'Milestone' European ruling says US online data deal invalid

An online privacy campaigner has won a "milestone" European ruling that a treaty allowing technology giants to send personal data from the EU to US is invalid.

An agreement gives US companies access to the online information of millions of EU citizens. The European Court of Justice has said it should not prevent Europe's national privacy watchdogs from checking US firms were taking adequate data protection measures.

The court found that allowing the authorities access to the content of electronic communications compromised the fundamental right to respect for private life.

The judgment followed a legal challenge by an Austrian privacy activist concerned that the social network Facebook might be sharing European's personal data with US cyberspies.

Max Schrems said: "I very much welcome the judgment of the Court, which will hopefully be a milestone when it comes to online privacy.

"This judgment draws a clear line. It clarifies that mass surveillance violates our fundamental rights. Reasonable legal redress must be possible."

The decision could have far-reaching consequences affecting many other companies, legal experts have said.

Mr Schrems challenged the 15-year-old Safe Harbour treaty in his fight to expose what information Facebook gave to American intelligence agencies.

Safe Habour was an agreement between the EU and US that came into effect in 2000. It was designed to provide a streamlined way for US firms to get data from Europe without breaking its rules.

The EU forbids personal data from being transferred to and processed in parts of the world that do not provide adequate privacy protections.

Safe Harbour allows US companies to self-certify that they are carrying out the required steps.

The judgment by the court in Luxembourg said national security, public interest and law enforcement requirements of the United States prevail over the Safe Harbour scheme.

It added the US was bound to disregard the protective rules laid down by Safe Harbour where they conflict with such requirements.

"The United States Safe Harbour scheme thus enables interference, by United States public authorities, with the fundamental rights of persons."

The court found that legislation allowing the authorities access to the content of electronic communications compromised the fundamental right to respect for private life.

The judgment said: "The court declares the Safe Harbour decision invalid."

Mr Schrems's legal battle over Safe Harbour was sparked by Edward Snowden's revelations over the US National Security Agency (NSA)'s Prism surveillance system which allowed spies to access enormous amounts of data from global tech companies.

He initially brought a lawsuit in Ireland after failing to secure an investigation into Facebook by the country's Data Protection Commission, which has the authority to audit the social media giant.

Mr Schrems claimed Ireland's data watchdog had an onus to uncover what information Facebook held on users and ultimately what was being transferred to the US under Safe Harbour and being accessed through Prism.

The case was brought in Dublin as every Facebook user outside the US and Canada has a contract with Facebook Ireland.

It was later transferred to the European court.

The judgment will be sent to the High Court in Dublin where the judge will use it as the basis for deciding on Mr Schrems's legal challenge for Facebook to be audited.

Mr Snowden, a former NSA contractor now in exile in Russia, triggered a wave of controversy when he leaked tens of thousands of documents about surveillance programmes run by the US intelligence services and foreign counterparts, including Britain's GCHQ, in 2013.

He fled to Hong Kong where he met journalists to co-ordinate a series of articles that exposed mass surveillance programmes such as the NSA's Prism and GCHQ's Tempora, which involve "hoovering up" vast volumes of private communications.

Jim Killock, executive director of Open Rights Group, a UK-based campaigning organisation aiming to raise awareness of digital rights, said: "In the face of the Snowden revelations, it is clear that Safe Harbour is not worth the paper its written on. We need a new agreement that will protect EU citizens from mass surveillance by the NSA."