It's a cliché that "data is the new oil"—a metaphor that dates back to at least 2006. Like oil, data is beginning to drive conflict, as different political blocs fight for control of how this valuable resource flows around the world. That tussle is at a critical juncture because of the confluence of three major factors: the Snowden revelations about massive online surveillance; key judgments by Europe's top court; and attempts by the US to use major trade deals to lock in unrestricted data flows globally.

The growing awareness of the importance of data flows to both technology and the world's economy is reflected in the number of reports on the topic that have been issued recently. For example, in April 2014, McKinsey published "Global flows in a digital age," which noted:

Global online traffic across borders grew 18-fold between 2005 and 2012, and could increase eightfold more by 2025. Digital technologies, which reduce the cost of production and distribution, are transforming flows in three ways: through the creation of purely digital goods and services, “digital wrappers” that enhance the value of physical flows, and digital platforms that facilitate cross-border production and exchange.

A month later, the European Centre for International Political Economy (ECIPE) issued a report that aimed to "quantify the losses that result from data localisation requirements and related data privacy and security laws that discriminate against foreign suppliers of data, and downstream goods and services providers." Data localisation in this context means keeping data within the same country—or legal bloc, in some cases—where it originated.

According to ECIPE's econometric modelling, if the European Union were to introduce economy-wide data localisation requirements that applied across all sectors of the economy, its GDP would suffer a loss of 1.1 percent as non-EU companies run fleeing to the hills. ECIPE said domestic investments would fall by 3.9 percent, and the economic losses suffered by EU citizens would total £156 billion (€182 billion, $193 billion).

The Snowden revelations

One reason why many countries were and still are considering data localisation requirements that would force companies to keep data within national or legal boundaries, is the Snowden leaks. These showed the NSA and GCHQ carrying out surveillance on a hitherto unsuspected scale. In particular, Edward Snowden revealed that both agencies spied on data as it flowed across US and UK borders to and from other countries.

An obvious way to avoid this problem is to keep data in the country where it is generated, to minimise opportunities for foreign interception. That too has issues—for example, it's easier for national governments to spy on and demand information—but it does place obstacles in the way of external intelligence agencies like the NSA and GCHQ.

One country that has already adopted this approach is Russia, which passed a data localisation law in 2014. LinkedIn's failure to comply means that the soon-to-be Microsoft subsidiary faces the prospect of Russian ISPs blocking access to its site. As Ars has reported, China too is bringing in data localisation requirements.

Perhaps even more important than Snowden's impact on governments' future data localisation policies have been the knock-on consequences of his revelations for the "Safe Harbour" framework that has governed data flows from the EU to the US since 2000. In 1998, the EU's directive on data protection went into effect, which prohibited the transfer of personal data to non-European Union countries that do not meet the 28-member-state bloc's "adequacy" standard for privacy protection—in other words, that offered sufficient safeguards for personal data.

The Safe Harbour website explains: "In order to bridge these differences in approach and provide a streamlined means for US organisations to comply with the Directive, the US Department of Commerce in consultation with the European Commission developed a 'Safe Harbour' framework and this website to provide the information an organisation would need to evaluate—and then join—the US-EU Safe Harbour programme."

Snowden's leaks showed the NSA gaining access to personal data held by major US online companies like Facebook as part of the PRISM programme. As a result, the Austrian privacy activist Max Schrems brought a legal challenge to data transfers made between the EU and the US using the Safe Harbour framework. As his site puts it: "Safe Harbour does not allow for [data] forwarding as it is performed under PRISM. If it would allow such forwarding the 'Safe Harbour Decision' would itself be illegal under Regulation 95/46/EC [the EU directive on data protection]."

Since Facebook has its European headquarters in Ireland, Schrems took his complaint to the Irish data protection agency. According to Schrems, the Irish data protection commissioner argued that "he does not have any duty to investigate the complaint and later argued that the legal view expressed in the complaint is 'frivolous'." As a result, Schrems' complaint was not investigated.

Schrems sought a judicial review by the Irish High Court, which then asked the Court of Justice of the European Union (CJEU) to rule on issues raised by the Safe Harbour framework. On October 6 last year, Europe's top court handed down its judgment, which effectively struck down Safe Harbour. The central problem, the court found, was that PRISM allowed "access on a generalised basis to the content of electronic communications," which the CJEU said "must be regarded as compromising the essence of the fundamental right to respect for private life," and therefore unacceptable under EU law.

Unless a suitable replacement for Safe Harbour could be found, data flows across the Atlantic would be illegal, and companies continuing to transfer EU personal data to the US risked large fines. What was needed was an upgraded version of Safe Harbour, otherwise US companies faced the prospect of being forced to keep all the personal data of their EU users within the European Union, something they insisted they were reluctant to do.

After fraught negotiations, the new Privacy Shield framework was announced on July 8. The European Commission claimed it was "fundamentally different" from Safe Harbour, and ruled out "indiscriminate mass surveillance":

The EU-US Privacy Shield will ensure a high level of protection for individuals and legal certainty for business. It is fundamentally different from the old 'Safe Harbour': It imposes clear and strong obligations on companies handling the data and makes sure that these rules are followed and enforced in practice. For the first time, the US has given the EU written assurance that the access of public authorities for law enforcement and national security will be subject to clear limitations, safeguards and oversight mechanisms and has ruled out indiscriminate mass surveillance of European citizens' data. And last but not least the Privacy Shield protects fundamental rights and provides for several accessible and affordable redress mechanisms.

Reactions to the new Privacy Shield were mixed. Microsoft called it "an important achievement for the privacy rights of citizens across Europe, and for companies across all industries that rely on international data flows to run their businesses and serve their customers."

Schrems, by contrast, said: "Privacy Shield is the product of pressure by the US and the IT industry—not of rational or reasonable considerations. It is little more than an little upgrade to Safe Harbour, but not a new deal. It is very likely to fail again, as soon as it reaches the CJEU." Joe McNamee, executive director of European Digital Rights, agreed with this view: "We now have to wait until the court again rules that the deal is illegal and then, maybe, the EU and US can negotiate a credible arrangement that actually respects the law, engenders trust and protects our fundamental rights."

News that Yahoo had been secretly scanning customers' e-mails greatly increases the likelihood of the Privacy Shield scheme being thrown out by the EU's top court. Snowden tweeted that during the Privacy Shield negotiations the US insisted that this kind of spying would never occur. As a result, the CJEU judges are unlikely to be impressed by any claims that Privacy Shield complies with EU laws.

A legal challenge to the Privacy Shield framework has already been filed, but not at the Court of Justice, which heard and threw out Safe Harbour. Instead, Digital Rights Ireland is asking the lesser-known General Court of the European Union to annul Privacy Shield, still on the grounds that it affords insufficient privacy protection to EU citizens.

Listing image by Hervé Cozanet