European data privacy rulings put pressure on US tech companies
Last week, a French court found that a local company’s use of Google Analytics – which tracks and reports web traffic – violated the rights of French civil servants. It’s a move that mirrors a decision in Austria just a month prior and is part of a larger push in the European Union to manage how US companies use resident data.
The EU had an agreement that US companies and laws provide adequate protections for European user data. But in July 2020, European courts broke the pact, saying the agreement did not offer sufficient protection against surveillance. Negotiations for a new agreement are ongoing.
Caitlin Fennessy is Vice President of the non-profit, US-based International Association of Privacy Professionals. Due to recent overseas court rulings, she said, the pressure is on companies and negotiators.
Caitlin Fennessy: The need for these data transfers is growing while compliance options to allow them are rapidly diminishing. Many of these rules were built around trade protections. But as we all know, companies really can’t control the laws that govern surveillance. And so there’s a bit of a challenge here where companies are called upon to address challenges that governments really need to work together to solve on the oversight side.
Kimberly Adams: What does the current situation mean for the way a company like Google operates in Europe?
Fennessy: This means that the risk profile companies currently face is simply much higher. Now, basically, the top two enforcement actions we’ve seen coming out of Europe around Google Analytics are the top two decisions in 101 cases that were worded similarly across Europe. We can therefore expect in the coming weeks and months to see dozens of additional enforcement actions fall in the same way. What’s important for business, I think, is that the risk is not just enforcement, but the risk is that their EU partners themselves recognize the increased risk they face as that this application is cascading and withdrawing from partnerships with American partners.
Adam: With these decisions coming and business scrambling, what do all of these recent developments mean for the ongoing negotiations between the US and EU for a potential new deal?
Fennessy: There is no doubt that these latest enforcement actions have just reversed the pressure in terms of the pressure that everyone is facing here. Both sides – the US and the EU – do not want to see another framework fall, and I think we can all expect it to be challenged almost immediately. And so they work to build something that will hold up and be durable.
Adam: Yeah, and I mean, with all these decisions coming in, are companies proactively making changes to try to prepare? Or are they kind of in a waiting moment?
Fennessy: They have been proactive. They conducted transfer impact assessments and examined options for locating and building data centers in Europe. So I think a big question that businesses and governments face is, you know, how much is going to change the way these services are structured and operate before a government-brokered solution is found? And are these changes going in a direction that American and European policymakers and businesses find useful or not?
Google released a statement earlier this year calling for a new framework for EU-US data sharing. The company also published a blog post on Google Analytics, the target of the cases in Austria and France. In this article, Google said it had made every effort to meet EU privacy standards when it comes to data transfers across the Atlantic.
Politico EU also has an article on the French decision and what it means for transatlantic data transfers more broadly.
Speaking of data collection, the EU is not alone in reassessing its practices. On Wednesday, Google announced it was doing a little self-regulation, adopting new policies to limit in-app ad tracking on Android devices, following in Apple’s footsteps a year later. But these official changes, like negotiations, will take time.