The Advocate General of the EU Court of Justice has given an opinion (PDF) in relation to a transfer of data by Facebook from Ireland to the USA that the Safe Harbour regime is invalid. This opinion stems from the very reason that caused the EU to open the renegotiations on Safe Harbour in the first place. That is, the revelations by Edward Snowden of the widespread surveillance by the US authorities.

In other words, on the basis that the standards of protection in the Safe Harbour need to be renegotiated, it is not appropriate to rely upon it in the meantime to enable transfers of EU citizens’ data to the US. The AG says this access to data by the US intelligence services is an interference with the right to respect for private life and the right to protection of personal data, which are guaranteed by the European Charter of Human Rights.

The Advocate General’s opinion is not binding on the Court of Justice of the European Union, but in most situations the ruling follows the opinion. Therefore the opinion puts further pressure on the current renegotiations of the Safe Harbour scheme.

The timing is crucial. If the full court follows this opinion and issues its ruling before the conclusion of the renegotiations, US cloud providers will effectively lose their Safe Harbour protection and their customers will likely want to review their contracts with the providers to ensure there are sufficient contractual safeguards to protect data.

The US government will not be unaware of the impact this would have on US / EU cloud business and it will want to conclude the renegotiations first. It should also ensure it provides comfort over the ability of US law to grant access to data held by US owned providers in Dublin and elsewhere in the EU such as in the current case against Microsoft.

We can expect the political drama to escalate behind the scenes. Watch this space…

UPDATE 12/10/2015: Contact me for a copy of my 8-point guide on what to do about your data transfers now.