European data privacy rulings put pressure on American tech companies

Last week, a French court found a local company’s use of Google Analytics — which tracks and reports web traffic — violated French civilians’ rights. It’s a decision that mirrored a ruling in Austria just a month before and is part of a larger push in the European Union to manage how American companies use residents’ data.

The EU had an agreement saying that American companies and laws provided adequate protections for European user data. But in July 2020, European courts severed the pact, saying the agreement didn’t provide enough protection from surveillance. Negotiations for a new deal are ongoing.

Caitlin Fennessy is vice president of the nonprofit International Association of Privacy Professionals, based in the U.S. Because of recent court decisions abroad, she said, the pressure is on for companies and negotiators.

Caitlin Fennessy: The need for these data transfers is growing while the compliance options to allow them is shrinking rapidly. A lot of these rules were built around commercial protections. But as we all know, companies truly can’t control the laws that govern surveillance. And so there is a bit of a challenge here where companies are being called on to address challenges that truly governments need to work together to solve on the surveillance side.

Kimberly Adams: What does the current state of play mean for how a company like Google operates in Europe?

Fennessy: It means that the risk profile that companies are facing right now is just a lot higher. Now, basically, the first two enforcement actions that we saw come out of Europe around Google Analytics are the first two decisions in 101 cases that were framed similarly across Europe. So, we can expect in the weeks and months ahead to see dozens of additional enforcement actions come down similarly. Importantly for businesses, I think, the risk is not just of enforcement, but the risk is that their EU partners will themselves recognize the heightened risk that they face as this enforcement cascades and pull back from partnerships with U.S. partners.

Adams: With these decisions coming down, companies kind of scrambling, what do all these recent developments mean for the ongoing negotiations between the U.S. and the EU for a potential new agreement?

Fennessy: There’s no question that these latest enforcement actions just turned the ratchet in terms of the pressure that everyone faces here. Both sides — the U.S. and the EU — do not want to see another framework fall, and I think we can all expect it will be challenged nearly immediately. And so they’re working to build something that will hold up and will be sustainable.

Adams: Yeah, and I mean, with all these decisions coming down, are companies proactively making any changes to try to get ready? Or are they sort of in a wait-and-see moment?

Fennessy: They have been proactive. They’ve been conducting transfer impact assessments and looking at options to localize and build data centers in Europe. So, I think a big question that companies and governments face is, you know, how much will change about how these services are structured and operate before a government-negotiated solution is reached? And are those changes in a direction that U.S. and EU policymakers and businesses think is helpful or not?

Related links: More insight from Kimberly Adams

Google released a statement earlier this year calling for a new framework for data sharing between the EU and U.S. The company also put out a blog post about Google Analytics — the target of the cases in Austria and France. In that post, Google said it has worked to meet the EU’s privacy standards when it comes to data transfers across the Atlantic.

Politico EU also has also an article on the French decision and what it means for trans-Atlantic data transfers more broadly.

Speaking of data collection, the EU is not the only one reevaluating its practices. On Wednesday, Google announced it’s doing a little self-regulation, adopting new policies to limit ad tracking across apps on Android devices, following in Apple’s footsteps a year later. But those official changes, like negotiations, will take some time.