data from one country to another between its subsidiaries, for example to manage the pay of its employees, is also affected.
Dutch MEP Sophie in 't Veld (Renew) hailed "a victory for the protection of personal data, but an overwhelming defeat for the Commission".
The invalidation of the "Privacy Shield" constitutes a new disavowal for Brussels after the cancellation on Wednesday of its decision requiring Apple to reimburse 13 billion euros, hitherto considered as improper tax advantages.
The origin of the case: a complaint by Max Schrems to the Irish regulator, demanding the interruption of the data flow between the European headquarters of Facebook, in Ireland, and its parent company in California.
Reason invoked: once in the United States, this data is less protected, because it can be claimed by intelligence agencies, such as the NSA or the FBI, without recourse or control, as shown by the revelations of the launch vehicle. Edward Snowden alert.
© 2020 AFP