More than 30 big US tech firms are breaking international agreed-upon
US-EU Safe Harbor commitments to safeguard Europeans’ data, according
to a complaint filed with the US Federal Trade Commission (FTC) on
Thursday.
The Washington-based Center for Digital Democracy (CDD)
claims tech giants such as AOL, Adobe, Salesforce, Datalogix, Marketo,
BlueKai, Criteo, Merkle and others are ignoring their promise to keep EU
citizens’ data private – as opposed to sharing it with other
organizations.
None of these companies have responded to requests for comment, but
we'll update when we hear more. The CDD claims "these companies are
compiling, using, and sharing EU consumers’ personal information without
their awareness and meaningful consent, in violation the Safe Harbor
framework."
The Safe Harbor agreement is a legally enforceable but
voluntary "code of conduct" for US businesses that process European
citizens’ data. The bilateral deal was reached in 2000 and is supposed
to guarantee Europeans data privacy in line with the
1995 EU Data Protection Directive, but following the Snowden revelations last year, many don’t believe it is worth the paper it’s printed on.
The
deal let the US off the hook of having to comply with data privacy
adequacy requirements for transferring data outside the EU and instead
allowed companies to sign up to the agreement on a case-by-case basis.
Currently 4,767 companies have so far signed up.
These companies
are then authorised to display a logo showing that they are part of the
scheme and the rules can be legally enforced. But last year Galexia, an
Australian-based consulting company on internet law and privacy, carried
out research into the Safe Harbor membership scheme and claimed it had
found that around one in every seven claims is false.
According to the CDD, the 30-odd companies
in the complaint are actively involved in “data profiling”.
“Our
investigation found that many of the companies are involved with a web
of powerful multiple data broker partners who, unknown to the EU public,
pool their data on them so they can be profiled and targeted online,"
said CDD executive director, Jeff Chester.
The group has also
claimed that the FTC is failing to enforce the Safe Harbor rules.
Compiling, using and sharing EU consumers' personal information without
their awareness, consent, or ability to opt out is in violation the Safe
Harbor framework. In such cases the FTC could enforce sanctions.
Representatives
of the EU and US are currently in negotiations to create a new,
so-called data privacy “umbrella agreement” which would – possibly –
give Europeans the same rights of redress as American citizens if their
data is used inappropriately.
In the meantime, many in the
European Parliament have called for the Safe Harbor agreement to be
suspended. Following an investigation into the NSA spying revelations
last year, the parliament voted to suspend the deal, but the European
Commission, which would have to act on such a vote, has not done so,
preferring instead to continue the “umbrella” negotiations.
Note EU-Digest: If
the EU Commissions is able to override the EU Parliament on issues of
Personal Privacy etc. there is something horribly wrong with the
application of Democratic rule in the EU. In case the so-called
"umbrella" rule ever gets implemented without proper review by the EU
and national parliaments European citizens will find their personal
rights even more curtailed than they are now. The EU Commission and the
EU parliament better get their act together.
Read more: What happens in Europe, doesn't stay in Europe: US giants accused of breaking EU privacy pact • The Register