EU-US Privacy Shield Replaced?

 

After months of legal uncertainty for cloud services, the EU has announced reaching an agreement in principle with the USA on an updated trans-Atlantic data flow deal. Products such as Google Fonts, Analytics, Stripe, and Facebook have been dogged by multiyear complaints relating to trans-Atlantic data flows as these tech giants have been trying to exhaust all legal challenges. Meta will now likely not have to suspend its operations as the EU is expected to suspend EU-USA data transfer enforcements and introduce a grace period until a final agreement has been reached and the new deal has been adopted.

While this all sounds good, the fine details of the revised deal and how the gap has been closed between the EU’s and USA’s 2 very different legal systems was not made clear at the announcement of this development. Any new deal will face the prospect of legal challenges, just as the Safe Harbor agreement did in 2015 due to EU citizen’s privacy rights and US surveillance laws.

Since the announcement, the White house has released a fact sheet on the new framework agreement which explains that EU citizens can seek redress through an independent ‘Data Protection Review Court’ that will consist of people from outside the US government and can adjudicate claims and direct remedial measures as necessary. However, the Commission took a similar approach with Privacy Shield and Safe Harbor in the past, until the court enacted a very different view. EU commissions and their US counterparts cannot provide a final assessment here, and only the European Court of Justice can.

Max Schrems, an outspoken sceptic of trans-Atlantic data transfer deals, voiced his concerns over this reformed deal by mentioning little reform on the US side. He also threatened that it was possible, via civil litigation and preliminary injunction, to take any new agreement to the Court of Justice of the European Union (CJEU) within months should EU law not be respected in the reformed deal. He was quoted as saying:

 “Once the final text arrives we will analyse it in depth, together with our U.S. legal experts. If it is not in line with EU law, we or another group will likely challenge it. In the end, the Court of Justice will decide a third time. We expect this to be back at the Court within months from a final decision,” he noted in a statement, “It is regrettable that the EU and U.S. have not used this situation to come to a ‘no spy’ agreement, with baseline guarantees among like-minded democracies. Customers and businesses face more years of legal uncertainty.”

Google, Meta, and the CCIA technology industry association all predictably welcomed the news and commended the European Commission and US government for coming to a new agreement in principle. However, CCIA director Alexandre Roure did express some concerns for upcoming EU rules surrounding industrial and connected device data reuse which is expected to introduce new data restrictions.

EU Finalises Big Tech Competition Regulation

 

On Thursday 24^th March 2022, the EU finalised an agreement reforming competition amongst technology platforms about how they can operate – levying fines of up to 10% of global annual revenue to those who breach the requirement, and 20% for repeat violators. The ‘Digital Markets Act’ (DMA) will apply to companies providing “core platform services” that have a market cap of over €75 billion or an annual turnover of €7.5 billion and targets social networks and search engines. To further fall under the scope of the DMA, companies must have 45 million monthly users in the EU and over 10,000 business users annually.

Companies such as Spotify currently do not fall under scope of the DMA, but larger US technology companies such as Google, Meta, and Apple do. EU lawmakers have been putting together this regulation for many years due to competition concerns in the digital landscape. The European Parliament reiterated that this regulation ensures more innovation and competition in the ‘Big Tech’ space, ultimately providing more choices for users. The DMA directly bans anti-competitive practices in the technology industry for which the EU has been imposing fines for over the past decade.

One of the key requirements of the regulation includes interoperability between messaging platforms. This means smaller competitors can request larger services, such as WhatsApp and Facebook Messenger, allow users to send messages, files, and make video calls across different applications. This is a significant step forward for consumers and businesses who may object to the policies of such platforms, but cannot switch platforms because they may lose the ability to message friends and customers.

Messenger services falling under scope will have to open up their APIs to competitors to enable interoperability features; this applies to both large and smaller platforms. The regulation implicitly states that messaging must remain end-to-end encrypted, and this must be phased in no matter how long it takes. Interoperability for social media services will also be assessed in the future, but is not currently being introduced.

The DMA also regulates the use of personal data and requires that services obtain explicit consent from users to use in targeted advertising. This has been introduced to allow individual’s greater control of their personal, private data and whether they wish to be tracked across services and devices. There will also be a limit on how many times services can ask for your consent to avoid “consent fatigue”. This has currently been set to once per year.

The regulation also stipulates that users should be able to freely choose their own browser, search engines, and virtual assistants in the event that these services are operated by a big tech company. This removes the pre-selected defaults for these platforms. Other obligations include:

·         Allowing app developers fair access to supplementary functions of smartphones (e.g. NFC chip);

·         Ensuring users have the right to unsubscribe from core platform services;

·         Provide sellers access to their marketing and advertising performance data through the platform;

·         And inform the EC of any mergers and acquisitions.

These companies may also not rank their services or products higher than other competitors, they may not reuse private data for other services, they may not establish unfair conditions for business users or pre-install software applications, and they may not require app developers to use certain services in order to be listed in app stores.

The EC is solely responsible for legally enforcing the DMA, but the commission will engage in regulatory dialogue first to ensure companies are clear in their responsibilities. The final legal text must still pass the Parliament and Council before being published and coming into force 3 weeks later. However, the agreement in place today is a much larger hurdle to cross than these formalities.