Cloud Hosting

Last month, the Irish Data Protection Commission (DPC), a leading European Union privacy regulator, issued a landmark ruling suspending Metas cross-border transfer of personal data from its EU users to its U.S.-based servers. The DPCs ruling includes a record $1.3 billion fine and could potentially shutter access to Facebook and Instagram across the EU.

The consequences, though, could extend far beyond Meta. In its ruling, the DPC held that businesses cannot rely on the so-called Standard Contractual Clauses, a legal framework used by Meta and others to transfer data from the EU to the U.S. in compliance with European privacy law. That framework is used by more than 90% of businesses engaged in transatlantic commerce, a nearly $7.1 trillion industry.

A disruption in transatlantic data flows would not only take a bite out of the economy, but also impact any company doing business in the EU which relies on U.S.-based software or cloud hosting.

The DPCs ruling against Meta is the latest in a long line of high-profile EU decisions that raise fundamental questions about whether European privacy law permits any type of transatlantic data transfer given the potential for U.S. intelligence agencies to surveil personal data held by American companies.

Opinion

Get smart opinions on the topics North Texans care about.

In other words, the concern driving the EU to ban data transfers to companies like Meta closely resembles the concern driving Americans to ban TikTok: That a foreign government may be able to surveil personal data held by a foreign company.

The upshot of this overlap aside, perhaps, from a gut check that Europeans view the U.S. like Americans view China is that both problems can be addressed through a single solution: a comprehensive federal privacy law.

This law can empower consumers to manage their own data in a way that minimizes what information businesses can collect or retain and, by extension, what governments can glean from those businesses. This would solve the problem from the bottom up, with consumers themselves limiting what data is potentially subject to corporate misuse or government surveillance.

The U.S. has much to gain from passing a comprehensive federal privacy law. Such a law would not only strengthen consumer privacy (by giving consumers more control) and protect national security (by reducing what data companies like TikTok can collect), but also provide American businesses with much-needed regulatory certainty.

The latter is particularly salient given the DPCs recent ruling against Meta. It is not tenable for American businesses to operate in a state of limbo as to whether their services or software will one day be banned in Europe or other privacy-conscious jurisdictions. And European policymakers have indicated that passing a comprehensive U.S. privacy law is the best way to stabilize EU-U.S. data flows over the long term.

Indeed, the European Commission is currently rushing to finalize a new transatlantic data transfer mechanism known as the EU-U.S. Data Privacy Framework. This new framework accounts for recent changes in U.S. surveillance policy made to address EU concerns. Yet these changes have been poorly received by European policymakers because they are the product of executive rather than legislative action, and the U.S., unlike most developed countries, lacks a comprehensive privacy law that enshrines baseline protections.

In the short term, these concerns should not stop the European Commission from finalizing the new framework to sustain data flows in the wake of the DPCs Meta decision. The commission has already indicated that, at least provisionally, the new framework adequately addresses concerns about mass surveillance, and a $7.1 trillion economic disruption would harm both the U.S. and Europe.

Even if the framework is finalized, though, it may not deliver the long-term certainty that American businesses need. Like its predecessors, it will face almost immediate legal jeopardy unless or until the United States passes a comprehensive privacy law.

Rarely can a single act of legislation serve the interests of industry, consumers and national security. A federal privacy law would do just that, but the clock is ticking.

Jordan E.M. Sessler serves as privacy counsel for BigCommerce, a Texas-based ecommerce software provider. The views expressed are his own and not those of BigCommerce. He wrote this column for The Dallas Morning News.

We welcome your thoughts in a letter to the editor. See the guidelines and submit your letter here.

Follow this link:
A data privacy law is becoming more urgent every day - The Dallas Morning News