Ruling on Transatlantic Data Transfers Puts US Tech Firms in Rough Water

The legal blow in Europe that removed "Safe Harbour" protection of cross-border data transfers by from US tech firms on Tuesday has thrust them into rough water.

The ruling Tuesday by Europe's top court, invalidating the 15 year old Safe Harbour agreement, means that some 4,000 Internet companies ranging from giants such as Apple, Facebook, and Google to startups just getting their sea legs can no longer legally transfer user data from Europe to the United States.

(Also see:  Facebook Says 'Imperative' for EU, US to Find Data Deal Solution)

"Aside from taking an axe to the undersea fibre optic cables connecting Europe to the United States, it is hard to imagine a more disruptive action to transatlantic digital commerce," the Information Technology and Innovation Foundation (ITIF) in Washington, DC, said in an online post.

"Safe Harbour agreement has been the cornerstone of the transatlantic digital economy since before global companies like Facebook were founded."

The rise of online social networks and the cloud services and storage industry have come with Internet titans building huge data centres in the US and elsewhere to catalogue Internet user and other data from around the world.

User information is also shifted between tech company servers to target advertising, the lifeblood of the Internet economy.

Huge problem
The European court of Justice ruling could force companies to keep European users' digital information in Europe. That would require companies to have enough data centre capacity there.

Major technology firms might be able to absorb that expense, but it is not likely small or medium sized companies have such room in their budgets.

"It's a huge problem for companies that move a lot of that information across borders, particularly Google and Facebook which have a lot of processing power in the US," said independent analyst Rob Enderle of Enderle Group.

"It means you have to keep data contained in the country."

Internet firms should be able to rent server capacity from cloud computing service providers in Europe,and deep-pocketed players will likely invest in building more data centres there, according to the analyst.

Already illegal
The court ruling did not come with a stated grace period, meaning that Internet firms may already be breaking the letter of the law.

It remains to be seen how aggressively and quickly regulators in Europe move to enforce it.

The EU insisted Tuesday that companies can keep transferring personal data to the United States while authorities work out a replacement for Safe Harbour.

"It's not as if the United States government could not have seen this coming," Danny O'Brien of the cyber rights advocate Electronic Frontier Foundation said in an online post.

"For the last two years, major tech companies, including Facebook and Google, have told American politicians that without reform of the NSA's global surveillance programs, they risked 'breaking the internet'."

The EU high court accepted the legal argument that the Safe Harbor agreement failed to live up to its promise in the wake of spying details leaked by former US National Security Agency (NSA) contractor Edward Snowden.

"The spread of knowledge about the NSA's surveillance programs has shaken the trust of customers in US Internet companies like Facebook, Google, and Apple," said O'Brien.

"It should come as no surprise, then, that the European Court of Justice has decided that United States companies can no longer be automatically trusted with the personal data of Europeans."

The ITIF believed that the ruling will not only disrupt Internet firms that depended on Safe Harbor to do business, but that it will hit the broader economy.

The non-profit research and education foundation urged policy makers to swiftly ink an interim agreement to avoid shutting down "transatlantic digital commerce overnight."