Will the new Safe Harbour deal really protect your data?

Businesses and campaigners react to Privacy Shield, the new EU-US data transfer agreement

EU flag

The EU and US have reached a last-minute deal to ensure companies can transfer European data to American soil.

The new agreement provides guarantees that personal data from the EU will receive adequate protection when processed by US firms, and replaces a defunct deal that around 4,000 businesses relied on.

Safe Harbour was ruled invalid by the EU last October when it decided the US valued national security and law enforcement over the guarantee of privacy.

Its replacement, the EU-US Privacy Shield, was hailed by the EU as a way of resolving the issue.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

European Commission vice president Andrus Ansip said: "We have agreed with our US partners a new framework that will ensure the right checks and balances for our citizens.

"We have for the first time received detailed written assurances from the US on the safeguards and limitations applicable to US surveillance programmes."

In some ways it is stronger than Safe Harbour though. Where the former agreement did not check companies were meeting their obligations to protect data, the new deal forces companies to publish their commitments, making them enforceable under US law.

The US has also given the EU written assurances that it will not carry out "indiscriminate mass surveillance" on data transferred under the scheme.

Companies will have deadlines by which they must respond to complaints from people who feel their data has been misused, while data watchdogs can refer those complaints to US authorities.

Furthermore, any accusations of spies accessing people's data will be investigated by a new Ombudsperson.

Advertisement - Article continues below

However, the new agreement has been met with mixed reaction from businesses and data protection campaigners.

TechUK, an industry trade body representing more than 800 companies, welcomed Privacy Shield.

Deputy CEO Anthony Walker said: "Today's announcement of a new deal for EU - US data transfers is extremely important. The European Commission and US Administration must now show total commitment to implementing this and getting transatlantic data flows back onto a secure and stable legal footing.

"Businesses large and small across Europe need reliable and affordable legal mechanisms to enable the data transfers that underpin their operations and ability to serve customers."

Advertisement
Advertisement - Article continues below

The Information Technology and Innovation Foundation (ITIF), also welcomed the agreement, and criticised the decision to revoke Safe Harbour.

Vice president Daniel Castro said: "We commend US and European negotiators for completing an agreement that avoids disrupting the transatlantic digital economy in the near term by ensuring continuity for the thousands of US and European companies providing services across the two markets."

Advertisement - Article continues below

But others are more sceptical, with one lawyer claiming Privacy Shield's reputation is already "shot to pieces".

Phil Lee, data protection partner at European law firm Fieldfisher, said: "Keeping in mind that this new Safe Harbour will almost certainly be challenged by civil liberties groups (and possibly even some data protection authorities) pretty much immediately, only the foolhardy would place want to place their trust in a new Safe Harbour right now. Whether legal or not, its reputation is already shot to pieces."

Privacy campaigner Max Schrems, whose lawsuit against Facebook led to the original Safe Harbour being ruled invalid, also spoke out against the new agreement.

He claimed that despite the US' written assurances of not spying on EU data, there have thus far been no changes to its legal system to reflect this.

"A couple of letters by the outgoing Obama administration is by no means a legal basis to guarantee the fundamental rights of 500 million European users in the long run, when there is explicit US law allowing mass surveillance," he wrote.

"I doubt that a European can walk to a US court and claim his fundamental rights based on a letter by someone. The Commission could to be en route to issuing a round-trip to the European Court in Luxembourg and back. This would also not provide any legal certainty for businesses - at the most it would provide a couple more months to adapt."

Advertisement - Article continues below

He ended his evaluation by warning that people will challenge the new agreement, adding that he may be among them.

Featured Resources

What you need to know about migrating to SAP S/4HANA

Factors to assess how and when to begin migration

Download now

Your enterprise cloud solutions guide

Infrastructure designed to meet your company's IT needs for next-generation cloud applications

Download now

Testing for compliance just became easier

How you can use technology to ensure compliance in your organisation

Download now

Best practices for implementing security awareness training

How to develop a security awareness programme that will actually change behaviour

Download now
Advertisement

Recommended

Visit/data-insights/data-management/354423/eu-us-data-transfer-tools-used-by-facebook-ruled-legal
data management

EU-US data transfer tools used by Facebook ruled legal

19 Dec 2019
Visit/backup/33385/arcserve-udp-9240dr-review-beef-up-your-backups
backup

Arcserve UDP 9240DR review: Beef up your backups

4 Apr 2019

Most Popular

Visit/policy-legislation/data-governance/354496/brexit-security-talks-under-threat-after-uk-accused-of
data governance

Brexit security talks under threat after UK accused of illegally copying Schengen data

10 Jan 2020
Visit/web-browser/30394/what-is-http-error-503-and-how-do-you-fix-it
web browser

What is HTTP error 503 and how do you fix it?

7 Jan 2020
Visit/infrastructure/server-storage/354476/broadberry-cyberserve-r182-z90-review-gigabytes-epyc-gamble
Server & storage

Broadberry CyberServe R182-Z90 review: Gigabyte’s EPYC gamble pays off handsomely

7 Jan 2020
Visit/operating-systems/microsoft-windows/354514/gchq-warns-against-windows-7-for-email-banking
Microsoft Windows

GCHQ warns against Windows 7 for email, banking

13 Jan 2020