Illustration: Aïda Amer/Axios

Europe's highest court blew up the agreement that allows most data transfers between the EU and the U.S. Thursday, creating uncertainty for the tech firms that rely on the pact and likely sending officials scrambling to come up with a replacement.

Why it matters: Major global tech companies like Facebook, Google and Microsoft send troves of user data across the Atlantic daily. This decision severely complicates the future of that and sends the message that Europe doesn't accept how its citizens' data is handled stateside.

Driving the news: The Court of Justice of the European Union Thursday morning in Brussels declared as invalid Privacy Shield, the agreement that broadly governs transatlantic data transfers for most companies.

  • The court did, however, uphold the terms that tech companies sometimes put in contracts dealing with sending data out of Europe, meaning companies can still rely on such contractual language to transfer data across the Atlantic, as long as data protection authorities don't reject it.

Details: The case, known as “Schrems II,” involves Austrian privacy advocate Max Schrems, who complained that clauses in Facebook’s data contracts don't adequately protect Europeans from government surveillance in the U.S.

  • The court, in striking down Privacy Shield, said such surveillance makes it impossible to ensure that Europeans' data can be sufficiently protected once it enters the U.S., as it inherently collects more data than European law permits and European citizens have no redress if the U.S. government violates their privacy.
  • It's unlikely a U.S.-appointed ombudsperson, as established under Privacy Shield, could force American intelligence agencies to handle Europeans' data differently or would be sufficiently independent from U.S. government interests, the court concluded.

Yes, but: This doesn’t mean companies can’t ship data across the Atlantic ever again, but it will certainly be harder now. It signals diverging values around privacy between the U.S. and the EU, which has been critical of the U.S. over its surveillance practices and failure to pass a comprehensive data privacy law.

  • Both the EU and the U.S. have maintained that Privacy Shield performs well and is supposed to be continually improved upon.
  • Tech trade groups say reeling back the ability to send data internationally would disproportionately hurt small and medium-sized companies.

Flashback: Schrems launched the case that upended the previous agreement governing data flows between the U.S. and Europe, known simply as the Safe Harbor. The U.S. and Europe then came to a new agreement, 2016's Privacy Shield, which is meant to be a “living document” and reviewed yearly.

What they’re saying: "I am very happy about the judgment," Schrems said in a statement. "It is clear that the US will have to seriously change their surveillance laws, if US companies want to continue to play a role on the EU market.... As the EU will not change its fundamental rights to please the NSA, the only way to overcome this clash is for the US to introduce solid privacy rights for all people — including foreigners."

  • Trade group BSA said the decision "creates a challenge for more than 5,300" firms that relied on Privacy Shield, 70% of which, it said, are small and midsized businesses. Jason Oxman, president of fellow tech trade group ITI, called it a "significant setback for all businesses and industries in the U.S. and EU who relied on Privacy Shield."
  • “Today’s decision is nothing short of irresponsible” said Eline Chivot, senior policy analyst at tech policy think tank ITIF’s Center for Data Innovation. "In the midst of a global pandemic during which global data flows are more vital than ever, it puts all global data transfers from the EU at risk and wreaks havoc on the digital economy."
  • Meanwhile, Microsoft sought to assure customers that there shouldn't be any disruption to their data flows since the court upheld the contractual clauses.

What’s next: U.S. and EU regulators will now be tasked with negotiating a new agreement that can withstand a legal challenge.

  • That may be a tall order, given the existential issues the ruling raises with how Europeans' data gets handled once it enters the U.S.

Go deeper

Miriam Kramer, author of Space
Oct 20, 2020 - Science

Microsoft and SpaceX partner up to deliver broadband via Starlink satellites

Photo: AaronP/Bauer-Griffin via Getty Images

Microsoft is getting into the space game.

Why it matters: Huge amounts of data pour in from space to Earth each day, and the tech heavyweight sees an opportunity to capitalize on that big data and the growing markets for it.

Updated 22 mins ago - Politics & Policy

Coronavirus dashboard

Illustration: Sarah Grillo/Axios

  1. Politics: The swing states where the pandemic is raging — Pence no longer expected to attend Barrett confirmation vote after COVID exposure.
  2. Health: 13 states set single-day case records last week
  3. Business: Where stimulus is needed most.
  4. Education: The dangerous instability of school re-openings.
  5. World: Restrictions grow across Europe.
  6. Media: Fox News president and several hosts advised to quarantine.

Supreme Court rejects request to extend Wisconsin absentee ballot deadline

Photo: Saul Loeb/AFP via Getty Images

The Supreme Court rejected in a 5-3 decision Monday Wisconsin Democrats' request to reinstate an extension of the deadline for counting absentee ballots to six days after Election Day, as long as they're postmarked by Nov. 3.

Why it matters: All ballots must now be received by 8 p.m. on Election Day in Wisconsin, a critical swing state in the presidential election.