What is (and will be) the impact of the October 6th European court decision invalidating the U.S.-EU Safe Harbor? Federal Trade Commission (FTC) Commissioner Julie Brill noted that individual European Union nation-state data protection authorities (DPAs) will potentially be able to question the viability of most any data transfers and related mechanisms, summarizing the court decision as “like hitting 7.8 on the Richter scale… a lot of damage.”

“like hitting 7.8 on the Richter scale… a lot of damage.”

Speaking about the European Court of Justice’s (ECJ) decision and the future for trans-Atlantic data flows on a call hosted by law firm Alston & Bird, she reminded the audience that standard model contract clauses and binding corporate rules (BCRs) can still be relied upon, at least for now, as well as specific informed and unambiguous consent (with the caveat that the consent mechanisms, according to those European DPAs, really only work in a limited business-to-consumer transactions context).

Brill observed that, “in Europe, this decision has been a vindication for privacy as a fundamental right” and lots of policymakers have been celebrating the decision. She commented that the European reaction is actually beneficial “for those of us in the United States who haven’t recognized this before… a lot of people haven’t taken the European view on privacy as all that serious before.” Many Americans, including President Obama, have viewed EU privacy efforts as primarily about digital protectionism, but Brill felt that the ECJ ruling “demonstrates the opposite case.”

The commissioner also saw the ECJ decision as a partial vindication of the push for a baseline comprehensive U.S. privacy law, particularly as part of an attempt to harmonize data privacy rules across the Atlantic.

The ECJ invalidation of the U.S.-EU Safe Harbor impairs the FTC’s privacy enforcement

Still, Brill expressed disappointment at the rejection of the Safe Harbor agreement. After spending years trying to explain the American privacy enforcement system to Europeans, she worried that the ECJ decision has removed a key consumer protection tool. Invalidating the Safe Harbor leaves the U.S. without a transparent data transfer mechanism, leaving U.S. enforcement bodies (particularly the FTC) to keep an eye on who is and who isn’t transferring data across the Atlantic, what their data privacy and security practices might be, etc. “The FTC can’t use safe harbor as a privacy enforcement tool anymore,” lamented Brill – an extra disappointment since it had become a rather effective tool, including settlements with 13 companies at the end of the summer for Safe Harbor privacy violations.

What America needs to do to help restore freer trans-Atlantic data flows

As for what needs to be done by the U.S. to help restore reliable mechanisms for U.S.-EU data flows, Brill stressed the need for Congress and the White House to focus on European citizen’s ability to seek redress of grievances for government surveillance (the Judicial Redress Act), and broader reforms of the National Security Agency’s data collection activities. However, she felt that the privacy regulation and enforcement “silos” between government data collection and private sector data collection “are starting to crumble.” Brill said that American policymakers “need to start thinking about data privacy and data flows in a more holistic manner.”

In the meantime, U.S. and EU policymakers are working on “efforts to try to create a more robust framework for transferring data” – a Safe Harbor 2.0 that negotiators hope will win over skeptical European DPAs allow for trans-Atlantic data flows to get back on track.

The U.S.-EU Safe Harbor, Brill concluded, was always the “wrong target for all the surveillance concerns,” but that doesn’t mean that it wasn’t “in need of improvement.” The commissioner sounded confident that we will see that improvement in a new agreement – and perhaps, sometime soon, in U.S. privacy laws.

This information is not intended and should not be construed as or substituted for legal advice. It is provided for informational purposes only. It is advisable to consult with your attorney on the precise scope and interpretation of any laws/regulation/legislation and their impact on your particular business.