In the IAPP piece New EU data blockage as German court would ban many cookie management providers, Dan Felz and Peter Swire examine the potential EU-wide impacts of a Wiesbaden court decision prohibiting a cookie management provider from utilizing a U.S.-based service to collect data, regardless of whether such data had ever actually been transferred out of the EU. Although the decision was made at the interim injunction stage and could thus be modified if the case proceeds to trial, its implications are significant.
One significant aspect of the new decision is that it seems to prohibit data processing by a company that operates in a third country even when the personal data is stored in the EU and never leaves the EU. The decision would appear to prohibit processing of data by any provider that is subject to both EU and non-EU law — even if the provider is headquartered in the EU — as long as a request by a foreign government could require production of data irrespective of storage location. In addition, the personal data at issue is routine – IP addresses linked only to a user’s cookie preferences on a university website. The German court did not analyze the actual risk of improper access to this data, but if its decision is read as finding that any risk of law enforcement access is too much, it appears to set an unduly low threshold for permitting any such risk.
The decision is based on analysis of the effects of the U.S. CLOUD Act, for potentially providing U.S. law enforcement with access to personal data stored in the EU. To date, the focus of EU and U.S. negotiations on a new version of Privacy Shield has been to create adequate protections concerning U.S. national security surveillance, which is a different legal issue than the basis for the Wiesbaden decision, which concerns the rules for U.S. law enforcement access.
To read the full analysis on IAPP, click here.
These statements are attributable only to the author, and their publication here does not necessarily reflect the view of the Cross-Border Data Forum or any participating individuals or organizations.
