After successfully prompting the European Court of Justice to invalidate the Safe Harbour agreement, which governed the privacy of EU citizens’ data transferred to the US until October, Schrems is attempting to force through the consequences of the court’s decision.
Schrems filed three separate complaints with the Irish, German and Belgian data protection agencies. They each state that Facebook does not request explicit consent to transfer the data from Facebook Ireland to Facebook Inc in the US. The complaint also states that Facebook cannot guarantee the privacy of EU citizen’s data from US government surveillance, and that it should be prevented from transferring data.
It asks the data protection agencies to levy appropriate measures against the US social network to “suspend all data flows from ‘Facebook Ireland Ltd’ to ‘Facebook Inc’”.
Schrems said: “We want to ensure that this very crucial judgement is also enforced in practice when it comes to the US companies that are involved in US mass surveillance. The court’s judgement was very clear in this respect.”
European data regulators
Facebook’s European base of operations is Dublin, Ireland, where it is governed by the Irish Data Protection Commissioner (IDPC), the target of Schrems’ initial complaint against Facebook in 2014.
A Facebook spokesperson said: “We have repeatedly explained that we are not and have never been part of any program to give the US government direct access to our servers.
“These issues are being examined by the IDPC at the request of Mr Schrems. We are cooperating fully with the IDPC and are confident that this investigation will lead to a comprehensive resolution of Mr Schrems’ complaints.”
Schrems describes his experiences of the IDPC as “rather mixed”, explaining why he has also contacted the Belgian and German watchdogs.
“I have absolutely no doubt that the vast majority of all European data protection authorities properly investigate complaints and take reasonable actions,” said Schrems.
Schrems also added that “wilful resistance to do the job may have personal consequences for officeholders”.
Illegal mass surveillance
The privacy campaigner dismisses the protections of other agreements and contracts for transferring data outside of the now invalid Safe Harbour agreement, explaining that they all have exceptions for cases of “illegal mass surveillance” – the cornerstone of the European Court of Justice’s invalidation of the Safe Harbour agreement.
Schrems’ is under no illusion that such a halt to data transfer between the EU and US would have serious ramifications for the operation of not only Facebook but many technology companies. He suggests providing Facebook with a “reasonable implementation period” under which the social network could make other arrangements.
“Users really don’t have to worry that their screens go dark, but I hope we will see serious restructuring in the background – just like Microsoft has now started to offer more secure data centres in Germany, that are supposedly not subject to US jurisdiction,” said Schrems.
The EU and US are currently in negotiations over a new Safe Harbour agreement, which will not come before the end of the year, and may not be able to avoid the NSA’s mass surveillance programme.
While Facebook is the target of this series of lawsuits and complaints, other US technology companies that operate on a similar basis will be watching the outcome.
Several companies, including Google, Microsoft and Amazon, have made moves to boost European-based data processing capabilities – data centres out of the reach of the US government.
guardian.co.uk © Guardian News and Media Limited 2010