By Sam Schechner and Valentina Pop
LUXEMBOURG--In a gold-curtained courtroom here, a debate is
playing out over the transfer of personal data used for billions of
dollars in digital advertising.
The European Court of Justice--the European Union's top
court--heard arguments Tuesday in the biggest threat yet to a legal
mechanism that allows Facebook Inc. and thousands of other firms to
transfer European personal data to U.S.-based servers.
Following revelations of widespread surveillance by the U.S.
National Security Agency, plaintiff Max Schrems, an Austrian law
student, made the case that the EU-U.S. agreement, called Safe
Harbor, no longer guarantees the privacy of European residents. He
was supported by lawyers representing the governments of Belgium,
Poland and Austria.
"Mass surveillance is manifestly incompatible with the
fundamental right to privacy and data protection," Noel Travers, a
lawyer for Mr. Schrems, told the court on Tuesday.
Mr. Travers acknowledged that he has "no evidence of the NSA
specifically having accessed my client's data" but said that Mr.
Schrems's right to privacy was violated and that in itself can be
considered harmful.
The case is a surprise challenge in a wave of disputes between
the EU and U.S. over online privacy. European officials look at the
protection of personal data as a fundamental right on par with free
expression; the U.S. regulates privacy mostly as a
consumer-protection issue. That divide was further highlighted last
year when the same court decided that a "right to be forgotten"
applies to search engines like Google Inc.
At stake in the case is traffic in a major currency of the
trans-Atlantic economy: personal information. For companies that
offer ad-supported services, personal information--like the
location of a Web user--allows the sale of targeted advertisements.
Digital ad spending in Western Europe is expected to total $34.81
billion in Europe in 2015, up 8.5% from last year, according to
research firm eMarketer.
In the U.K. alone, three American firms--Google, Facebook and
Twitter Inc.--will account for more than half of the overall
digital ad spending of GBP8.06 billion (about $12 billion) in 2015,
eMarketer says.
Safe Harbor was a stopgap deal adopted in 2000 after the EU
found that the U.S.'s patchwork of different data-protection
regimes wasn't stringent enough to meet European standards. Under
the agreement, the EU let data flows continue for companies that
self-certify they are in line with EU-data protection rules.
Mr. Schrems challenged Facebook's compliance with EU
data-privacy rules in Ireland, where the company's European
operations are based. The Irish data protection authority rejected
Mr. Schrems's challenge, a move that he appealed in the country's
highest court, which asked the EU's top court whether national
authorities can suspend Safe Harbor when there are "extraordinary
circumstances."
Facebook declined to comment on the case, but says that it
provides user data to governments only when laws force it to do
so.
Safe Harbor's defenders--including the European Commission, the
EU's executive arm--respond that the question of how to protect
Europeans from overzealous spying is already part of talks between
the EU and the U.S. to address European concerns about the
agreement. They say any move by the court to scrap it now would
upset trans-Atlantic ties.
"It would have quite serious effects...risking disruption of
trade that carries significant benefit for the EU and its
citizens," said a representative of the U.K. government at
Tuesday's hearing.
Several EU countries--Belgium, Austria, Poland--lined up to
support Mr. Schrems on Tuesday. "Safe Harbor is not in fact for the
data of EU citizens, but is at best a safe harbor for data
pirates," Gerhard Kunnert, a lawyer representing the Austrian
government, told the court.
The lead judge on the case, Thomas von Danwitz, also appeared
sympathetic. He grilled the lawyer for the European Commission on
the language used in the Safe Harbor text, which the lawyer
admitted is "no model of clarity."
Mr. von Danwitz was also the lead judge when the court last year
struck down a data-retention law obliging telecom companies to
store the data of Europeans for law enforcement.
Companies on both sides of the Atlantic have expressed concern
at the possible scrapping of Safe Harbor, because it concerns not
just advertising but also things like payroll information and
company phone books. European firms like Ericsson and BT Group PLC
often rely on U.S. service providers or have U.S.-based
subsidiaries that are Safe Harbor-certified. There are other
mechanisms to transfer data between the EU and the U.S., but they
are costly because they involve contractual changes and lengthy
approvals.
"If Safe Harbor is really compromised, then this creates a
serious legal vacuum," said Eduardo Ustaran, a privacy attorney who
works for several U.S. tech firms. "It would disrupt not just data
flows, but trade relations between Europe and the U.S."
Some companies say they may be forced to build more servers in
Europe if the agreement is scrapped or scaled back. Twitter said in
a securities filing earlier this month that revocation of Safe
Harbor could require "duplicative, and potentially expensive,
information technology infrastructure and business operations in
Europe."
"Without formulating an alternative this would be a major blow
to the trans-Atlantic digital economy," said Thomas Boué of the
Software Alliance, an umbrella lobby group for the software
industry.
Mr. Schrems, for his part, dismisses those concerns. "Safe
Harbor was always broken but after the [Edward] Snowden
revelations, even the European Commission admits it needs
improvement," he said.
A nonbinding opinion by the court's advocate general will be
published on June 24, with a final verdict expected before
October.
Write to Sam Schechner at sam.schechner@wsj.com and Valentina
Pop at valentina.pop@wsj.com
Access Investor Kit for BT Group Plc
Visit
http://www.companyspotlight.com/partner?cp_code=P479&isin=GB0030913577
Access Investor Kit for LM Ericsson Telefon AB
Visit
http://www.companyspotlight.com/partner?cp_code=P479&isin=SE0000108656
Access Investor Kit for BT Group Plc
Visit
http://www.companyspotlight.com/partner?cp_code=P479&isin=US05577E1010
Access Investor Kit for LM Ericsson Telefon AB
Visit
http://www.companyspotlight.com/partner?cp_code=P479&isin=US2948216088
Access Investor Kit for Facebook, Inc.
Visit
http://www.companyspotlight.com/partner?cp_code=P479&isin=US30303M1027
Access Investor Kit for Google, Inc.
Visit
http://www.companyspotlight.com/partner?cp_code=P479&isin=US38259P5089
Access Investor Kit for Google, Inc.
Visit
http://www.companyspotlight.com/partner?cp_code=P479&isin=US38259P7069
Subscribe to WSJ: http://online.wsj.com?mod=djnwires