EU court puts US-Swiss data-sharing deal at risk

European countries could demand that US companies host data centres in Europe to reduce surveillance risk Keystone

The European Court of Justice’s decision to invalidate a deal allowing thousands of firms to transfer data between Europe and the United States could affect a bilateral data-sharing agreement between the US and Switzerland. 

Under European privacy laws, companies are forbidden from transferring European citizens’ personal data to countries deemed to have lower privacy standards. The “Safe Harbour” accord was introduced 15 years ago to allow firms to easily transfer personal data to the US without having to seek prior approval, a potentially long and expensive process. 

On Tuesday the EU court concluded that European data held by US companies would not be safe from surveillance that would be deemed illegal in Europe. The court said Safe Harbour did not sufficiently protect EU citizens’ personal data as American companies were “bound to disregard, without limitation” the privacy safeguards where they come into conflict with the national security, public interest and law enforcement requirements of the US. 

Revelations by National Security Agency contractor Edward Snowden about US mass surveillance activities involving European citizens prompted the re-examination of the deal and the EU court’s decision will mean it will have to be renegotiated. 

Surveillance law

Campaigners protesting recent legislation that reinforces state surveillance, began Tuesday to collect signatures, with the aim of calling a new referendum. The law, adopted last month, authorizes listening devices to be installed in public or private locations.  

Last week, the European commissioner for human rights, Nils Muižnieks, addressed a letter to the Swiss government expressing concern over the new executive powers set by the legislation.

“This decision will also put into question the agreement reached between Switzerland and the US,” said a spokesperson for the Federal Data Protection and Information Commissioner (FDPIC). “In case of a renegotiation only a coordinated approach between Switzerland and the EU will achieve the objective.” 

In 2008, Switzerland signed a bilateral agreement with the US over transfer of data involving Swiss residents. As with the EU agreement, it includes a list of US companies like Apple and Google that have committed to ensuring sufficient measures are taken to protect data involving Swiss residents. Presently, nothing changes with regard to the bilateral agreement but the Swiss authorities will be monitoring the EU renegotiation. 

A breakdown of the data-sharing agreement means that data regulators from individual European countries could check if US companies meet their norms on data protection. They can also demand that the data concerning their citizens be stored on European servers instead of transferring them to the US.