Antitrust Law Daily Wrap Up, PRIVACY NEWS: Commissioner Brill discusses transatlantic privacy in wake of Schrems decision, (Oct 23, 2015)

By Michael Menzhuber, J.D., LL.M.

FTC Commissioner Julie Brill delivered the keynote address today before the Amsterdam Privacy Conference. In her prepared remarks, entitled “Transatlantic Privacy After Schrems: Time for An Honest Conversation,” Brill focused on the effect of the European Court of Justice (ECJ) decision in Schrems v. Data Protection Comm’r, CJEU Case C0362/14 (2015) and moving forward from that decision.

Brill suggested that the ECJ’s decision in Schrems, which invalidated the European Commission’s (EU) decision in 2000 to approve an agreement known as Safe Harbor as a data transfer mechanism, has placed the U.S. and Europe at a critical juncture where the shared values need to be reflected upon, there is honesty as to the nature of similarities and differences, and there is an assessment of the steps needed to be taken to develop a trusted framework for the transatlantic flow of information.

The Commissioner commented that, while Safe Harbor needed improvements such as more transparency, it was the wrong target for arguments that U.S. surveillance practices violate the privacy rights of Europeans. She suggested that important protections were lost by the ECJ’s invalidation of the EU’s decision to approve Safe Harbor; namely, (1) transatlantic data transfers would be less transparent; and (2) the FTC’s enforcement of companies’ transatlantic privacy commitment would be much more difficult. Brill did note, however, that the Schrems decision demonstrated that privacy in Europe is a fundamental right that Europeans and their Court take seriously.

Brill stated her belief that a new data transfer mechanism should be created that would strengthen the privacy protections that were in Safe Harbor principals. However, she went on to urge everyone to consider implementation of a successor Safe Harbor as a beginning, not the end, of a renewed effort to work together on strengthening privacy protections.

She cited the ongoing, robust debate in the U.S. over whether to enact legislation that requires companies to have a means to provide law enforcement with access to unencrypted versions of encrypted communications in response to a court order or warrant. She suggested that Europeans should engage in this discussion as well and should examine their Member States’ own law enforcement with the same openness and recognition of the potential impact the practices may have on consumers’ and citizens’ privacy.

It is in the larger issues presented by newer data technologies, and the highly connected world that they create, for which the U.S. and Europe may be able to forge a constructive dialogue about common approaches that will, at the same time, address the challenges these technologies pose to fundamental aspects of consumer privacy, security, and fairness in our societies, she said.

The U.S. needs to go further with its consumer privacy laws to ensure that consumers are adequately protected with respect to these new technologies, according to the Commissioner. However, additional consumer privacy legislation in the U.S. was not a prerequisite for a post-Schrems data transfer mechanism.

Brill noted that building trust in transatlantic data flows, and ensuring privacy and security protections for our highly connected and data-intensive world, are big tasks that neither the FTC nor the European data protection authorities (DPA) should handle alone. She explained that the Schrems decision did not take away the common ground shared by the U.S. and Europe and did not diminish the importance of: (1) working together to understand the privacy implications of new technologies; (2) cooperating on enforcement matters when possible; and (3) bringing our own actions when warranted. She then expressed her hope that the Schrems decision would motivate both European and American stakeholders to join in an honest discussion about the strengths and weaknesses of privacy protection on both sides of the Atlantic.

News: Privacy FederalTradeCommissionNews