The European Court of Justice this week sided with the Austrian privacy advocate Max Schrems and found that “Privacy Shield,” the framework for data transfers from Europe to the United States, does not protect the personal information of Europeans. The decision will have far-reaching implications for trans-Atlantic trade, tech, data protection, and democratic governance. To continue transfers of personal data from Europe to the US — key to the continued growth of the US tech industry — the US will need to update domestic privacy laws and establish a data protection agency. Several bills now pending in Congress would do this, though the prospects for passage in an election year remain unclear.
This is the second successful challenge that Schrems has brought to the Court of Justice. In 2015, the Court struck down “Safe Harbor” after Schrems argued that the first EU-US framework lacked sufficient safeguards for personal data. US and EU negotiators then put together Privacy Shield, but many doubted the Court of Justice would endorse the revised data transfer policy, particularly after Europe enacted the General Data Protection Regulation, a comprehensive new privacy law to protect the personal information of Europeans.
The “Schrems I” decision arose in 2015 against the backdrop of the 2013 Snowden disclosures and concern that US intelligence agencies had too easy access to the personal data gathered by US tech firms. These concerns remain in the European Court’s opinion in “Schrems II.” Current US surveillance law contains few safeguards for non-US persons and the US remains one of the few democratic countries in the world without a data protection agency. But the second Schrems decision appears in 2020 when there is also growing concern about the fairness of Artificial Intelligence techniques, the unregulated use of face surveillance, and the recognition that mass surveillance curbs democratic freedoms and solidifies authoritarian governments. Europe itself has made strengthening democratic institutions and adherence to the rule of law top priorities over the next several years. So, the impact of the Schrems II decision will likely reach beyond EU-US relations. Other governments also collect and process the personal data of Europeans — the decision of the European court will have global consequences.
The Center for AI and Digital Policy, founded in 2020, advises governments on technology policy.
Marc Rotenberg, Director
Center for AI and Digital Policy at Michael Dukakis Institute
