In the wake of last week’s dramatic judgement by the Court of Justice of the European Union (CJEU), which means that transatlantic data transfers made under the Safe Harbour agreement are likely to be ruled illegal across the EU, there has been no shortage of apocalyptic visions claiming that e-commerce—and even the Internet itself—were doomed. Companies are already finding alternative, if imperfect, ways to transfer personal data from the EU to the US, although a very recent data protection ruling in Germany suggests that one approach—using contracts—is unlikely to withstand legal scrutiny. But what’s being overlooked are the much wider implications of the court’s ruling, which reach far beyond e-commerce.
The careful legal reasoning used by the CJEU to reach its decisions will make its rulings extremely hard, if not impossible, to circumvent, since they are based on the EU Charter of Fundamental Rights. As the European Commission’s page on the Charter explains: “The Charter of Fundamental Rights of the EU brings together in a single document the fundamental rights protected in the EU.” Once merely aspirational, the Charter attained a new importance in December 2009: “with the entry into force of the Treaty of Lisbon, the Charter became legally binding on the EU institutions and on national governments, just like the EU Treaties themselves.”
By anchoring its ruling in the principles underlying the Charter, the CJEU has cleverly ensured that it cannot be overturned simply by bringing in new laws, since those laws must themselves comply with the Charter.