In a blow to Brussels, the European Court of Justice rejected the Privacy Shield agreement between the bloc and US. The tool, which is used by thousands of firms, was introduced in 2016 to protect Europeans’ personal data when it is transferred across the Atlantic. The agreement prompted complaints amid privacy concerns about the United States’ surveillance watchdogs.
The ECJ said: “In respect of certain surveillance programmes, those provisions do not indicate any limitations on the power they confer to implement those programmes, or the existence of guarantees for potentially target non-US persons.”
Privacy Shield’s predecessor, Safe Harbour, was also invalidated by the Luxembourg-based firm in 2015 after former US intelligence contractor Edward Snowden’s revelations of mass US surveillance.
The decision by the ECJ could have significant implications for separate data adequacy negotiations between the EU and UK.
As part of the post-Brexit future relationship talks, the two sides are trying to establish an agreement to enable smooth flows of data after the transition period expires at the end of the year.
The UK has fully transposed the EU’s GDPR into national law but has a controversial track record in mass surveillance, which have received repeated legal challenges.
In 2018 a European Court of Human Rights ruled the UK had breached human rights protections in its mass surveillance programmes.
Peter Church, counsel at Linklaters, suggested the Government could have to rethink its domestic intelligence schemes to bring them in line with EU law, as well as a review of its relationship with the US.
He said: “The ECJ’s judgment could have implications for the UK’s prospects of gaining adequacy at the end of the Brexit transition period.
Steve Peers, Professor of EU law at the University of Essex, said: “This judgement sets a high bar for an adequacy decision, especially when private sector data is processed for national security purposes.”
European Justice commissioner Didier Reynders said the judgement would have to be discussed with UK officials as part of the future relationship talks.
MUST READ: Brexit crisis: EU hints it will IGNORE UK deadline as talks drag on
Eurocrats have previously called on the US to change its surveillance rules to match the EU’s.
European Commission vice-president Vera Jourova said: “The Court of Justice of the European Union once again underlined that the right of European citizens to data protection is absolutely fundamental.
“I have personally repeated many times that we would like to see on the American side, a federal law on data protection, which would be equivalent or very similar to GDPR, which would stipulate equivalent strong safe guards for the protection of private data of our citizens.”