More than 30 big US tech firms are breaking international agreed-upon US-EU Safe Harbor commitments to safeguard Europeans’ data, according to a complaint filed with the US Federal Trade Commission (FTC) on Thursday.
The Washington-based Center for Digital Democracy (CDD) claims tech giants such as AOL, Adobe, Salesforce, Datalogix, Marketo, BlueKai, Criteo, Merkle and others are ignoring their promise to keep EU citizens’ data private – as opposed to sharing it with other organisations.
None of these companies have responded to requests for comment, but we'll update when we hear more. The CDD claims "these companies are compiling, using, and sharing EU consumers’ personal information without their awareness and meaningful consent, in violation the Safe Harbor framework."
The Safe Harbor agreement is a legally enforceable but voluntary "code of conduct" for US businesses that process European citizens’ data. The bilateral deal was reached in 2000 and is supposed to guarantee Europeans data privacy in line with the 1995 EU Data Protection Directive, but following the Snowden revelations last year, many don’t believe it is worth the paper it’s printed on.
The deal let the US off the hook of having to comply with data privacy adequacy requirements for transferring data outside the EU and instead allowed companies to sign up to the agreement on a case-by-case basis. Currently 4,767 companies have so far signed up.
These companies are then authorised to display a logo showing that they are part of the scheme and the rules can be legally enforced. But last year Galexia, an Australian-based consulting company on internet law and privacy, carried out research into the Safe Harbor membership scheme and claimed it had found that around one in every seven claims is false.
According to the CDD, the 30-odd companies in the complaint are actively involved in “data profiling”.
“Our investigation found that many of the companies are involved with a web of powerful multiple data broker partners who, unknown to the EU public, pool their data on them so they can be profiled and targeted online," said CDD executive director, Jeff Chester.
The group has also claimed that the FTC is failing to enforce the Safe Harbor rules. Compiling, using and sharing EU consumers' personal information without their awareness, consent, or ability to opt out is in violation the Safe Harbor framework. In such cases the FTC could enforce sanctions.
Representatives of the EU and US are currently in negotiations to create a new, so-called data privacy “umbrella agreement” which would – possibly – give Europeans the same rights of redress as American citizens if their data is used inappropriately.
In the meantime, many in the European Parliament have called for the Safe Harbor agreement to be suspended. Following an investigation into the NSA spying revelations last year, the parliament voted to suspend the deal, but the European Commission, which would have to act on such a vote, has not done so, preferring instead to continue the “umbrella” negotiations.
Claude Moraes, Labour MEP for London, and now head of the European Parliament’s civil liberties committee, said that Safe Harbor was very far from safe and should be thrown out.
The CDD added:
Among the companies covered are data broker companies with reams of for-sale sensitive information on individual consumers, data management platforms that allow customers to rapidly analyse their own consumer information and combine it with outside data sources to produce marketing insights, and mobile marketers that track devices and tie them to user profiles so as to sell customers the most profitable consumers’ attention.