Safe Harbour is gone but Europe is still afraid to tackle the US on privacy
Published 08/10/2015 | 02:30
When all the fine language about privacy rights is done, one question remains unanswered in the 'Safe Harbour' saga: who will dare to cut off European data flows to the US if it continues to gather intelligence from our Facebook and Gmail accounts?
The European Commission? The Irish Data Protection Commissioner? Any other European data protection commissioner or government?
Who actually has the nerve or the backing to pull the trigger?
It's a simple question. And it seems we're all a bit hesitant to answer it. Even those strongest in advocating better privacy rights consistently shy away from addressing this fundamental point.
Their assumption, it seems, is that it won't come to that. The US, they say, will listen carefully to Europe's misgivings over data surveillance and stop dragnetting our data before we have to take any real action.
But who believes that America is about to stop mass surveillance on internet data? Let's be serious, now: what are the chances that the NSA will suspend its Prism-style activities?
To recap: this mass surveillance is the reason why the ECJ has truck down 'Safe Harbour' and speculated on a suspension of transatlantic data flows. After two years of controversy over it, the US still shows little inclination to curb the practice.
So again: how firm is our conviction to cut off data flows?
Is it possible that we Europeans simply talk a good talk on American mass surveillance but ultimately wimp out when it comes to following through with genuine sanctions?
If anything, our own countries are going down the US dragnet route. As UCD law lecturer (and Digital Rights Ireland chairman) TJ McIntyre points out, Britain and France have laws allowing for mass surveillance, with Holland, Denmark and Finland possibly about to follow suit.
"There is, to put it mildly, an inconsistency in preventing the transfer of data to the US while tolerating similar practices within Europe," he wrote in yesterday's Irish Independent.
Even if we were to find some inner gumption to follow through with real action against the US, what does "suspending data flows" actually mean? Does it mean that everything's fine with transatlantic communication so long as there's a European data centre involved? Does it mean that no data may "flow" with any US entity? (Presumably not.)
And will we have the guts to also apply our new resolve to so-called 'model contracts' that lawyers now say can replace 'Safe Harbour'? For the unacquainted, model contracts are supposed to set a basic legal standard for European firms transferring data in and out of jurisdictions outside the EU's borders, where data standards may be more lax.
But as several privacy advocates are pointing out, these model contracts do little to get around the European Court of Justice's new basic thesis: that indiscriminate American collection of EU citizens' data is inimical to our fundamental rights. So presumably, complaints such as the one brought by Max Schrems against Facebook will now be re-assessed against this new context.
And if they are, who has the guts to follow the logic and stop EU-US data flows?
As it happens, much of this is now being dumped on the doorstep of the Irish Data Protection Commissioner.
"This judgment has the consequence that the Irish supervisory authority is required to examine Mr Schrems' complaint with all due diligence," said the ECJ. "It is to decide whether transfer of the data of Facebook's European subscribers to the United States should be suspended on the grounds that that country does not afford an adequate level of protection of personal data."
So it's all up to her? A globally monumental decision that no-one has the guts to take - not the European Commission, not the European Parliament, not any European government - is to be handed down to one country's regulator?
Fair enough. But the Americans probably have very little respect for European resolve. If no-one looks serious about following through with the main sanction we have, you can't blame them the US for thinking that we're all talk and little action.