3 ms·

The ECJ didn't leave all that much room for a quick fix. Any new agreement will have to consider state access to data, which safe harbour left as a huge gap, an

by ploxold 11y ago

The ECJ didn't leave all that much room for a quick fix. Any new agreement will have to consider state access to data, which safe harbour left as a huge gap, and yet guarantee the privacy rights of EU citizens. Those rights are incompatible with what US intelligence seems to be doing. The ECJ judgment even said it explicitly, "In particular, legislation permitting the public authorities to have access on a generalised basis to the content of electronic communications must be regarded as compromising the essence of the fundamental right to respect for private life". Any form of self-certifying to the FTC is going to be inadequate from now on, as I read it. But it isn't just about safe harbour being poorly enforced, and completely unreviewed, the point is we now know what US intelligence does to EU consumer data. So, the ECJ gave a set up for the Irish High Court to find that data transfer between Facebook Europe and Facebook Inc is illegal. It will be interesting to see what happens when that shoe drops.

vidarh 11y ago
They not only set it up for the Irish High Court, but also set it up for two separate avenues of appeals on human rights grounds if the Irish High Court still decides it's ok: The Charter of Fundamental Rights of the European Union covers privacy in article 7 and data protection in article 8 [1]. The European Convention on Human Rights [2] covers privacy (in article 8). It's noteworthy that the ECJ made the statement it did, because the ECHR has national security exceptions that would make it easy for them find differently, whereas the Charter does not say a single word about whether or not there are legitimate exceptions and it'd be easy enough for the ECJ to infer exceptions without any uproar (on the contrary, in Europe both the ECJ and ECHR tends to cause more uproar when they expand peoples rights than when the curtail them). But instead they explicitly referred to "access on a generalised basis" (my emphasis) which makes it fairly clear that they accept the exceptions of the ECHR but believe the exceptions can not be stretched this far, and at the same time they it might be seen as drawing a line with respect to the Charter as well. So they've basically put everyone on notice that it's not only the EU Data Protection directive and associated national laws that are in play, and that surveillance must be considered, but that there may be legitimate claims under both the Charter of Fundamental Rights and under the European Convention on Human Rights as well. This is going to make it extra fascinating to watch, as while the ECJ is the final arbiter of EU law, including the Charter, the final arbiter of the ECHR is the European Court of Human Rights. If this goes to the ECHR, and ECHR agrees with the above statement from the ECJ, then that has effects far outside the borders of the EU, as the ECHR is binding on members of the Council of Europe, and the CoE includes most European states outside the EU as well. Including Russia. [1] http://www.europarl.europa.eu/charter/pdf/text_en.pdf http://www.europarl.europa.eu/charter/pdf/text_en.pdf [2] http://www.echr.coe.int/Documents/Convention_ENG.pdf http://www.echr.coe.int/Documents/Convention_ENG.pdf

by ploxold 11y ago

vidarh 11y ago

They not only set it up for the Irish High Court, but also set it up for two separate avenues of appeals on human rights grounds if the Irish High Court still decides it's ok: The Charter of Fundamental Rights of the European Union covers privacy in article 7 and data protection in article 8 [1]. The European Convention on Human Rights [2] covers privacy (in article 8). It's noteworthy that the ECJ made the statement it did, because the ECHR has national security exceptions that would make it easy for them find differently, whereas the Charter does not say a single word about whether or not there are legitimate exceptions and it'd be easy enough for the ECJ to infer exceptions without any uproar (on the contrary, in Europe both the ECJ and ECHR tends to cause more uproar when they expand peoples rights than when the curtail them). But instead they explicitly referred to "access on a generalised basis" (my emphasis) which makes it fairly clear that they accept the exceptions of the ECHR but believe the exceptions can not be stretched this far, and at the same time they it might be seen as drawing a line with respect to the Charter as well. So they've basically put everyone on notice that it's not only the EU Data Protection directive and associated national laws that are in play, and that surveillance must be considered, but that there may be legitimate claims under both the Charter of Fundamental Rights and under the European Convention on Human Rights as well. This is going to make it extra fascinating to watch, as while the ECJ is the final arbiter of EU law, including the Charter, the final arbiter of the ECHR is the European Court of Human Rights. If this goes to the ECHR, and ECHR agrees with the above statement from the ECJ, then that has effects far outside the borders of the EU, as the ECHR is binding on members of the Council of Europe, and the CoE includes most European states outside the EU as well. Including Russia. [1] http://www.europarl.europa.eu/charter/pdf/text_en.pdf http://www.europarl.europa.eu/charter/pdf/text_en.pdf [2] http://www.echr.coe.int/Documents/Convention_ENG.pdf http://www.echr.coe.int/Documents/Convention_ENG.pdf