At last, the data giants have been humbled

A staid European Union court in quiet Luxembourg has made waves in international waters by declaring that a data transfer agreement between the EU and the US fails to comply with European human rights law. The decision, issued by the European court of justice on Tuesday in a case brought by pioneering privacy activist Max Schrems against Facebook not only promises to uproot the business practices of some of the technology sector’s giants. It also contains the strongest condemnation by any court to date of the US National Security Agency’s mass-surveillance practices.

The court’s decision to suspend the so-called safe harbour agreement is one of those rare beasts: a highly legalistic judgment of seemingly little public relevance whose ripples will touch – if not be felt – by everyone from the average British Facebook user to the American congressman. Just as the US supreme court did earlier this year when it ruled gay marriage to be constitutional, the European court of justice has not just walked but run in the direction of progress.

Safe harbour, an agreement made between the EU and the US in 2000, was supposed to protect private data collected by internet companies: your age, your relationship status, even just the Facebook pages you have “liked”. When US companies with subsidiaries in the EU collected personal data in Europe and sent it back to the US, or when EU companies outsourced their data to US providers, that personal data was supposedly still covered by the privacy protections enshrined in EU law. So when Facebook Europe, headquartered in Ireland, collected data on its European members and then sent that data to servers in the US, the information remained protected by EU data protection and human rights law.

Safe harbour was supposed to remind those companies deliberately transferring data to the US that they couldn’t escape obligations to protect that data from abuse, error, theft or illegitimate appropriation, even if under the guise of national security. Edward Snowden’s revelation made shockingly clear that this wasn’t the case.

Tuesday’s ruling is rife at every turn with well-founded indignation at the sheer scope and audacity of US spying on non-American citizens – that the court had clearly been itching to pronounce. It could have issued a far more restrained decision in response to Schrems’ claim, which essentially asked whether safe harbour prevented national data protection authorities – such as Britain’s Information Commissioner’s Office – from investigating the practices of US companies. Instead, the court leapt enthusiastically at the chance to question the validity of the safe harbour agreement itself, and with it the compliance of US law on privacy and surveillance with European human rights standards.

It is entirely unlikely, as scaremongers suggest, that the ruling will cripple the burgeoning start-up scene, yet the dark cloud that has long hung over safe harbour has meant that companies have prepared for this eventuality. At any rate, The internet companies most likely to be affected are those that already have a lot of power and influence, such as Facebook with its European subsidiaries, or EU companies and governments outsourcing data to US cloud services. For the average internet user, the impact will be immediate but hard to discern. US companies with European subsidiaries – Facebook, Google and Amazon, for example – will have to either keep individuals’ data in European servers or look for another legal basis for transferring that data to the US. Such other bases are available, and may represent more of a compliance hurdle than an actual obstacle to companies moving data abroad.

Similarly, government agencies that seek to outsource data to US-based cloud services – as HMRC sought to do with Google earlier this year – will have to think twice and review the legality of their proposals. On the whole, the decision is likely to slow but not noticeably stem the amount of data transferred to the US and thus the amount of data readily available for US intelligence agencies to inspect under their lax surveillance laws, which afford non-US persons next to no privacy rights whatsoever.

What is significant is that the European court of justice has taken a step that no court has previously had the courage to take: it declared the mass, indiscriminate electronic interception and scrutiny of private internet communications to be an act that inherently violates human rights law. In the context of international law, this is a decision that may come to be remembered as being as critical to enshrining global norms on surveillance as the Nuremberg trials were for solidifying human right prohibitions against crimes against humanity and genocide. The edicts contained in the judgment create a “point of no return” for the evolution of legal thinking on surveillance.

For this reason, the decision will certainly be influential in the European court of human rights, which next year will consider no less than three claims against mass surveillance in the United Kingdom: one brought by Liberty, Privacy International and Amnesty International, after Britain’s Investigatory Powers Tribunal ruled mass surveillance to be compliant with the Human Rights Act, as well as two others lodged by Big Brother Watch, English PEN and the Open Rights Group, and the Bureau of Investigative Journalism respectively.

The cases will likely be heard just as the UK parliament debates the investigatory powers bill, a new piece of legislation that will probably aim to relegitimise – and entrench – GCHQ’s bulk interception powers; with the CJEU’s finding thrown into the mix, the result is likely to be a perfect storm of debates on the legitimacy of the British surveillance state. Other court cases on the legality of mass surveillance are being heard across Europe – in France, Germany and the Netherlands – and this decision is likely to aid the lawyers and campaigners running those cases too.

With any luck the ruling will also influence American politics, as Congress could allow to lapse the very mass surveillance provisions that elicited the court’s vitriol, as the relevant clauses of the US surveillance legislation face sunset in 2017.

The real value of this judgment could be as a wake-up call to US legislators that, in a digital era in which the internet knows no nationality, affording Americans some protections and foreigners none is not only an unsustainable financial strategy, it is a violation of international law.