08 - 602: Spring Additional Video Report #1

Due on Sunday, January 25, 2016

Dr.Sadeh 12:00am

Arnab Kumar

Arnab Kumar

08 - 602 (Dr.Sadeh 12:00am): Spring Additional Video Report #1

Problem 1
Write a one-page write-up that includes a brief discussion about something you found interesting about the
topic and some questions you have for the speaker.
This report is on the video : Safe Harbor: Introduction and consequences of the CJEUs Safe
Harbor ruling given by Max Schrems. The video is an introduction to what really happened that led to
the CJEUs Safe Harbor ruling, its consequences, and how it led to invalidating the EU-US data sharing
deal in the light of the revelations over US surveillance by Edward Snowden. What is really special about
this talk is that it is given by the Austrian privacy activist Max Schrems, who campaigned against Facebook
for privacy violation, including its violations of European privacy laws and alleged transfer of personal data
to the US National Security Agency (NSA) as part of the NSAs PRISM programme. He is the founder of
the group called Europe v Facebook and as of February 2015 has initiated two lawsuits involving Facebook.
As is described by Max, his interest in this issue began during his stint at Santa Clara University after
being surprised by what the companys privacy lawyer had to say to his class on Facebook and their
interaction with the European Data Privacy Laws. This was further compounded by him receiving a CD
containing over 1,200 pages of data on himself from Facebook, after he requested them under the European
right to access provision. He then proceeds onto describing the entire ordeal, as I have briefed in the
next few points:
Schrems Europe v Facebook (EvF) group had filed a complaint against Facebook Ireland Ltd with
the Irish Data Protection Commissioner, which was rejected on the grounds that it was frivolous and
vexatious. Schrems followed this up with a successful filed of an associated, which resulted in the Justice
saying that Irish law relating to privacy had effectively been pre-empted by European law and that
the core issue was whether the relevant directives should be re-evaluated in the light of the subsequent
entry into force of Article 8 (protection of personal data) of the Charter of Fundamental Rights of the
European Union.
This was followed up by the case being taken up at the Court of Justice of the European Union,
where they dug deep into the privacy implications of the mass surveillance in the US. Participants
included many countries of the EU, though some of the noticeable avoiders of the case were the German
government, citing they did not want to too engaged in the trans atlantic partnership. This was also
followed by attempted interventions by the US Governments. All this was followed by the courts
Advocate General for the case, Yves Bot, declaring the Safe Harbour agreement invalid and said that
individual data protection authorities could suspend data transfers to third countries if they violated
EU rights. What this would mean would not be that data transfer to the US would be illegal, but that
US would lose its privileged status which it had due to the Safe Harbor Agreement, and would be like
any other third country.

Page 2 of 3

Arnab Kumar

08 - 602 (Dr.Sadeh 12:00am): Spring Additional Video Report #1

(continued)

This would mean US companies explicitly asking for consent from European consumers. Even though
this has always portrayed to be done via Privacy policies, the EU requires that they be freely give,
informed, unambiguous and specific. Due to US gag order, such mass surveillance can never be stated
explicitly, leading them to a legal limbo and uncertainty on how to proceed. Due to lack of effectivity of this, many companies presently do not rely on Safe Harbour for its data transfers. Instead they
rely on pre-approved contractual agreements called model clauses, or standard contractual clauses.
Schrems has since gone on to file three more complaints against Facebook with Data Protection Authorities (DPAs) in Belgium, Ireland, and Hamburg in Germany pertaining to this issue.
One of the takeouts of this talk, according to me is
Although this case, and this issue, seemed an attack on Facebook and the US, the issue is something
that is generalistic to other European governments as well. As has been pointed out by Schrems. it is
a problem that applies to almost all of the European governments, and this case just gave it a platform
to be addressed. How this is performed, and proceeds, is something to be observed very carefully.

Page 3 of 3