One of the European Union’s most powerful data regulators has warned companies may yet face massive disruption to translatlantic data flows as a result of an EU court ruling last year, despite efforts by policymakers to avoid that outcome.
Europe’s highest court last July ruled an EU-US data transfer agreement was invalid, citing concerns the US surveillance regime might not respect the privacy rights of citizens in the bloc.
Irish Data Protection Commissioner Helen Dixon, who was involved in the case, said the full impact would be determined by an upcoming court ruling in Ireland and efforts by EU and US officials to ameliorate it.
The July court ruling has created uncertainty about whether some transfers of personal data held by companies in the EU to the United States will even be possible.
Dixon’s office in August issued a provisional order that the mechanism Facebook uses to transfer EU user data to the United States “cannot in practice be used.”
The order was frozen by the Irish High Court and a decision on that, which Dixon said may be decided as early as April, will be crucial to the future of data flows across the Atlantic.
Parallel political efforts to resolve the issue between EU and US officials remain at a “very early stage,” Dixon said.
“In very general terms, removing from that specific (Facebook) case, there would be massive disruptions for individual companies and organisations” she told Reuters in an interview.
“There would equally be solutions that would overcome those issues in some cases” such as keeping the data within the EU. “In other cases there wouldn’t be easy solutions,” she said.
Momentum building
Ireland, which hosts the European headquarters of many of the world’s largest Internet companies, who take advantage of the country’s low corporate tax rate, has been accused in the past for underfunding its data regulator.
But Dixon said her office was “building momentum” after growing from 30 to 150 staff in seven year. It is was likely to issue at least six or seven decisions this year, up from two last year – against Twitter and Facebook’s WhatsApp messaging service.
Confirmation on whether WhatsApp faces a major fine as a result of the probe into whether it properly informed users about how it planned to share data with other Facebook companies, could be finalised by April, she said.
Dixon’s office has the power to levy fines of up to 5 percent of a firm’s global revenue. She declined to speculate on the WhatsApp decision, but said any fine would reflect the significant number of users affected.
Several probes against Facebook and its sister companies Instagram and WhatsApp are near completion, as are investigations into Google and Verizon, she said. The regulator has 27 cross-border probes open.
All of her decisions are subject to review by regulators in the other 26 EU nations as part of the bloc’s “one stop shop” system.