America and the European Union have reached a deal on data protection, But Is Europe Safe From the Eavesdroppers?

Swords and shields

February 6, 2016 (print edition)

NAIVETY and paranoia mark the European Union’s attitude to espionage. The EU does not have a spy agency, nor does it have access to the intelligence collected by its members and their allies. That has advantages: EU decision-makers need not worry about keeping secrets (because they do not know any); nor must they grapple with the legal and political practicalities of intelligence oversight—such as what access spooks have to private data. The downside is that they do not see the benefits of espionage, and have a lurid fear (mixed perhaps with envy) of what spy services, particularly American ones, get up to.

Yet it is the European Parliament which votes on data-protection rules, the European Commission which negotiates agreements with other countries, and the judges of the European Court of Justice (ECJ) who have the final say on whether those deals meet the right standards. And in October 2015 the ECJ, on the advice of the Commission and to the applause of many parliamentarians, upended the “Safe Harbour” agreement which for the past 15 years had allowed foreign companies to store Europeans’ personal data on American computers.

The arrangement had been extremely useful, both for the giants of the internet economy, which could market their services seamlessly on both sides of the Atlantic, and for much smaller businesses—for example those which outsource payroll and other services to American contractors. But it rested on the idea that America protected privacy to European standards. After the revelations of Edward Snowden, an American intelligence contractor who has fled to Moscow, many found that hard to believe: “mass surveillance”—to use the Orwellian term favoured by Mr Snowden’s supporters—of all data held in America seemed a fundamental breach of Europeans’ right to privacy.

From an American point of view, that looked like self-indulgent posturing. The Snowden material was grossly misinterpreted. All foreign-intelligence outfits spy on foreigners: the clue is in the name. “Bulk collection” (to use the spooks’ preferred term) is a necessary part of modern intelligence work: all spy agencies that can collect and sieve information from the internet will do so. But America’s spies operate under a level of legislative and judicial oversight that no European country can match. Indeed, since a presidential directive in January 2014, America, uniquely, puts foreign and domestic personal data on the same footing as far as bulk collection is concerned.

Moreover, European countries’ spy agencies benefit hugely from intelligence-sharing with America about terrorism, organised crime and the activities of countries such as Russia and China. That politicians fail to acknowledge this to their own voters smacks of timidity and ingratitude. There may be disguised protectionism involved too: European privacy worries mask a degree of envy of America’s digital dominance. Europe has signally failed to develop rivals to Amazon, Apple, Facebook or Google.

Against that difficult background, this week’s outline deal on a new agreement to replace Safe Harbour looked like something of a triumph. Under heavy pressure from internet and technology companies on both sides of the Atlantic, and with the prospect of a transatlantic trade war on data looming, both sides have moved. In the new “Privacy Shield”, America has offered to institute safeguards and limits on its surveillance programmes. Europeans will be able to complain individually or at an institutional level about breaches, including to a new ombudsman in the State Department. The new deal will be reviewed annually.

Many obstacles lie ahead. Europe’s national data-protection agencies welcomed the deal but said they wanted more details—to be provided by the end of the month. If any one of these regulators is unhappy, it can ban its country’s companies from sending data to America. That would prompt another long legal battle, probably ending in the ECJ.

Even if the bureaucrats give grudging approval, privacy campaigners find the Privacy Shield farcical. Given that intelligence agencies operate in secret, how will anyone know—unless another Snowden blows the whistle—that their data are being snooped on unlawfully? The next administration may change the rules. And in any case, why should anyone believe what American spymasters say? A legal challenge to the new deal looms. But once the Commission has issued a beefed-up “adequacy decision”, it will be harder for the ECJ to strike it down. In the meantime, the transatlantic data economy can keep humming.

Control all, delete

For all its real and imagined flaws, the new deal shows that transatlantic negotiations still work. It gives hope for the ailing Transatlantic Trade and Investment Partnership (TTIP), a counterpart to the Trans-Pacific Partnership which America and 11 Pacific-rim countries signed on February 4th. It also shows a realistic grasp on both sides of the importance of transatlantic ties. European neuroses madden America just as American swagger intimidates and annoys Europeans. But each side needs the other. Europe is America’s biggest trade partner. America is the keystone of European security. (That was highlighted this week by America’s announcement that it will quadruple defence spending on deterring Russia in NATO’s eastern frontline states.)

Perhaps even more important, the Privacy Shield may stop the slide towards the fragmentation of cyberspace along national lines. Since its inception, the internet has struggled to stay a borderless space for ideas and commerce. Countries such as China have established what they see as sovereignty over their computers and networks, protecting themselves from threats such as “information weapons” (also known as “news”). Others are itching to follow. If America and the EU, with their shared history, interests and values, could not reach agreement over safeguarding their citizens’ data, there would be little hope for anyone else.