Europe and the U.S. finally agree a landmark data-sharing pact — and it’s already under threat
The Privacy Shield Framework logo is displayed on a smartphone screen.
Pavlo Gonchar | Sopa Images | Lightrocket | Getty Images
Businesses can continue transferring data from the European Union to the U.S. as normal after the two superpowers this week agreed a landmark data-sharing pact.
The framework, which replaces a previous agreement that was invalidated in 2020, is a major development with implications for U.S. tech giants, which rely on the pact to transfer data on their European users back to America.
Without it in place, these companies faced the risk of costly initiatives to process and store user data locally — or withdraw their business from the bloc altogether. So the agreement of the new rules will provide some relief to Meta and other U.S. companies which share gargantuan amounts of user data around the world.
However, the rules already face the threat of legal challenges from privacy activists, who are unhappy with the level of protection the measures offer European citizens. They say it isn’t that different from an earlier framework called Privacy Shield.
CNBC runs through all you need to know about the new EU-U.S. privacy framework, why it matters, and its chances of success.
What’s the new EU-U.S. Data Privacy Framework?
The new data-sharing pact, called the EU-U.S. Data Privacy Framework, aims to ensure that data can flow safely between the EU and U.S., without having to put in place additional data protection safeguards.
In a statement Monday, EU executive body the European Commission said it concluded that U.S. data protection laws offer an “adequate level of protection” for European citizens, and introduced new safeguards limiting access to EU data by U.S. intelligence services to only what is “necessary and proportionate.”
A new Data Protection Review Court will be established for Europeans to issue privacy complaints. It will have powers to order firms to delete users’ data if it finds the information collected was in breach of the new safeguards.
Why was a new data transfer agreement needed?
The Data Privacy Framework replaces a prior agreement, called Privacy Shield, which allowed companies to share data on Europeans to the U.S. for storage and processing locally in their domestic data centers.
This was struck down in July 2020, when the European Court of Justice, the EU’s top court, sided with Austrian privacy campaigner Max Schrems, who alleged U.S. law did not offer sufficient protection against surveillance by public authorities.
Schrems said that revelations from NSA whistleblower Edward Snowden about U.S. surveillance meant that American data protection standards couldn’t be trusted.
He raised a complaint against the social network Facebook which, like many other firms, was transferring his and other user data to the States, as well as the Irish Data Protection Commission, which is Facebook’s main regulatory authority when it comes to data privacy in Europe.
It reached the European Court of Justice, which in 2015 ruled that the then Safe Harbour Agreement, a previous mechanism for allowing European users’ data to be moved to the U.S., was not valid and did not adequately protect European citizens.
It was replaced with the Privacy Shield, however, this was subsequently scrapped too.
In the meantime, companies have relied on separate mechanisms known as Standard Contractual Clauses to ensure they can still move data across the Atlantic.
These tools, too, are under threat.
The Irish DPC in May ruled that Meta’s use of SCCs for transfers of personal data to the U.S. is in breach of the EU’s General Data Protection Regulation. The U.S. tech giant was fined a record $1.3 billion.
Why does it matter?
Multinational companies operate in various jurisdictions, and they need to move data on their customers across borders in a way that’s both secure and complies with data protection regulations.
U.S. tech giants share data on their European users back home all the time. It’s part and parcel of the internet being an open, interconnected platform.
But the way data is handled by these tech companies has come under heavy scrutiny by regulators and privacy campaigners.
Meta, Google, Amazon and others collect huge amounts of data on their users, which they use to inform their content recommendation algorithms and personalize ads.
There have also been countless examples of scandals surrounding the misuse of people’s data by tech firms — not least Meta’s improper sharing of data with Cambridge Analytica, the controversial political consulting firm.
Europe has tough regulations when it comes to processing internet users’ data.
In 2018, the General Data Protection Regulation, or GDPR, came into force introducing tough requirements for organizations to ensure they handle user data safely and securely. This is a law that applies across all the countries within the EU.
The U.S., on the other hand, does not have a singular federal data protection law in place that covers the privacy of all types of data.
Instead, individual U.S. states have come up with their own respective regulations for data privacy, with California leading the charge.
“There has been intense regulatory and political scrutiny on EU-U.S. data transfers, so there are notable differences in the U.S. law protections implemented to support the new framework,” Holger Lutz, partner at law firm Clifford Chance, told CNBC via email.
“Changes to U.S. law have been made in parallel to enhance protections for EU personal data and rights for EU citizens in connection with that data. Those protections are not limited to the new framework – they also protect EU-U.S. personal data transfers outside the framework, and can be taken into account when making such transfers based on other legal instruments such as the EU standard contractual clauses.”
Will it succeed?
The approval of a new data privacy framework means that businesses will now have certainty over how they can process data across borders going forward.
Had there not been an agreement, some companies may have been forced to close their operations in Europe. Indeed, Meta warned this was a risk in February 2022.
Still, obstacles lie ahead.
Schrems, the Austrian privacy activist who helped bring down Privacy Shield, has already said he plans to launch a legal challenge to rip up the new data-sharing pact.
In a statement, Schrems said his law firm Noyb has “various options for a challenge already in the drawer.”
“We currently expect this to be back at the Court of Justice by the beginning of next year,” Schrems said.
“The Court of Justice could then even suspend the new deal while it is reviewing the substance of it. For the sake of legal certainty and the rule of law we will then get an answer if the Commission’s tiny improvements were enough or not.”
Privacy activists say the measures are not sufficient as U.S. privacy laws do not extend protections to non-U.S. citizens, meaning people in the EU don’t have the same level of protection.
“Whether the framework is successful will be a matter of whether the European courts consider the protections for personal data in the US do enough to deliver essential equivalence to the EU protections,” Lutz of Clifford Chance told CNBC.
“Businesses will be carefully considering these potential challenges in their scenario planning.”
An employee walks past a quilt displaying Etsy Inc. signage at the company’s headquarters in the Brooklyn.
Victor J. Blue/Bloomberg via Getty Images
Etsy is trying to make it easier for shoppers to purchase products from local merchants and avoid the extra cost of imports as President Donald Trump’s sweeping tariffs raise concerns about soaring prices.
In a post to Etsy’s website on Thursday, CEO Josh Silverman said the company is “surfacing new ways for buyers to discover businesses in their countries” via shopping pages and by featuring local sellers on its website and app.
“While we continue to nurture and enable cross-border trade on Etsy, we understand that people are increasingly interested in shopping domestically,” Silverman said.
Etsy operates an online marketplace that connects buyers and sellers with mostly artisanal and handcrafted goods. The site, which had 5.6 million active sellers as of the end of December, competes with e-commerce juggernaut Amazon, as well as newer entrants that have ties to China like Temu, Shein and TikTok Shop.
By highlighting local sellers, Etsy could relieve some shoppers from having to pay higher prices induced by President Trump’s widespread tariffs on trade partners. Trump has imposed tariffs on most foreign countries, with China facing a rate of 145%, and other nations facing 10% rates after he instituted a 90-day pause to allow for negotiations. Trump also signed an executive order that will end the de minimis provision, a loophole for low-value shipments often used by online businesses, on May 2.
Temu and Shein have already announced they plan to raise prices late next week in response to the tariffs. Sellers on Amazon’s third-party marketplace, many of whom source their products from China, have said they’re considering raising prices.
Silverman said Etsy has provided guidance for its sellers to help them “run their businesses with as little disruption as possible” in the wake of tariffs and changes to the de minimis exemption.
Before Trump’s “Liberation Day” tariffs took effect, Silverman said on the company’s fourth-quarter earnings call in late February that he expects Etsy to benefit from the tariffs and de minimis restrictions because it “has much less dependence on products coming in from China.”
“We’re doing whatever work we can do to anticipate and prepare for come what may,” Silverman said at the time. “In general, though, I think Etsy will be more resilient than many of our competitors in these situations.”
Still, American shoppers may face higher prices on Etsy as U.S. businesses that source their products or components from China pass some of those costs on to consumers.
Etsy shares are down 17% this year, slightly more than the Nasdaq.
WATCH: Amazon CEO Andy Jassy says sellers will pass cost of tariffs on to consumers
Google CEO Sundar Pichai testifies before the House Judiciary Committee at the Rayburn House Office Building on December 11, 2018 in Washington, DC.
Alex Wong | Getty Images
Google’s antitrust woes are continuing to mount, just as the company tries to brace for a future dominated by artificial intelligence.
On Thursday, a federal judge ruled that Google held illegal monopolies in online advertising markets due to its position between ad buyers and sellers.
The ruling, which followed a September trial in Alexandria, Virginia, represents a second major antitrust blow for Google in under a year. In August, a judge determined the company has held a monopoly in its core market of internet search, the most-significant antitrust ruling in the tech industry since the case against Microsoft more than 20 years ago.
Google is in a particularly precarious spot as it tries to simultaneously defend its primary business in court while fending off an onslaught of new competition due to the emergence of generative AI, most notably OpenAI’s ChatGPT, which offers users alternative ways to search for information. Revenue growth has cooled in recent years, and Google also now faces the added potential of a slowdown in ad spending due to economic concerns from President Donald Trump’s sweeping new tariffs.
Parent company Alphabet reports first-quarter results next week. Alphabet’s stock price dipped more than 1% on Thursday and is now down 20% this year.
In Thursday’s ruling, U.S. District Judge Leonie Brinkema said Google’s anticompetitive practices “substantially harmed” publishers and users on the web. The trial featured 39 live witnesses, depositions from an additional 20 witnesses and hundreds of exhibits.
Judge Brinkema ruled that Google unlawfully controls two of the three parts of the advertising technology market: the publisher ad server market and ad exchange market. Brinkema dismissed the third part of the case, determining that tools used for general display advertising can’t clearly be defined as Google’s own market. In particular, the judge cited the purchases of DoubleClick and Admeld and said the government failed to show those “acquisitions were anticompetitive.”
“We won half of this case and we will appeal the other half,” Lee-Anne Mulholland, Google’s vice president or regulatory affairs, said in an emailed statement. “We disagree with the Court’s decision regarding our publisher tools. Publishers have many options and they choose Google because our ad tech tools are simple, affordable and effective.”
Attorney General Pam Bondi said in a press release from the DOJ that the ruling represents a “landmark victory in the ongoing fight to stop Google from monopolizing the digital public square.”
Potential ad disruption
If regulators force the company to divest parts of the ad-tech business, as the Justice Department has requested, it could open up opportunities for smaller players and other competitors to fill the void and snap up valuable market share. Amazon has been growing its ad business in recent years.
Meanwhile, Google is still defending itself against claims that its search has acted as a monopoly by creating strong barriers to entry and a feedback loop that sustained its dominance. Google said in August, immediately after the search case ruling, that it would appeal, meaning the matter can play out in court for years even after the remedies are determined.
The remedies trial, which will lay out the consequences, begins next week. The Justice Department is aiming for a break up of Google’s Chrome browser and eliminating exclusive agreements, like its deal with Apple for search on iPhones. The judge is expected to make the ruling by August.
Google CEO Sundar Pichai (L) and Apple CEO Tim Cook (R) listen as U.S. President Joe Biden speaks during a roundtable with American and Indian business leaders in the East Room of the White House on June 23, 2023 in Washington, DC.
Anna Moneymaker | Getty Images
After the ad market ruling on Thursday, Gartner’s Andrew Frank said Google’s “conflicts of interest” are apparent by how the market runs.
“The structure has been decades in the making,” Frank said, adding that “untangling that would be a significant challenge, particularly since lawyers don’t tend to be system architects.”
However, the uncertainty that comes with a potentially years-long appeals process means many publishers and advertisers will be waiting to see how things shake out before making any big decisions given how much they rely on Google’s technology.
“Google will have incentives to encourage more competition possibly by loosening certain restrictions on certain media it controls, YouTube being one of them,” Frank said. “Those kind of incentives may create opportunities for other publishers or ad tech players.”
A date for the remedies trial hasn’t been set.
Damian Rollison, senior director of market insights for marketing platform Soci, said the revenue hit from the ad market case could be more dramatic than the impact from the search case.
“The company stands to lose a lot more in material terms if its ad business, long its main source of revenue, is broken up,” Rollison said in an email. “Whereas divisions like Chrome are more strategically important.”
WATCH: U.S. judge finds Google holds illegal online ad-tech monopolies
Jason Citron, CEO of Discord in Washington, DC, on January 31, 2024.
Andrew Caballero-Reynolds | AFP | Getty Images
The New Jersey attorney general sued Discord on Thursday, alleging that the company misled consumers about child safety features on the gaming-centric social messaging app.
The lawsuit, filed in the New Jersey Superior Court by Attorney General Matthew Platkin and the state’s division of consumer affairs, alleges that Discord violated the state’s consumer fraud laws.
Discord did so, the complaint said, by allegedly “misleading children and parents from New Jersey” about safety features, “obscuring” the risks children face on the platform and failing to enforce its minimum age requirement.
“Discord’s strategy of employing difficult to navigate and ambiguous safety settings to lull parents and children into a false sense of safety, when Discord knew well that children on the Application were being targeted and exploited, are unconscionable and/or abusive commercial acts or practices,” lawyers wrote in the legal filing.
They alleged that Discord’s acts and practices were “offensive to public policy.”
A Discord spokesperson said in a statement that the company disputes the allegations and that it is “proud of our continuous efforts and investments in features and tools that help make Discord safer.”
“Given our engagement with the Attorney General’s office, we are surprised by the announcement that New Jersey has filed an action against Discord today,” the spokesperson said.
One of the lawsuit’s allegations centers around Discord’s age-verification process, which the plaintiffs believe is flawed, writing that children under thirteen can easily lie about their age to bypass the app’s minimum age requirement.
The lawsuit also alleges that Discord misled parents to believe that its so-called Safe Direct Messaging feature “was designed to automatically scan and delete all private messages containing explicit media content.” The lawyers claim that Discord misrepresented the efficacy of that safety tool.
“By default, direct messages between ‘friends’ were not scanned at all,” the complaint stated. “But even when Safe Direct Messaging filters were enabled, children were still exposed to child sexual abuse material, videos depicting violence or terror, and other harmful content.”
The New Jersey attorney general is seeking unspecified civil penalties against Discord, according to the complaint.
The filing marks the latest lawsuit brought by various state attorneys general around the country against social media companies.
In 2023, a bipartisan coalition of over 40 state attorneys general sued Meta over allegations that the company knowingly implemented addictive features across apps like Facebook and Instagram that harm the mental well being of children and young adults.
The New Mexico attorney general sued Snap in Sep. 2024 over allegations that Snapchat’s design features have made it easy for predators to easily target children through sextortion schemes.
The following month, a bipartisan group of over a dozen state attorneys general filed lawsuits against TikTok over allegations that the app misleads consumers that its safe for children. In one particular lawsuit filed by the District of Columbia’s attorney general, lawyers allege that the ByteDance-owned app maintains a virtual currency that “substantially harms children” and a livestreaming feature that “exploits them financially.”
In January 2024, executives from Meta, TikTok, Snap, Discord and X were grilled by lawmakers during a senate hearing over allegations that the companies failed to protect children on their respective social media platforms.
WATCH: The FTC has an uphill battle in its antitrust case against Meta.
-
Sports2 years ago‘Storybook stuff’: Inside the night Bryce Harper sent the Phillies to the World Series
-
Sports1 year agoStory injured on diving stop, exits Red Sox game
-
Sports1 year agoGame 1 of WS least-watched in recorded history
-
Sports2 years agoMLB Rank 2023: Ranking baseball’s top 100 players
-
Sports4 years ago
Team Europe easily wins 4th straight Laver Cup
-
Environment2 years agoJapan and South Korea have a lot at stake in a free and open South China Sea
-
Environment2 years agoGame-changing Lectric XPedition launched as affordable electric cargo bike
-
Business3 years agoBank of England’s extraordinary response to government policy is almost unthinkable | Ed Conway