Shield of dreams

Europe’s highest court has now killed two transatlantic data deals, which is enough to call it a pattern. In 2015 it struck down Safe Harbor, the arrangement that let American firms move Europeans’ personal data across the Atlantic. Its successor, Privacy Shield, arrived in 2016.^{1NPR, via WHROEurope's top court strikes down key rules of U.S.-EU data transfer16 Jul 2020} On 16 July 2020 the Court of Justice of the European Union struck that down too.^{1NPR, via WHROEurope's top court strikes down key rules of U.S.-EU data transfer16 Jul 2020}

Privacy Shield covered more than 5,300 companies, including banks, Facebook and Twitter.^{1NPR, via WHROEurope's top court strikes down key rules of U.S.-EU data transfer16 Jul 2020} The Commerce Department, which ran the scheme, said it was “deeply disappointed” and warned of “negative consequences to the $7.1 trillion transatlantic economic relationship”.^{1NPR, via WHROEurope's top court strikes down key rules of U.S.-EU data transfer16 Jul 2020,2US Department of Commerce, via AJOTU.S. Secretary of Commerce Ross statement on Schrems II ruling and the importance of EU-US data flows16 Jul 2020} The disappointment is understandable. The surprise is not. A deal that fails the same test twice is not unlucky; it is mis-designed.

The court’s reasoning is plain enough. American surveillance laws, it said, are “not circumscribed in a way that satisfies requirements that are essentially equivalent to those required” under European Union law. The Foreign Intelligence Surveillance Act, it added, “cannot be regarded as limited to what is strictly necessary.”^{1NPR, via WHROEurope's top court strikes down key rules of U.S.-EU data transfer16 Jul 2020} The problem lies mainly with the American government rather than with the companies that signed up.^{1NPR, via WHROEurope's top court strikes down key rules of U.S.-EU data transfer16 Jul 2020} No amount of paperwork in Silicon Valley can fix a statute written in Washington.

Max Schrems, the privacy activist whose complaint began the case, put it with some relish. America, he said, is now “simply put back to an average country with no special access to EU data.”^{1NPR, via WHROEurope's top court strikes down key rules of U.S.-EU data transfer16 Jul 2020} That is a fair summary of the legal position and a poor one of the commercial position, because the average country does not host so much of Europe’s business software.

So what happens on Monday? Less than the headlines suggest, for now. The court upheld standard contractual clauses, the boilerplate agreements under which a company promises to protect data it ships abroad.^{1NPR, via WHROEurope's top court strikes down key rules of U.S.-EU data transfer16 Jul 2020} Facebook and Microsoft have said they use them.^{1NPR, via WHROEurope's top court strikes down key rules of U.S.-EU data transfer16 Jul 2020} The European Commission, for its part, said transatlantic data flows “can continue”, relying on the broad toolbox of the General Data Protection Regulation, such as binding corporate rules and those same clauses.^{3European CommissionPress conference speaking points of Vice-President Jourová following the judgment in case C-311/18 Facebook Ireland and Schrems16 Jul 2020,4European CommissionOpening remarks by Vice-President Jourová and Commissioner Reynders at the press point following the judgment in case C-311/1816 Jul 2020} Firms will swap one form for another and carry on.

That is the comfortable reading, and we doubt it will last. A contract binds two companies; it cannot bind an intelligence agency. The clauses let European regulators intervene when a destination country may not protect data adequately,^{1NPR, via WHROEurope's top court strikes down key rules of U.S.-EU data transfer16 Jul 2020} and the destination here is the one whose surveillance law the court has just found wanting. Mr Schrems says America “will have to seriously change their surveillance laws” if its firms want to keep a major role in the European market.^{1NPR, via WHROEurope's top court strikes down key rules of U.S.-EU data transfer16 Jul 2020} Clauses buy time. They do not buy certainty.

There is a strong objection, and it deserves a hearing. European governments run intelligence services of considerable appetite, and the court’s standard seems to bear more heavily on America than on, say, France. Judges in Luxembourg, the argument goes, have appointed themselves auditors of another country’s spies. There is something in this. The double standard is real, and Washington is entitled to say so.

But the objection answers a different question. Whether Europe is consistent is a point about Europe. Whether a company may lawfully move a customer’s records is a point about the law as it stands, and the court has now ruled on it twice. Pointing at France does not make a data transfer legal. It is also a weak bargaining position for the party whose firms stand to lose most if the flows stop.

The pro-market answer is neither to denounce the court nor to stitch together a Privacy Shield 3.0 for Luxembourg to unpick. The Commerce Department says it will keep running the scheme meanwhile and remain “in close contact” with the Commission.^{2US Department of Commerce, via AJOTU.S. Secretary of Commerce Ross statement on Schrems II ruling and the importance of EU-US data flows16 Jul 2020} Fine, as far as it goes. What would last is reform: clearer limits on collection, and a route to redress that a European citizen could use and a European judge could believe. Open markets run on trust, and trust, unlike a certification list, cannot be administered.

Negotiating a shield is easier than reforming a spy agency. It is also why the first two broke.