European Court Rules EU-U.S. Safe Harbor Agreement Invalid

In a landmark ruling this morning, the European Court of Justice declared the EU-U.S. data-transfer agreement, known as the Safe Harbor, immediately invalid. This agreement was thrown into question after the Advocate General of the European Court of Justice, Yves Bot, ruled that American privacy rules did not offer European citizens enough protection against their online data being misused by companies or national governments and therefore, domestic regulators in each European country should have the right to suspend transfers of data about their citizens to the United States. While the Court was not required to follow Bot’s ruling, they too found the agreement lacking protections for their citizens, stating that “national security, public interest and law enforcement requirements of the United States prevail over the safe harbour scheme, so that United States undertakings are bound to disregard, without limitation, the protective rules laid down by that scheme where they conflict with such requirements,” and that as a result of this and other factors the Safe Harbor Decision should be deemed invalid. Since the European Court of Justice is the highest legal authority in the European Union, its decision cannot be appealed.

The invalidation of this data-transfer agreement is especially worrisome to U.S. tech companies, but also to any organization with international operations. Furthermore, it could cause problems for EU-U.S. trade as businesses solely relying on the Safe Harbor will no longer have a secure way in place to move data between the two continents. Since the ruling gives more power to the 28 individual EU countries’ privacy watchdogs, companies may not be able to transfer data until these domestic authorities give their approval.

This ruling comes as the European Commission and the United States are in the midst of long-running discussions over strengthening the Safe Harbor framework. It is likely the Court’s ruling will complicate these negotiations and that it will put more pressure on the United States to comply with the heightened standards being requested by the EU. However, it could cause the U.S. negotiators to take a more stringent position as well in order to protect the interests of American companies. It is unclear how long these negotiations will continue or when alternative methods of transferring data will be offered.