WHEN senior European Union officials recently went to America to seek answers about Edward Snowden’s claims of wholesale snooping, including on EU institutions, they were told to mind their own business. Didn’t the visitors know how much spying was done by their own members? Britain, too, warned the European Commission that security matters were outside its remit. The Eurocrats’ only consolation is that the world’s spooks still think them important enough to be spied on.
Yet at least one person cheered the disclosure of PRISM, which helps American spooks collect information held by big internet firms such as Google and Facebook. “Thank you, America, for PRISM, which has helped us to make a very strong data protection law in Europe,” declared Viviane Reding, the justice commissioner, whose campaign for new EU-wide rules on data privacy has unexpectedly revived. Ms Reding is a loose cannon. But this week she won a powerful ally: Angela Merkel. Two months before Germany’s election, the chancellor is accused of prevaricating, amid allegations of German collusion with American spies. Now she, too, wants “very strict” data-privacy rules.
Mrs Merkel has tried to avoid a bust-up with America. She made sure transatlantic trade talks started on time despite a half-hearted French attempt to block them over the spying scandal. And she has refrained from repeating warnings by the European Parliament and Cecilia Malmström, the commissioner for home affairs, that the EU might suspend two programmes for data-swaps on airline travellers (Passenger Name Record, or PNR) and money transfers (the Terrorist Finance Tracking Programme, or TFTP). Instead, she has focused on updating the EU’s outdated data-privacy rules, which will not come into force for years, long after the furore over Mr Snowden has died down.
Still this legislation may have the most profound effect of all, not because it will stop spying but because it could shape the future of cloud computing and the internet economy. The commission presents its data-privacy regulation, launched in January 2012, as an attempt to rationalise 28 national laws passed under the loose framework of a 1995 EU directive. It is meant to reduce costs to firms, promote a European digital single market and give citizens more control over their personal information. It has been the subject of intense lobbying by the Americans. So far EU governments have reached broad agreement on four of 11 chapters; MEPs have tabled some 3,000 amendments.
One big issue is the proposed “right to be forgotten”. This is meant to make it easier for users to delete personal information (eg, embarrassing photographs). But internet firms don’t want to have to chase down information copied onto other websites. Britain, the Netherlands and Sweden hope to water down the proposed law because they think it is too onerous, particularly for small and medium-sized firms, and could stifle innovation.
Now the focus will shift to rules that companies must follow before handing over personal data to law-enforcement or intelligence agencies abroad. Given that much of the world’s internet traffic is routed through America, and that most online data is held there, American intelligence agencies have a “home advantage”. President Barack Obama’s reassurance that PRISM “does not apply to US citizens and it does not apply to people living in the United States” offers little comfort to Europeans.
An umbrella agreement to regulate data transfer between America and the EU is stuck on the issue of non-discrimination. Under the Foreign Intelligence Surveillance Act (FISA), which authorises America to eavesdrop on international telephone calls and online data, Europeans do not enjoy the same protection and judicial means of redress as Americans. Unless the matter is solved, says the EU, the PNR and TFTP deals will be in danger.
The commission now wants to impose similar rules through its data-protection law, which would apply to information on European citizens held anywhere in the world. The EU has two weapons at its disposal. The first toughens up the criteria for defining which non-EU countries have adequate data-protection rules. This could undermine the “safe harbour” rule that uniquely allows American firms to certify they are in compliance. The second threatens any company that breaches EU privacy rules with fines of up to 2% of gross turnover.
The other e-war
As with so much else, privacy and security have different values for Americans and Europeans. “For Americans data privacy is a matter of consumer law; for Europeans it’s a fundamental right,” says Jean-Louis Bruguière, a former French counter-terrorism judge. Given their experience of totalitarianism under both Nazis and Communists, Germans in particular have an instinctive aversion to the all-knowing secret state. Yet in private the German government knows it must rely on America’s intelligence establishment to help keep its citizens safe. No EU law is going to stop spooks trying to get at online data. But new rules could place companies in a bind and raise the political cost to America of being found sifting through Europeans’ personal data.
A separate, unspoken objective by the EU may be to gain an edge in the internet economy. By setting a “global standard” on data privacy, and extending it beyond Europe’s shores, the EU hopes to strengthen its hand in transatlantic trade talks. It would level the regulatory burden, to the detriment of America’s internet giants, but perhaps also Europe’s start-ups. Toomas Hendrick Ilves, president of Estonia, argues that the right response to PRISM should be to create a secure “European cloud” with high data-protection standards. But this will not resolve the question of spying either: the rules governing spooks in European countries are often far laxer than those in America.