

The EU and US have missed a deadline to fix new rules to protect Europeans’ personal data from US government snooping, with officials from the European commission and US Department of Commerce remaining locked in talks after a self-imposed January deadline came and went.

“There have been constructive but difficult talks over the weekend,” a commission spokesperson said on Monday. “Work is still ongoing, we are not there yet, but the commission is working day and night on achieving a deal.”



The two sides have been racing to rewrite rules on sharing European citizens’ data across the Atlantic, after the European court of justice ruled last October that the EU-US “safe harbour” rules were invalid.

The safe harbour agreement was drawn up in 2000 to facilitate the seamless transfer of data across the Atlantic, but vanished overnight with the court decision after a wider outcry in Europe about the revelations of US whistleblower Edward Snowden.

The case was triggered when an Austrian law student and privacy campaigner, Max Schrems, launched a complaint against Facebook in 2013, shortly before Snowden revealed that the US National Security Agency was routinely intercepting data from emails, social media and telephones.



Schrems had initially wanted to find out what had happened to his personal records, but Snowden’s revelations encouraged him to take action against the data regulator in Ireland, where Facebook has its European headquarters.

EU privacy law forbids the movement of citizens’ data outside the bloc unless it is transferred to a location deemed to have protections in line with European standards.



Although an agreement could be reached in the next few days, the two sides remain at odds over how to monitor a new data-sharing agreement and get redress for EU citizens, an EU source said.

Whether or not an agreement is reached between the EU and US, regulators from Europe’s 28 national data protection agencies will meet on Tuesday and Wednesday to work out the next steps. Their decision will affect 4,000 companies including Facebook, Google and Microsoft, as well as many smaller companies which were using the safe harbour agreement to transfer employee or customer data across the Atlantic.

Following the ECJ decision last October, companies have been looking into alternatives to safe harbour, such as writing data-sharing clauses into terms and conditions. But it is unclear whether these will satisfy European regulators who will determine whether they are in line with the ECJ judgement.

Henriette Tielemans, a partner at the law firm Covington & Burling, said companies faced “enormous uncertainty” about what European regulators would deem adequate privacy protection.



“If there is no agreement on safe harbour 2.0 that doesn’t mean there are no alternatives,” she said. “There are very valid alternatives. The real question for me is: are these alternatives going to be changed or abolished?”