Tweet
In the wake of last week's dramatic judgement by the Court of Justice of the European Union (CJEU), which means that transatlantic data transfers made under the Safe Harbour agreement are likely to be ruled illegal across the EU, there has been no shortage of apocalyptic visions claiming that e-commerce—and even the Internet itself—were doomed. Companies are already finding alternative, if imperfect, ways to transfer personal data from the EU to the US, although a very recent data protection ruling in Germany suggests that one approach—using contracts—is unlikely to withstand legal scrutiny. But what's being overlooked are the much wider implications of the court's ruling, which reach far beyond e-commerce.
The careful legal reasoning used by the CJEU to reach its decisions will make its rulings extremely hard, if not impossible, to circumvent, since they are based on the EU Charter of Fundamental Rights. As the European Commission's page on the Charter explains: "The Charter of Fundamental Rights of the EU brings together in a single document the fundamental rights protected in the EU." Once merely aspirational, the Charter attained a new importance in December 2009: "with the entry into force of the Treaty of Lisbon, the Charter became legally binding on the EU institutions and on national governments, just like the EU Treaties themselves."
By anchoring its ruling in the principles underlying the Charter, the CJEU has cleverly ensured that it cannot be overturned simply by bringing in new laws, since those laws must themselves comply with the Charter.
That fact also applies to other aspects of the EU's rule-making. As Steve Peers, a law professor at the University of Essex, writes in a detailed legal examination of the Safe Harbour decision: "Since the Court [CJEU] refers frequently to the primary law rules in the Charter, there’s no real chance to escape what it says by signing new treaties (even the planned TTIP or TISA), by adopting new decisions, or by amending the data protection Directive."
That's hugely important, because international treaties have become a way for governments to force through changes in domestic laws without any kind of democratic debate—the argument being that some international treaty "obliges" them to do so, and so discussion is pointless. For example, when the EU signed up to the WIPO Copyright Treaty, it was "obliged" to bring make circumvention of DRM illegal, and so brought in the EU copyright directive, which required member states to pass the appropriate local laws. But as Peers points out, in the light of the Safe Harbour decision, the European Commission now knows that any such attempt to circumvent the ruling will also be struck down by the CJEU.
It's not simply that TTIP or TISA cannot sneak Safe Harbour in by the back door: the CJEU ruling also means that they cannot contain any chapters on data flows across the Atlantic that do not address the deficiencies of Safe Harbour. That's awkward, since securing EU commitments to ensure completely free data flow across the Atlantic—including for personal information—is one of the key objectives for the US in both TTIP and TISA, just as it was in the newly-completed TPP agreement.
Back in July, Euractiv reported that US Secretary of Commerce Penny Pritzker emphasised how crucial some kind of Safe Harbour scheme was to the TTIP negotiations, calling it "a foundation [for TTIP] that's important in terms of data flows and certainly in terms of time frame.” In other words, without Safe Harbour as a framework, it will be hard to include data flows in TTIP.
The same is true for TTIP's sibling, the Trade in Services Agreement (TISA). The leak of a key section revealed the following wording proposed by the US as applying to the whole agreement: "No Party may prevent a service supplier of another Party from transferring, accessing, processing or storing information, including personal information, within or outside the Party's territory, where such activity is carried out in connection with the conduct of the service supplier's business." That absolute prohibition on restricting data flows is incompatible with the CJEU ruling; leaving something like it in final text of the agreement would therefore see TISA ruled invalid by the court.
Full Story: Fallout from EU-US Safe Harbor ruling will be dramatic and far-reaching | Ars Technica
The careful legal reasoning used by the CJEU to reach its decisions will make its rulings extremely hard, if not impossible, to circumvent, since they are based on the EU Charter of Fundamental Rights. As the European Commission's page on the Charter explains: "The Charter of Fundamental Rights of the EU brings together in a single document the fundamental rights protected in the EU." Once merely aspirational, the Charter attained a new importance in December 2009: "with the entry into force of the Treaty of Lisbon, the Charter became legally binding on the EU institutions and on national governments, just like the EU Treaties themselves."
By anchoring its ruling in the principles underlying the Charter, the CJEU has cleverly ensured that it cannot be overturned simply by bringing in new laws, since those laws must themselves comply with the Charter.
That fact also applies to other aspects of the EU's rule-making. As Steve Peers, a law professor at the University of Essex, writes in a detailed legal examination of the Safe Harbour decision: "Since the Court [CJEU] refers frequently to the primary law rules in the Charter, there’s no real chance to escape what it says by signing new treaties (even the planned TTIP or TISA), by adopting new decisions, or by amending the data protection Directive."
That's hugely important, because international treaties have become a way for governments to force through changes in domestic laws without any kind of democratic debate—the argument being that some international treaty "obliges" them to do so, and so discussion is pointless. For example, when the EU signed up to the WIPO Copyright Treaty, it was "obliged" to bring make circumvention of DRM illegal, and so brought in the EU copyright directive, which required member states to pass the appropriate local laws. But as Peers points out, in the light of the Safe Harbour decision, the European Commission now knows that any such attempt to circumvent the ruling will also be struck down by the CJEU.
It's not simply that TTIP or TISA cannot sneak Safe Harbour in by the back door: the CJEU ruling also means that they cannot contain any chapters on data flows across the Atlantic that do not address the deficiencies of Safe Harbour. That's awkward, since securing EU commitments to ensure completely free data flow across the Atlantic—including for personal information—is one of the key objectives for the US in both TTIP and TISA, just as it was in the newly-completed TPP agreement.
Back in July, Euractiv reported that US Secretary of Commerce Penny Pritzker emphasised how crucial some kind of Safe Harbour scheme was to the TTIP negotiations, calling it "a foundation [for TTIP] that's important in terms of data flows and certainly in terms of time frame.” In other words, without Safe Harbour as a framework, it will be hard to include data flows in TTIP.
The same is true for TTIP's sibling, the Trade in Services Agreement (TISA). The leak of a key section revealed the following wording proposed by the US as applying to the whole agreement: "No Party may prevent a service supplier of another Party from transferring, accessing, processing or storing information, including personal information, within or outside the Party's territory, where such activity is carried out in connection with the conduct of the service supplier's business." That absolute prohibition on restricting data flows is incompatible with the CJEU ruling; leaving something like it in final text of the agreement would therefore see TISA ruled invalid by the court.
Full Story: Fallout from EU-US Safe Harbor ruling will be dramatic and far-reaching | Ars Technica
Comment