A solution to the Safe Harbor data framework will not hit its January 2016 deadline, raising the possibility of large fines levied against companies like Facebook in the New Year.
That's according to Dutch justice minister Ard van der Steur, who has published a lengthy response to Parliamentary questions on the issue.
Van der Steur's response goes into some depth about the history of the framework, which covers data transfer across the Atlantic, and the decision and resulting impact of the European Court of Justice's ruling to effectively strike it down in October.
His response also goes into the EU's efforts to come up with a new solution with the US government, at which point van der Steur warns: "It is not expected that the negotiations with the US will be completed very shortly."
Critically, it appears that the EU has yet to even broach the issue that caused the framework to fall apart in the first place: mass surveillance of internet traffic by the NSA.
He notes: "Since the end of 2013, there have been ongoing negotiations ... However, the talks have yet to start on the two substantive issues concerning national security. The Commission sees the ruling of the ECJ as an important stimulus to accelerate those conversations."
That "stimulus" was received nearly two months ago. But despite calls from European politicians, American representatives, and businesses on both sides of the Atlantic to come up with a solution as fast as possible, it seems that the core issue has yet to be addressed.
Happy talking talking happy talk
Van der Steur does not go so far as to say that the agreement won't be reached by the end of January, but he does make it plain that the likelihood is very low and he spends considerable time looking at interim options.
He also notes that if – meaning when – agreement is not reached by the end of January 2016 deadline, there will likely be coordinated enforcement actions – a reference to the fact that the Article 29 Working Group has warned that it will "take all necessary and appropriate actions, which may include coordinated enforcement actions" starting February 2016.
That could well mean large fines for US companies that are unable to show how they will protect their users' data from US government spying.
According to van der Steur, the European Commission will have a meeting with European regulators "very shortly" and come up with recommendations for this interim period. And he noted that the EC has very recently spoken with business organizations concerned about the legal impact on their businesses starting in two months' time.
The Netherlands will take over the presidency of the European Union on 1 January 2016, and so its ministers are getting up to speed on the pressing issues. As a result, van der Steur notes that his ministry will now be an official channel for US government discussions and he will be heading to Washington shortly to discuss the Safe Harbor issue. ®