This site may earn affiliate commissions from the links on this page. Terms of employ.

When the Snowden leaks first became public knowledge, we predicted that there could exist long-term ramifications equally a issue. The intervening period has done piddling to quell fears. Under the auspices of General Alexander and with ample support from sealed courtroom cases and secret White House decisions, the NSA began hoovering upwards data from every conceivable source. Even in situations where the NSA had the right to lodge companies to turn over private records, it opted for yet more spying. Now, after 2.5 years, some of the country'south nosotros've spied upon are beginning to push back.

Today, the European Court of Justice (CJEU) ruled that the condom harbor provision that has governed data sharing between the United States and Europe is no longer valid due to rampant NSA overreach. From the outset, the U.s. has made information technology extremely clear that not-U.s. citizens enjoy no protections where data collection is concerned. The degree of protection that US citizens relish is, itself, highly questionable — but the authorities hasn't fifty-fifty tried to mask its intent to spy on every single person on the planet that isn't from the United States. Because electric current US police force requires all US companies to automatically comply with surveillance orders, U.s.a. companies cannot guarantee the privacy and safety of EU data under EU law.

The problem, nevertheless, goes deeper than that. The NSA doesn't just claim it has the correct to spy on anyone it pleases, at any time, for any reason — information technology claims it has the right to store such data for an indefinite menses of fourth dimension, that individuals accept no right to know they are the subject of an investigation, or to challenge the grounds on which their data has been retained. From the ruling:

The Court [states] that legislation permitting the public authorities to have access on a generalized basis to the content of electronic communications must be regarded every bit compromising the essence of the fundamental right to respect for individual life.

Too, the Court observes that legislation not providing for any possibility for an individual to pursue legal remedies in gild to have access to personal data relating to him, or to obtain the rectification or erasure of such data, compromises the essence of the fundamental right to effective judicial protection, the existence of such a possibility beingness inherent in the beingness of the rule of police.

And so what happens now?

The CJEU has effectively invalidated the safe harbor provision and returned the issue to the easily of regulators in each country. From this point forward, each Eu fellow member nation will make its own decisions about how to interact with the United states of america on such issues. One potential outcome is that Usa tech companies operating in Europe could be required to keep information local to each country that they operate in, or at least within the European union itself. Firms could also exist required to explicitly turn down to hand such information over to the NSA, should it come calling. This could create issues for Us companies — Microsoft is currently fighting the DOJ over whether or not information technology is compelled to turn over information held in the EU just considering the DOJ wants to run into information technology.

epdc

Microsoft's Ireland branch has been fighting to avert handing data over US authorities.

It's tempting to hail this determination as a victory for privacy advocates nevertheless, simply I'yard not sure it is. The NSA has proven perfectly willing to ally with foreign governments to spy on targets, which means it could mayhap obtain the same information it gets now by allying with organizations like Britain'southward GCHQ. These institutions have worked mitt-in-glove with the NSA to gather information virtually their own citizens, then plough it over. Meanwhile, leaders in the EU accept already pushed to outlaw encryption — even when such practices are an important part of safeguarding citizen privacy.

Until such practices are themselves outlawed, it'southward not clear how much power whatever CJEU conclusion will have. At the very to the lowest degree, nevertheless, it'south an attempt to push back the NSA'due south ludicrous overreach and expose the hypocrisy inherent to any merits that the Usa respects the privacy or security of strange citizens.