Top European Court Invalidates U.S.–E.U. Data-Transfer Agreement

LUXEMBOURG CITY — Citing the United States’ intrusive and sweeping surveillance practices, the European Union Court of Justice today invalidated the Privacy Shield, a data-transfer agreement between the European Union and the United States. More than 5,000 U.S. companies rely on Privacy Shield for transatlantic data transfers. The court concluded that the agreement fails to adequately protect the privacy rights of Europeans from U.S. mass surveillance.

The ruling came in a case originally brought by Austrian lawyer and privacy advocate Max Schrems against Facebook Ireland. The American Civil Liberties Union provided expert testimony about U.S. surveillance laws in the case.

“This ruling makes clear that no international agreement can adequately protect people’s privacy from the United States’ current mass surveillance programs and practices,” said Ashley Gorski, senior staff attorney with the ACLU’s National Security Project. “U.S. surveillance violates fundamental privacy rights and continues to be a massive financial liability for U.S. companies trying to compete in a global market. Unless Congress swiftly acts to enact comprehensive surveillance reforms, U.S. businesses will continue to pay the consequences.”

The court also held that European Union Data Protection Commissioners must suspend or prohibit data transfers under separate instruments, called Standard Contractual Clauses, if the commissioners conclude that U.S. law fails to appropriately protect Europeans’ data — as the court concluded today.

Today’s ruling makes it very difficult — if not impossible — for most companies doing business in Europe to outsource significant volumes of data to tech companies in the United States for processing or for backup purposes. Companies will still be able to execute individual data transmissions where, for example, users consent to the transfer of their data, or where the transfer is strictly necessary to the performance of a contract.

This is the second time the European Union Court of Justice has invalidated a data-sharing agreement between the European Union and the United States. The court in 2015 invalidated the Safe Harbor agreement — the two governments’ initial attempt to reconcile European privacy law and U.S. surveillance practices — after Edward Snowden revealed the NSA’s warrantless surveillance practices. The ACLU previously warned Congress and the European Commission that the Privacy Shield agreement was invalid because it failed to ensure that U.S. law adequately protected the rights of individuals in the European Union.

The ACLU is calling on Congress to radically reform U.S. surveillance laws to rein in warrantless spying, and to ensure that there is a meaningful opportunity to challenge the government’s surveillance.