Sign in. It’s quick, free and it’s up to you.
An account is an optional way to support the work we do. Find out more.
YESTERDAY, in the case of Schrems v Data Protection Commissioner, the Court of Justice of the European Union (CJEU) found the “Safe Harbour” data transfer mechanism to be invalid.
The Safe Harbour system was devised as a streamlined system in order to facilitate the transfer of personal data from Europe to the United States.
In 2000, the European Commission released a decision declaring that the Safe Harbour system provided an “adequate” level of data protection.
Under the scheme, US based companies could volunteer to abide by the Safe Harbour principles in order to benefit from the streamlined data transfer mechanism.
The decision in Schrems constitutes a significant win for privacy advocate Max Schrems in his ongoing legal battle with Facebook and the Irish Data Protection Commissioner.
The ruling in Schrems was the result of a preliminary reference from the Irish High Court in June 2014.
Mr Justice Hogan referred a question to the CJEU, asking whether the Data Protection Commissioner was bound by the EU Commission’s adequacy decision, or whether the Data Protection Commissioner should investigate the matter independently.
In a major victory for Max Schrems, the CJEU decided not only that the Data Protection Commissioner had a duty to investigate the matter, but also decided to consider whether the Safe Harbour regime itself was valid.
The impact
Following the decision of the CJEU to invalidate the Safe Harbour mechanism, commentators have been debating the extent of the ruling’s impact, but almost all agree that the decision has significant implications for how internet companies operate.
In spite of the apparent shock in some quarters, this decision did not come without warning. In fact, this decision arrives subsequent to a series of strongly pro-privacy decisions from the CJEU.
The most notable decision in this collection – prior to yesterday’s Safe Harbour decision – is another case with a strong Irish connection. I am, of course, referring to the decision in Digital Rights Ireland and Seitlinger and Others, which was decided by the CJEU in April 2014.
Like the Schrems case, the Digital Rights Ireland case saw the CJEU invalidate a piece of EU law on the grounds of data protection and privacy.
In the Digital Rights Ireland case, it was the Data Retention Directive that was deemed invalid by the CJEU.
In spite of the potential for disorder following both the Digital Rights Ireland and Schrems rulings, in both cases the CJEU declined to declare a grace period for reorganisation and adjustment.
NSA whistle-blower
The similarities between the decisions do not end there. In addition to references in both rulings to the Charter of Fundamental Rights, the influence of the NSA whistle-blower, Edward Snowden, is clear.
The documents released by Snowden detailing the capability of the NSA to access information held by US companies (including Facebook) through the PRISM programme appeared particularly influential in both of the rulings.
As the debate concerning the full effect of decision in the Schrems case continues, it is important to pause and consider the manner in which Edward Snowden has influenced the direction of EU data protection law.
EU data protection law
The Digital Rights Ireland decision was the first major European ruling on surveillance following the Snowden revelations.
The Data Retention Directive had been introduced in response to the terrorist attacks in Madrid and London and was deemed a crucial tool in efforts to combat terrorism and organised crime. Under the Data Retention Directive, Member States were obliged to provide for the retention of communications metadata for between six and 24 months.
The metadata that was required to be retained included the data necessary to determine the source, destination, date, and time of communications.
The CJEU found the indiscriminate and unlimited collection of data on ‘all persons and all means of electronic communication’ to be a disproportionate interference with privacy and data protection rights.
Delivered in the aftermath of the Snowden revelations, the decision in Digital Rights Ireland was a clear statement of intent on behalf of the highest court of the EU.
In an implied reference to the Snowden revelations, the CJEU criticised the Data Retention Directive for not requiring that data be retained within the EU.
Implications for multinationals that transfer data outside of the EU
According to the court, by not requiring this, the Data Retention Directive could not fully ensure “compliance with the requirements of protection and security by an independent authority” as is required by the Charter.
This reasoning had clear implications for multinationals that transfer data outside of the EU and foreshadowed the recent decision in the Schrems case.
The significance of this finding was not lost on the Irish Courts when it considered Schrems’ arguments at the domestic level in June 2014.
Before sending the preliminary reference question to the CJEU that resulted in Tuesday’s decision, the Irish High Court directly addressed the significance of the Snowden revelations.
Snowden revelations
Mr Justice Hogan considered the Snowden revelations in detail and evaluated whether the existence of the PRISM programme and the findings of the CJEU in Digital Rights
Ireland cast doubt on the legality of Safe Harbour. Accordingly, even though the question put to the CJEU by the Irish High Court did not explicitly request a ruling on the issue of Safe Harbour, the candid examination of the Snowden revelations certainly set the stage for Tuesday’s decision in Schrems.
As the debate surrounding the technical, economic, and political effects of the ruling in Schrems continues, it is important to recognise that this is a crucial moment for data protection and privacy in Europe and around the World. While reform of the data protection regime continues to face challenges and problematic legislation – such as the recent French surveillance law – continues to be introduced, the influence of the Snowden revelations is difficult to deny.
The Safe Harbour regime had been recognised as problematic since its inception, yet the Snowden revelations provided the additional momentum needed to launch an effective legal challenge.
In his newly opened Twitter account, Edward Snowden thanked Europe for the decisions in both the Schrems and Digital Rights Ireland cases.
Such gratitude is returned to Snowden by many privacy advocates benefiting from the persistent and powerful “Snowden Effect”.
Maria Helen Murphy is a Lecturer in Law at Maynooth University.
To embed this post, copy the code below on your site
Snowden is a bigger American patriot than every single republican candidate running for president
He may be a hero, but the manner he carried out his whistle blowing is disgraceful. He leaked documents that put peoples lives at risk. Just took all the info and put it out there with no thought for the safety of others.
He could have achieved his goals without risking peoples lives.
along the road that Snowden took please name the decisions that could have been taken differently while still of course leading to the same outcome where he defines policy across the world for the better?
I also find it amusing you haven’t mentioned America who is the country who did all the wrong things to create this whistleblower. what about their bad decisions where they preferred to go on a witch hunt rather than sort out their own wrongdoings?
Honestly though what other choice did he really have? There is no system in place in the US to protect whistleblowers, especially ones blowing the whistle on government abuses of power. Had he just approached a journalist with claims of a massive government eavesdropping campaign the story would have been smothered in no time and Snowden imprisoned.
This way possibly risked lives but certainly got the truth out there in a way even the US government couldn’t deny or hush up.
patriots dont hide
@ Jason. imprisoned? more like executed… (some sort of accident or suicide no doubts)
MaryLou: That is an outright falsehood, Snowden did not just leak all information indiscriminately. He provided the classified information to reputable journalists so they could judiciously decide which information was in the public interest. The Washington Post and the Guardian both had a process for determining which information was safe to release and which wouldn’t jeopardise the security of people involved in various governmental agencies. I know you have a habit of making ill-informed posts, but this is probably the worst I’ve seen.
The Guardian sold him out afterwards and both Assange and he won;t deal with them again without strict conditions attached.
Patriots don’t flee their country and go running into the arms of tyrants like Putin.
he leaked to several newspapers. it was factchecked, edited, details redacted. what do you suggest he should have done. I’m curious too, can you explain how any snowden leaks put anyone at risk too?
It was Manning who released classified information on a huge scale, and admitted he didn’t even know the content of the vast majority of the leaked documents. Assange then published it without questioning the damage it might cause.
Snowden – now there’s a real man. Assange too of course. Snowden has already said he would return to the US if he could face a jury of his peers but as he’s being charged under the Espionage Act, he cannot reveal any information whatsoever as to why he did it.
If Hilary Clinton sees power all of this will be undone. She is rotten to the core. And Snowden is her number on enemy.
This may surprise you, but I actually agree with you.
The problem is the US is still firmly rooted in the Cold War paranoia mentality of everything needs to be completely secret which kills any opportunity for whistleblowers to improve the system. While I don’t agree with mass release of confidential information, the American system really left them with little options.
I am surprised tbh. Something that irks me is that General Petraeus in his bio, revealed classified information and he walks away relatively unscathed. The double-standard is there to see.
And during the bradley Manning trial, his defence asked if there was s ingle casualty or loss of life caused to US citizens by his actions, and the prosecution were unable to provide a single example of it doing so.
I think the lack of evidence is because it’s incredibly difficult to prove whether any casualties were actually caused. Although a number of experts did say that the information was so out-of-date that the units involved in the leaked documents were likely already out of rotation.
I’d say the witch hunt against Manning and Snowden have more relation to the sheer scale of the confidential information released which was unprecedented in both size and importance.
i hope he is caught and jailed for life
I hope you’re caught and jailed for life.
@Sgt Pepper
Petraeus revealed some information to Paula Broadwell but neither of them made it public knowledge. Hence, no double-standard.
Jesus, Ciaran. The White house proof-read the book first and released it, unwittingly in the process revealing classified information.
The world needs more heroes like Snowden and Manning.
Peyton or Eli?
Try not to forget Mordechai Vanunu… Everybody else has.
Who says he is finished???
The lad is a real patriot. Traitor to the government, hero to the people. He gave up every thing to tell us what really goes on.
I’m amazed people didn’t already think this was going on. I’ve always taken it as a given that internet traffic was being monitored by various governments around the world.
If you guys think any of our laws will stop USA then I am sorry to say it wont…they wont give a hoot…they will still spy on Europe anyway and even I must admit that there is nothing Europe will really do about it but wave a piece of paper the us won’t care about.
the data commissioner Schrems inquiry immediately as vexatious and without merit. The fact she got it so wrong would show that she (the commissioner) isn’t fit for duty. The government should force her to resign or fire her.
This guy is nothing other than a western main stream media spin. After all the shenanigans that is going on with the Yanks I would give him zero credibility
jesus, Frank. I would have thought you’d have backed him to the hilt?
I’m confused. I thought we were on the side of the Russians in their battle with anti-Christ Obama!?
Sgt Pepper, I do my own research on these things and lift the skin off their little yankie rice puddings.
From Barack Obama’s date of Birth on 4.8.1961 to Edward Snowden’s reported birth on 21.6.1983 INCLUSIVE is: 7992 days
http://www.timeanddate.com/date/durationresult.html?d1=4&m1=8&y1=1961&d2=21&m2=6&y2=1983&ti=on
7992 = 666 + 666 + 666 + 666 + 666 + 666 + 666 + 666 + 666 + 666 + 666 + 666
Now that you mention it, Frank. It’s beginning to make sense.
Ed Snowden’s parents were some feckers to choose to conceive a child with the aims of being born 7991 days after a then undergraduate, who they just KNEW would be president one day – being half black and all. And then to put everyone off, instead of birthing him on June 22nd which would have made the 666 association too obvious, they yanked him out a day early, thinking no-one would notice. Sneaky sneaky yankie ba$tards! But they didn’t count on our Frank and his spotting of this obvious deceit.
Frank and his Cat are paid shills for the multi-million dollar numerology industry.
7992 > 7+9+9+2 = 27
@Jake Hssssssssssss!!!! P.S. What’s your birthday?
Is 27 the Devil’s number too now? Jaysus, is any number safe nowadays?
Avina Laaf …
Devils Number magnified and reduced …666+666+666 = 1998 > 1+9+9+8 = 27
http://cwhsphoenix.org/wp-content/uploads/2014/05/THE-27-CLUB.png
If nothing else, this decision shows the benefit of having Hogan, J. as a Judge in our Cuirt Ard.
This move is very bad for artificial intelligence research.
Won’t rind a more artificial name than Jane Race
Jake*
Either the Ironic comment of the day or you have very cruel parents.
WHICH Mr. Justice Hogan?
have your say