Brad Smith, Microsoft’s president and chief legal officer, published a blog post about the effects of a collapse of the Safe Harbour agreement between the US and EU. In the blog post, Smith asks the US government to comply that “it will only demand access to private information stored in the United States and is from an EU national in a way that follows EU law and vice versa.”
Smith follows up by stating that “privacy is a fundamental human right,“ and also mentions that privacy rights lose their meaning when they change each time data transfers from one jurisdiction to another.
“Individuals must not lose their rights because their private information crosses a border. While never stated quite directly, this principle underlies every aspect of the European Court’s decision, and it makes sense.”
As a result, Smith concludes that “we need to make sure across the Atlantic that people’s rights move with the data they take with them.” If that takes place, and the US government is to implement EU law to EU data held in the US, it would comply with the stipulation of the Court of Justice of the European Union (CJEU) in its Safe Harbour ruling.
The ruling states that the legal protection for the private date of EU nationals held in the US should be “essentially equivalent” to those available to them in Europe for it to comply with EU legislation.
Understanding the authorities would still need access to the personal data stored under certain situations, Smith also asks for “an expedited process for government entities in the EU and US to access personal online information that moves across the Atlantic and belongs to each other’s citizens by serving lawful requests directly with the appropriate authority in an individual’s home country.”
Governments can only seek for information within the boundaries of their own laws; the passing of judgment on requests will follow the rules of the receiving government. “If the designated authority determines the request consistent with the privacy protections and other requirements of the citizen’s local law, it would validate and give it legal basis, authorizing disclosure,” Smith states.
An allowable exception to the proposed framework occurs when citizens move physically across the Atlantic. Smith suggests, “The US government should have permission to turn solely to its own courts under US law to acquire date about EU nationals that move to the US, and the same is true for a European government when American citizens reside there.”
The fact that Microsoft is advocating what are radical thoughts for an American company displays the concern over the fallout of the Safe Harbour framework. The blog post comes at a time when EU and US governments are trying to produce a replacement for the collapsing framework, which needs to be in place by the end of January 2016.