By The Electronic Frontier Foundation
The European Union’s highest court last week made clear – once again – that the U.S. government’s mass surveillance programs are incompatible with the privacy rights of EU citizens.
The judgement was made in the latest case involving Austrian privacy advocate and EFF Pioneer Award winner Max Schrems. It invalidated the “Privacy Shield,” the data protection deal that secured the transatlantic data flow, and narrowed the ability of companies to transfer data using individual agreements (Standard Contractual Clauses, or SCCs).
Despite the many “we are disappointed” statements by the EU Commission, U.S. government officials, and businesses, it should come as no surprise, since it follows the reasoning the court made in Schrems’ previous case, in 2015.
Back then, the EU Court of Justice (CJEU) noted that European citizens had no real recourse in U.S. law if their data was swept up in the U.S. governments’ surveillance schemes. Such a violation of their basic privacy rights meant that U.S. companies could not provide an “adequate level of [data] protection,” as required by EU law and promised by the EU/U.S. “Privacy Safe Harbor” self-regulation regime. Accordingly, the Safe Harbor was deemed inadequate, and data transfers by companies between the EU and the U.S. were forbidden.
Since that original decision, multinational companies, the U.S. government, and the European Commission sought to paper over the giant gaps between U.S. spying practices and the EU’s fundamental values. The U.S. government made clear that it did not intend to change its surveillance practices, nor push for legislative fixes in Congress. All parties instead agreed to merely fiddle around the edges of transatlantic data practices, reinventing the previous Safe Harbor agreement, which weakly governed corporate handling of EU citizen’s personal data, under a new name: the EU-U.S. Privacy Shield.
EFF, along with the rest of civil society on both sides of the Atlantic, pointed out that this was just shuffling chairs on the Titanic. The Court cited government programs like PRISM and Upstream as its primary reason for ending data flows between Europe and the United States, not the (admittedly woeful) privacy practices of the companies themselves. That meant that it was entirely in the government and U.S. Congress’s hands to decide whether U.S. tech companies are allowed to handle European personal data. The message to the U.S. government is simple: Fix U.S. mass surveillance, or undermine one of the United States’ major industries.
Five years after the original iceberg of Schrems 1, Schrems 2 has pushed the Titanic fully beneath the waves. The new judgement explicitly calls out the weaknesses of U.S. law in protecting non-U.S. persons from arbitrary surveillance, highlighting that:
Section 702 of the FISA does not indicate any limitations on the power it confers to implement surveillance programs for the purposes of foreign intelligence or the existence of guarantees for non-US persons potentially targeted by those programs.
and
[N]either Section 702 of the FISA, nor E.O. 12333, read in conjunction with PPD‑28, correlates to the minimum safeguards resulting, under EU law, from the principle of proportionality, with the consequence that the surveillance programs based on those provisions cannot be regarded as limited to what is strictly necessary.
The CJEU could not be more blunt in its pronouncements, but it remains unclear how the various actors that could fix this problem will react. Will EU data protection authorities step up their enforcement activities and invalidate SCCs that authorize data flows to the U.S. for failing to protect EU citizens from U.S. mass surveillance programs? And if U.S. corporations cannot confidently rely on either SCCs or the defunct Privacy Shield, will they lobby harder for real U.S. legislative change to protect the privacy rights of Europeans in the U.S. – or just find another temporary stopgap to force yet another CJEU decision? And will the European Commission move from defending the status quo and current corporate practices, to truly acting on behalf of its citizens?
Whatever the initial reaction by EU regulators, companies and the Commission, the real solution lies, as it always has, with the United States Congress. Last week’s decision is yet another significant indicator that the U.S. government’s foreign intelligence surveillance practices need a massive overhaul. Congress half-heartedly began the process of improving some parts of FISA earlier this year – a process which now appears to have been abandoned. But this decision shows, yet again, that the U.S. needs much broader, privacy-protective reform, and that Congress’ inaction makes us all less safe, wherever we are.
Previously:
* Yahoo E-Mail Scan Shows U.S. Spy Push To Recast Constitutional Privacy.
* Snowden: ‘Journalists Are A Threatened Class’ In Era Of Mass Surveillance.
* AT&T Spying On Americans For Profit.
* ACLU Demands Secret U.S. Court Reveal Secret U.S. Laws.
* Obama’s New Era Of Secret Law.
* EFF To Court: Government Must Inform People That It’s Accessing Their E-Mails, Personal Data.
* A Plea To Citizens, Websites: Fight The Expansion Of Government Powers To Break Into Users’ Computers.
* NSA Today: Archives Of Spy Agency’s Internal Newsletter Culled From Snowden Documents.
* U.S. Surveillance Court A Bigger Rubber Stamp Than Chicago City Council.
* Obama Won’t Tell Congress How Many Innocent Americans He’s Spying On.
* Ruling Unsealed: National Security Letters Upheld As Constitutional.
* EFF Sues For Secret Court Orders Requiring Tech Companies To Decrypt Users’ Communications.
* Trying (And Trying) To Get Records From The ‘Most Transparent Administration’ Ever.
* EFF Urges Appeals Court To Allow Wikimedia And Others To Fight NSA Surveillance.
* U.S. Government Reveals Breadth Of Requests For Internet Records.
* What’s The Evidence That Mass Surveillance Works? Not Much.
* Why The Close Collaboration Between The NSA And AT&T Matters.
* First Library To Support Anonymous Internet Browsing Effort Stops After DHS E-Mail.
* EFF Sues For Records About ‘Hemisphere’ Phone Call Collection And Drug Enforcement Program.
* Snowden Documentarian Laura Poitras Sues U.S. Government To Uncover Records After Years Of Airport Detentions And Searches.
* Obama Secretly Expanded NSA Spying To Internet.
* Court: NSA Phone Program Illegal.
* The Chicago Connection To The Hidden Intelligence Breakdowns Behind The Mumbai Attacks.
* Human Rights Watch Sues DEA Over Bulk Collection Of American’s Telephone Records.
* U.S. Secretly Tracked Billions Of Calls For Decades.
* Amnesty International Joins ACLU, Wikimedia In Lawsuit To Stop Mass Surveillance Program.
* Stop Spying On Wikipedia Users.
* EFF Wins Battle Over Secret Legal Opinions On Government Spying.
* The NSA’s “U.S. Corporate Partners.”
* I Fight Surveillance.
* Illegal Spying Below.
* Smith vs. Obama.
* EFF Sues NSA Over FOIA.
* Stand Against Spying.
* The NSA Revelations All In One Chart.
* U.S. Supreme Court Limits Cell Phone Searches.
* EFF To Court: There’s No Doubt The Government Destroyed NSA Spying Evidence.
* House Committee Puts NSA On Notice Over Encryption Standards.
* Which Tech Companies Help Protect You From Government Data Demands?
* Lawsuit Demands DOJ Release More Secret Surveillance Court Rulings.
* Human Rights Organizations To Foreign Ministers: Stop Spying On Us.
* What The Proposed NSA Reforms Wouldn’t Do.
* Technologists Turn On Obama.
* Dear Supreme Court: Set Limits On Cell Phone Searches.
* EFF Fights National Security Letter Demands On Behalf Of Telecom, Internet Company.
* Eighth-Grader Schools The NSA.
* You Know Who Else Collected Metadata? The Stasi.
* Today We Fight Back.
* The Day We Fight Back.
* FAQ: The NSA’s Angry Birds.
* Jon Stewart: The Old Hope-A-Dope.
* Four Blatantly False Claims Obama Has Made About NSA Surveillance.
* EFF To DOJ In Lawsuit: Stop Pretending Information Revealed About NSA Over Last Seven Months Is Still A Secret.
* Judge On NSA Case Cites 9/11 Report, But It Doesn’t Actually Support His Ruling.
* Edward Snowden’s Christmas Message.
* Jon Stewart: Obama Totally Lying About NSA Spying.
* Presidential Panel To NSA: Stop Undermining Encryption.
* The NSA Is Coming To Town.
* 60 Minutes We Can’t Get Back.
* Why Care About The NSA?
* NSA Surveillance Drives Writers To Self-Censor.
* Filed: 22 Firsthand Accounts Of How NSA Surveillance Chilled The Right To Association.
* Claim On ‘Attacks Thwarted’ By NSA Spreads Despite Lack Of Evidence.
* Obama Vs. The World.
* How A Telecom Helped The Government Spy On Me.
* UN Member States Asked To End Unchecked Surveillance.
* Government Standards Agency: Don’t Follow Our Encryption Guidelines Because NSA.
* Five More Organizations Join Lawsuit Against NSA.
* A Scandal Of Historic Proportions.
* Item: NSA Briefing.
* The Case Of The Missing NSA Blog Post.
* The NSA Is Out Of Control.
* Patriot Act Author Joins Lawsuit Against NSA.
* Obama’s Promises Disappear From Web.
* Why NSA Snooping Is A Bigger Deal In Germany.
* Item: Today’s NSA Briefing.
* NSA Briefing: It Just Got Worse (Again).
* Song of the Moment: Party at the NSA.
* It Not Only Can Happen Here, It Is Happening Here.
* What NSA Transparency Looks Like.
* America’s Lying About Spying: Worse Than You Think.
* Obama Continues To Lie His Ass Off About The NSA.
* The Surveillance Reforms Obama Supported Before He Was President.
* America’s Spying: Worse Than You Think.
* Has The U.S. Government Lied About Its Snooping? Let’s Go To The Videotape.
* Who Are We At War With? That’s Classified.
* Six Ways Congress May Reform NSA Snooping.
* NSA Says It Can’t Search Its Own E-Mails.
* Does The NSA Tap That?
* Obama Explains The Difference Between His Spying And Bush’s Spying.
* FAQ: What You Need To Know About The NSA’s Surveillance Programs.
* NSA: Responding To This FOIA Would Help “Our Adversaries”.
* Fact-Check: The NSA And 9/11.
* The NSA’s Black Hole: 5 Things We Still Don’t Know About The Agency’s Snooping.
* Defenders Of NSA Surveillance Citing Chicago Case Omit Most Of Mumbai Plotter’s Story.
* Obama’s War On Truth And Transparency.
* ProPublica’s Guide To The Best Stories On The Growing Surveillance State.
* The Fight To Rein In NSA Surveillance.
* Taking Short Break From Denouncing Trump Authoritarianism, House Dems Join With GOP To ‘Violate The Privacy Rights Of Everyone In The United States.’
* Edward Snowden’s Permanent Record.
* Defending Edward Snowden’s Permanent Record.
–
Comments welcome.
Posted on July 20, 2020