What is 'safe harbour' the EU Declared Invalid?

The European Court of Justice has ruled that the “safe harbour” agreement that allowed the transfer of European citizens data to the US is no longer valid. But what does that mean for the Facebooks, Googles and Microsofts of this world?

In a two-year-old case forced to the EU’s highest court by Austrian privacy campaigner Max Schrems, the EUCJ ruled that the European Commission’s trans-Atlantic data protection agreement that went into force in 2000 was invalid because it does not adequately protect consumers in the wake of the Snowden revelations.

What was the ‘safe harbour’ agreement?

EU privacy law forbids the movement of its citizens’ data outside of the EU, unless it is transferred to a location, which is deemed to have “adequate” privacy protections in line with those of the EU. The safe harbour agreement that was made between the EC and the US government essentially promised to protect EU citizens’ data if transferred by American companies to the US.It allowed companies such as Facebook to self-certify that they would protect EU citizens’ data when transferred and stored within US data centres. Patrick Van Eecke, co-head of the global privacy practice DLA Piper said: “The advantage of safe harbour was that it functioned as a kind of ‘one stop shop’ allowing for the export of personal data to the US, whoever in Europe it came from, without the need to ask for consent, or to enter into bilateral agreements, over and over again.”

Can data still be transferred to the US?

Now that the 2000 agreement has been called invalid, American companies – including Google, Facebook, Apple and Microsoft – can no longer rely on self-certification and must seek to strike “model contract clauses” in each case. These agreements authorise the transfer of data outside of Europe. Monique Goyens, director general of the European Consumer Organisation said: “In essence, if Facebook, Google et al. wish to continue sending Europeans’ personal data over the Atlantic they will just have to guarantee an adequate level of protection in line with EU rules.”
The impact on large US technology companies and their operations within the EU is likely to be limited to a large amount of paperwork. Many will already have model contract clauses already drawn up. Others may be forced to stop the transfer of data to the US until they have.
Many US companies have established or are in the process of building EU-based data centres to handle data for EU citizens, including Facebook, Apple and Google. The search company, for instance, lists four data centres within Europe, including one in Ireland.

What about Facebook?

For Facebook, which has been placed at the centre of this case by Schrems, the decision means that the Irish data protection authority (DPA) will be forced to investigate the Austrian’s claims and Facebook’s data protection practices.
“[The Irish DPA must]decide whether ... transfer of the data of Facebook’s European subscribers to the US should be suspended on the grounds that that country does not afford an adequate level of protection of personal data,” the EUCJ said.

Will I notice anything different?

The impact on users in the short term is unlikely to be obvious. The dissolution of the agreement will, in theory, ensure better data protection for users’ personal information going forward. It may also help stop the US government from being able to gain access to user data from the EU.
Sites and services such as Facebook are highly unlikely to be disrupted to any meaningful level. But it may open the door to further probes, complaints and lawsuits from users and data regulators.

What about cloud services?

The companies most affected are likely to be smaller, less financially and technologically able companies. Many use US-based cloud services to store or process data that they could not do themselves. It is the 21st century equivalent of outsourcing. Those companies will have to abide by the same systems as Facebook and Google, agreeing model contract clauses and ensuring that the service they are using, such as Amazon’s web services, also complies with data protection regulations. Despite being standard and essentially fixed agreements, getting them approved before transferring data will be both a financial and administrative burden.

Will a new safe harbour agreement be needed?

The ruling did not come completely out of the blue – it’s a ratification of the EU’s Advocate General’s opinion on Safe Harbour – but was not expected quite so soon. A new safe harbour agreement is currently being negotiated between the EU and US, and has been in negotiation for the last two years, following the Snowden revelations. The EU has been trying to limit the US government’s access to EU citizens’ data stored in the US and to allow EU citizens to sue US companies in US courts should they misuse their data. The EU has been using the threat of vetoing future trade agreements as a stick, but an agreement has yet to be struck. The new ruling is likely to light a fire under the proceedings as a new agreement is needed to help lubricate international trade in services.Some analysts see the EUCJ’s ruling as likely to hurt, not help, the new safe harbour negotiations. Van Eecke: “By tweaking and fine-tuning the existing safe harbour system and adding a layer of solid enforcement we could come to a workable solution. This is exactly what the government officials are working on, but which now risks to be impeded by the court’s decision.”

What happens if one can’t be made?

Should the US attempt to derail a new safe harbour agreement, it is US companies aiming to expand beyond US borders that are likely to be impacted. European companies may also see access to advanced cloud services restricted, although the move to data centres situated in Europe will ease the situation. In the meantime encryption may hold the answer to maintaining data transfer while a new agreement is put in place. Nigel Hawthorn, from cloud security company Skyhigh Networks, said: “Organisations need to investigate technologies such as encryption or risk being dragged through the courts by privacy advocates, customers or employees. Tokenising or encrypting data flows before they are sent to the cloud, and keeping the keys on premise, means all of these issues disappear. There is no ‘personal’ data in the cloud service once it has been encrypted or tokenised.”

Guardian

 

« Bitcoin - It's Uncomplicated
White House Backs Off Encryption »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Virtustream

Virtustream

The Virtustream Enterprise Class Cloud provides a secure, highly available, Infrastructure as a Service (IaaS) to enterprises and government customers.

Janusnet

Janusnet

Janusnet develops software and solutions for organisations to enforce and manage data security.

Nethemba

Nethemba

Nethemba provide pentesting and security audits for networks and web applications. Other services include digital forensics, training and consultancy.

SafenSoft (SnS)

SafenSoft (SnS)

SafenSoft delivers high-efficiency, low-impact proactive protection against malware, insider threats, and confidential data leakage.

SecuTech Solutions

SecuTech Solutions

SecuTech is a global leader in providing strong authentication and software licensing management solutions.

RunSafe Security

RunSafe Security

RunSafe Security is the pioneer of a patented cyberhardening transformation process designed to disrupt attackers and protect vulnerable embedded systems and devices.

Cyberra Legal Services (CLS)

Cyberra Legal Services (CLS)

Cyberra Legal Services provides cyber law advisory, cyber crime consultancy, cyber law compliance audit, cyber security, cyber forensics and cyber training services.

ubirch

ubirch

The ubirch platform is designed to ensure that IoT data is trustworthy and secure.

Improsec

Improsec

Improsec is a fully independent Cyber Security advisory company - we provide knowledge, experience and both strategic and deep technical expertise to our clients.

FutureCon Events

FutureCon Events

FutureCon produces cutting edge events aimed for Senior Level Professionals working in the security community, bringing together the best minds in the industry for a unique cybersecurity event.

CyberKnight Technologies

CyberKnight Technologies

CyberKnight Technologies is a cybersecurity focused value-added-distributor (VAD) headquartered in Dubai and covering the Middle East.

DMARC360

DMARC360

DMARC360 analyzes your email traffic patterns and sources, rapidly deploys email authentication protocols and monitors your email domains with automated recommendations and incident response.

Cranfield University

Cranfield University

Cranfield Defence and Security are at the forefront of their fields, offering capabilities ranging from cyber security and digital warfare to robotics, forensic sciences and simulation and analytics.

Mainstream Technologies

Mainstream Technologies

Mainstream Technologies is an information technology services firm specializing in custom software development, managed IT services, cybersecurity services and hosting.

Vancord

Vancord

Vancord is an information and security technology company that works in collaboration with clients to support their infrastructure and data security needs for today and tomorrow.

AddSecure

AddSecure

AddSecure is a leading European provider of secure IoT connectivity and end-to-end solutions.