1. People who are focusing on Mark Zuckerberg's testimony to Congress are missing the point. What happens to Facebook in Europe is far more important - and the stakes just got far, far higher this morning thanks to a legal decision in Ireland.
2. Back in 2015, a young privacy activist and lawyer, @maxschrems took a court case in Ireland, where Facebook's European operations are based. He argued that Facebook, by transferring personal data to the US, was exposing it to mass surveillance and thus breaking EU privacy law.
3. If you want the gory details, read the later parts of this paper by @ANewman_forward and me, forthcoming in World Politics - dropbox.com/s/hf2uau5jq7h7… . No-one in the US took this case very seriously. They made a big mistake. The Irish High Court made a finding of fact that
4. large scale surveillance had happened. He then referred it to the European Court of Justice, to rule on the European law. The ECJ issued a humdinger of a ruling. It effectively revoked the treaty-like arrangement under which the EU and US allowed companies to transfer data.
6. The result was consternation - Eric Schmidt saying that the Internet itself was endangered by the ruling - and a panicky effort by the EU and US to negotiate a new arrangement - the so-called Privacy Shield, to allow the forwards and backwards transfer of data.
7. See further foreignaffairs.com/articles/unite…. So, Schrems took another case in Ireland against Facebook. This time, the US took it seriously, hoping to forestall another catastrophe, quietly working with Facebook lawyers to prevent another damaging set of factual findings.
8. It didn't work. Today, the Irish Court released its findings. It has found that there is "mass indiscriminate processing" of European citizens' personal data by US surveillance programs. It has referred the matter to the ECJ for further consideration - irishtimes.com/business/techn…
9. What does this mean? First - that it is _highly likely_ that the ECJ will take down the Privacy Shield, leaving US companies with no ability to transfer data to the US. This is a huge problem for e-commerce companies - and a potential catastrophe for Facebook
10. if no other solution is found. The ECJ will likely demand US concessions on surveillance of EU citizens that US three letter agencies are going to be unwilling to make. Privacy Shield tried to square this by effectively pretending that the US was making concessions
11. when in fact it was largely re-describing existing US practice. That is probably not going to wash, given the Irish court's new findings, and the ECJ's activism on privacy/data protection issues. The current controversies around Facebook don't help much either.
12. And the magical words "Donald J. Trump" will not be sprinkling any happy pixie dust to soothe European judges' fears about what the US might do with data that it is gathering on EU citizens.
13. The Irish court further has suggested that the specific means through which Facebook looks to transfer data to the US - so called Standard Contractual Clauses on privacy - look to be inadequate under EU privacy law. This is also a very big deal for US companies.
14. Finally, the other interesting twist is that the Irish court has asked the ECJ to rule on the question of whether individual national (or, in Germany, Laender-level) officials might be obliged to block data flows to Big Surveillance, or have discretion, and if so how.
15. The ECJ may be cautious in ruling on this (in its last judgment it set out a complex system of referrals). If it is not cautious, and offers a significant judgment providing discretion or demanding blockages, big tech companies are in a whole world of hurt. Finis.
[that should just be “transfer of data”- wrote this too quickly)
