Commission offers outline, but few specifics in Safe Harbor talks

After a weekend of intense talks between senior EU and U.S. officials in Brussels, and a missed deadline for finalization, EU Justice, Consumers, and Gender Equality Commissioner Věra Jourová addressed the European Parliament’s LIBE Committee late Monday on the "state of play" of the transatlantic data-transfer negotiations. Though she did not provide much by way of specifics, Jourová did offer up a broad sketch of what’s on the table for a new agreement she described as "close ... but additional effort is needed.”

Jourová said she was not at liberty to offer up too many specific details on the talks, but said the College of the European Commission will discuss the matter in further detail on Tuesday. “Negotiations are still ongoing,” she said in her speech to the LIBE Committee, “including at the political level. There have been very intensive discussions [during] the weekend.”

A deadline for finalizing an agreement between the EU and U.S. had been set for January 31, and the EU’s data protection authorities – the Article 29 Working Party – are set to begin their deliberations on what actions they’ll take on data transfers to the U.S. on Wednesday. Without a new agreement, some DPAs are urging enforcement actions against some previously Safe Harbor-certified companies.

During her speech, Jourová sketched out the four key issues that are at play in the Safe Harbor talks: a need for limitations and protections from access to personal data by public authorities; independent oversight and the need for citizen redress with regards to national security information access; how individual complaints by citizens to private companies will be resolved; and a requirement of binding commitments from the U.S.

She also described a trust-and-monitor paradigm in the agreement. “We must trust our U.S. counterparts,” she said. “At the same time, we must check” that protections are maintained. As a result, Jourová described a clause that would suspend any agreement if the EU found protections were not maintained.

In addition to specific commitments from the U.S. at the “highest level possible,” Jourová also stressed that the “European Data Protection Authorities must have an active role in the new arrangement … whether it is on commercial aspects or national security,” EU citizens’ fundamental human rights must be protected.

Jourová, who looked visibly exhausted during the hearing, said she was also planning to speak with U.S. Department of Commerce Secretary Penny Pritzker tonight “to discuss the remaining open issues.”

Several Members of Parliament, however, were not pleased with the lack of clarity on the details of the agreement and on the level of assurance the EU would receive from its American counterparts.

“We have to look at the agreement in more detail,” said Dutch MEP Sophie in 't Veld. “We’re not talking about negotiations, we’re talking about whether the U.S. offers legitimate safeguards. You talked about written assurances from the administration, but there will be a new administration next year. What does that mean if there’s a new Trump administration or Sanders administration?”

In 't Veld also expressed doubt that the U.S. was serious about its commitments, citing the Judicial Redress Act, which recently passed a Senate committee after an amendment for national security was attached, as an example. “They have to pass a law. I don’t think they’re serious about this or else they would have done so already. They’re not sincere, are they?”

Any new agreement would have to stand up to the principles described in the Schrems decision by the European Court of Justice last October. The European Commission last week stressed that any new arrangement would have to be bulletproof against future invalidation.

But In 't Veld was not convinced that the assurances by the U.S. would be enough. “Tomorrow, Max Schrems and 1,000 of his friends are going to go to court,” she said, adding, “I want to be reassured, but I’m not reassured.”

Jan Philipp Albrecht, who has been instrumental in getting the General Data Protection Regulation close to finalization, also expressed concerns about Jourová’s presentation.

“It’s hard to assess what we have in front of us,” he said, pointing out two main questions that remained. First, Albrecht wants more details on the role and power of any U.S.-based Ombudsperson to handle EU complaints about U.S. surveillance, an idea Jourová said had been proposed by the U.S. and that was still being considered as part of the negotiations. Albrecht also queried Jourová on the enforcement capabilities of the U.S. Federal Trade Commission. “You say that the FTC needs to look at every case” brought to it by EU citizens, he said, adding, “How will that be insured?”

LIBE Committee Chairman Claude Moraes offered up two actionable items to help the Commission. First, he will call for a special hearing, open to the public, with senior EU and U.S. officials to find out more about the value of a so-called ombudsperson and other oversight measures. He also called for an official parliamentary resolution to help the Commissioner with this “strange, hybrid-type agreement.”

On Tuesday, Moraes said the European Parliament will play watchdog over any new transatlantic agreement, stating in a press release that, "although I welcome the commitments of the Commission to renegotiate the Safe Harbor agreement, I am deeply concerned about the value of the proposals in reality, from the ombudsman to the future guarantees on judicial redress."

Though Jourová couldn't offer up specifics of anything agreed to in the negotiations, she did outline three key areas that would be different in a new "Safe Harbor" agreement (she specifically said she hoped to call it something else when finalized). First is a guarantee by the U.S. government that they are not conducting indiscriminate surveillance of EU citizens. She pointed out that the U.S. has made material changes to privacy protection since the Snowden revelations. “In the context of our negotiations, we are obtaining specific written assurances from the U.S. that access by public authorities to personal data transferred from Europe will be limited to what is necessary and proportionate,” she said, adding that such assurances “must confirm” there will be no mass surveillance – unless under very specific and limited exceptions.

Which leads to the second difference: Jourová said an annual joint review will be put in place to help continuously monitor surveillance developments. To help with independent oversight and individual redress, the imposition of a U.S.-based ombudsperson could potentially be placed highly enough in the U.S. executive branch to have the clearance necessary to access specific operations by U.S. intelligence agencies and respond to EU concerns about surveillance. Several members of Parliament urged Jourová to provide more details of this proposed authority.

Finally, the third difference is that all EU citizen complaints would be resolved in some manner. Complaints by EU citizens to private companies would have a multi-layered response. First, the company should resolve the complaint itself. If that doesn't happen, an EU citizen should use an alternative dispute resolution that would be free of charge. Additionally, a citizen could complain to an EU data protection authority, who would “channel” complaints to the DoC and FTC. Since the FTC has been clear that it looks at strategic issues, instead of individual complaints, Jourová said officials are working on a “last-resort mechanism” for individuals.

Some of the greatest doubt from MEPs was expressed over the legality of the eventual agreement. Jourová noted, “this will not be an international agreement, but an exchange of letters, we need signatures at highest political level and publication of the commitments in the Federal Register.” Some MEPs expressed doubt about the efficacy of such an arrangement, but Jourová said U.S. commitments must be “formal and binding.” 

Jourová didn’t mince word about the difficulty of these negotiations, but offered a word of optimism. “It is not an easy task to build a strong bridge between two legal systems which have some major differences,” she said. “But I believe that the close partnership between Europe and the United States deserves these special efforts.”