Law student brings down data pact
From Vienna caf'es to the European Union's highest court, an Austrian law student's two-year battle against Facebook and mass US surveillance culminated yesterday in a landmark ruling that has rippled across the business world.
The European Court of Justice yesterday struck down the Safe Harbour agreement that allows over 4 000 companies to transfer European citizens' data to the US.
Max Schrems, a 28-year-old Facebook user finishing his PhD in law at Vienna University, took an interest in the subject of privacy while studying for a semester abroad at Santa Clara University in California.
The legal battle against mass US surveillance he subsequently pursued resulted in what lawyers called a "bombshell" ruling knocking down a data transfer framework between the European Union and the US used by over 4 000 companies such as Google, Facebook and IBM.
"Max Schrems and Edward Snowden. What a combination. Two young men who have made indelible impacts on the world of data protection," wrote Stewart Room, a partner at PricewaterhouseCoopers.
Like many Vienna residents, Schrems has a caf'e - the traditional Caf'e Ritter in the Austrian capital's fashionable Mariahilf shopping district - that is like a second home where he spends much of his time and receives visitors.
In 2013, ex-National Security Agency contractor Edward Snowden leaked details about the US government's Prism programme that allowed it to harvest private information directly from big tech companies such as Facebook.
Facebook has repeatedly denied being a "back door" for US spies.
Schrems took up the privacy battle and filed 22 complaints against Facebook in Ireland, where the company has its European headquarters. He set up a Web site, called europe-v-facebook.org, with the aim of ensuring Europeans' privacy rights are enforced against "tech giants like Facebook".
He then lodged a complaint with the Irish Data Protection Commissioner, asking it to stop Facebook's transfers of European users' data to its US servers because of the risk of US government snooping.
That complaint was thrown out as "frivolous and vexatious".
But Schrems appealed. His case eventually wound its way to the Luxembourg-based European Court of Justice, which yesterday struck down the framework underpinning the data transfers of thousands of companies.
"Individuals now have far greater ability to exert a disruptive influence and shape law," said Paula Barrett, partner at law firm Eversheds.
Snowden, without whom Schrems said Tuesday's victory would have been impossible, congratulated the Austrian privacy activist via Twitter.
"Congratulations Max Schrems. You've changed the world for the better," Snowden tweeted.
EU wants revamped deal
Meanwhile, the European Union will press ahead with efforts to revamp transfers of personal data to the US after yesterday's court ruling that the current system is illegal, said European Commission VP Frans Timmermans.
"We have been working with the US authorities to make data transfers safer for European citizens. In the light of the ruling, we will continue this work towards a new and safe framework for the transfer of personal data across the Atlantic," Timmermans told a news conference.
"We will come forward with clear guidance for national data protection authorities on how to deal with data transfer requests to the US in the light of the ruling."
The United States is "deeply disappointed" by the ruling from the highest EU court yesterday, the US Secretary of Commerce said in a statement.
"We are deeply disappointed in today's decision from the European Court of Justice, which creates significant uncertainty for both US and EU companies and consumers, and puts at risk the thriving transatlantic digital economy," Penny Pritzker said in a statement.
"We are prepared to work with the European Commission to address uncertainty created by the court decision," Pritzker added.