Uncle Sam’s data-privacy deal with the European Union looks poorly timed and vulnerable. The detailed provisions released on Monday will tighten how the likes of Facebook and Google parent Alphabet handle information and create an ombudsman to hear complaints about U.S. practices. Yet EU states must still approve the accord, and there are reasons for them to be wary.
The so-called Privacy Shield agreement was reached earlier this month, replacing a pact that the EU’s top court struck down last year as inadequate to protect personal data. The deal will make it easier to share credit-card transactions, search information and other digital material with the United States, while requiring companies to control access strictly. The ombudsman’s office – part of the U.S. State Department – will investigate alleged violations.
What’s missing, though, is any substantial limit on the ability of U.S. intelligence agencies to gather digital data in bulk, the habit that prompted the EU court to invalidate the prior agreement. And putting the ombudsman in the State Department undermines any claim to independence.
The timing is also less than ideal. The administration of President Barack Obama is set to allow the National Security Agency to give other American intelligence agencies the raw information it gathers, without screening it first for privacy concerns. And the Justice Department is mired in a high-profile legal battle over Apple’s refusal to help it take extra steps to hack into a smartphone used by one of the killers of 14 people in San Bernardino, California last year.
American officials say that privacy protections under the U.S. Constitution and various state and federal statutes are as strong as any in Europe, even if the process of enforcement may be different. That’s true up to a point, although it’s a stretch to claim that any rules stateside match measures like Germany’s highly restrictive Federal Data Protection Act.
Especially with the Apple case bubbling and the possible expansion of Washington’s data sharing, Europeans could be forgiven for thinking that purported U.S. national-security interests too often trump privacy. The Privacy Shield may be one deal that EU states could easily refuse.