EU diplomat: Safe Harbor 2.0 must guard Europeans’ 'fundamental rights'

In an interview at the Monitor on Thursday, David O’Sullivan, the European Union’s ambassador to the US, said he was confident that Europeans and their American counterparts could forge a new transatlantic data transfer deal that included more robust privacy protections.

Though the European Union’s highest court has struck down the pact that eased the flow of information across the Atlantic, the EU’s ambassador to the US remains confident that negotiations to update that agreement will soon proceed.

In an interview at The Christian Science Monitor on Thursday, Ambassador David O’Sullivan said that US and EU negotiators have yet to absorb the full consequences of the European Union Court of Justice’s ruling on Safe Harbor, which provided a means for US companies to transfer Europeans' personal data to America, but expressed confidence that talks could soon reopen.

"We’re on the road to protecting data flows between us," Mr. O’Sullivan said. "But it must be part of a broad legal framework that protects the fundamental rights of Europeans."

O’Sullivan confirmed that European officials met on Thursday to discuss the technical impact of the court’s ruling. A political meeting is scheduled for next week, but no specific timetable has been outlined for negotiators to resume Transatlantic talks, which left off in July.

The court's ruling, handed down Tuesday, stems from a complaint lodged in 2013 by Austrian privacy activist Max Schrems. Then a student in Ireland, Mr. Schrems argued that because of the existence of the National Security Agency’s PRISM program, Facebook couldn’t keep his data safe under the privacy protections in Safe Harbor.

The decision allows domestic regulators in Europe to challenge the ability of around 4,500 US companies to transfer the personal data of EU citizens to American servers on privacy grounds. US Secretary of Commerce Penny Pritzker said in a statement that the verdict “[put] at risk the thriving transatlantic digital economy.” The flow of information from Europe will continue for now, but under a different section of EU data protection law.

Though the decision could split Europe’s privacy authority between the EU’s 28 member states, O’Sullivan said it would not cause the EU’s protections to fragment. "Our objective is to see the consolidation of the EU on this issue," he said. "[EU member states] all want to work off of a common set of rules, but the judgment will take time to digest."

During that gestation period, O’Sullivan will head to California and Washington as part of an outreach trip scheduled months before the court’s decision, where many big name tech companies that took advantage of the protection to boost advertising efforts, including Apple, Google, Twitter, and Yahoo, will also be processing the court’s ruling.

So far, the reaction has been mixed. A spokesperson for the file-storage service Box told Passcode that the company is looking for new means of complying with the EU's privacy requirements, but does not anticipate that the changes will hamper business.

Still, sorting out the differences between Brussels and Silicon Valley could prove challenging. In a statement Tuesday, the European Commission’s First Vice-President Frans Timmermans called the judgment "an important first step for upholding Europeans’ fundamental rights to data protection." Timmermans also said the verdict affirmed the need to renegotiate Safe Harbor.

O’Sullivan acknowledged the court's decision would necessitate some changes when negotiators return to the table. "The negotiations have made great progress," he said. "We need to review that progress in light of the court’s decision."

The result of that review could have an important impact on how data moves across the Atlantic.