The EU’s data protection laws restrict exporting personal data from the European Economic Area. The Model Clauses, standard contractual clauses approved by the European Commission, are a preferred way to legitimize the transfer of personal data outside the European Economic Area.

Global cloud service providers offering enterprise-level service, availability, and performance, along with ancillary services such as 24/7 customer and technical support, need flexibility to move personal data of an EU customer outside of the EU in the course of providing the cloud service.

While Microsoft and our customers may rely on the “Safe Harbor” framework to legitimize the transfer of personal data from the EU, some European data protection regulators have said the Safe Harbor framework may not be sufficient for an enterprise cloud services environment.

'Destroying it's IT business'? Not at all. Allow a few contract lawyers to buy slightly bigger yachts? probably. Anyway, imagine if the legislation that came out of the judgement was so draconian that customers in EU countries couldn't use US based cloud services at all, that would only leave the whole of North America, South America, Africa, Russia, the far east and possibly China (if providers were willing to play by their rules) to sell to. How would they ever survive?

A lot of geeks got very excited about this but it was never going to be an apocalypse, just a readjustment.

"Safe Harbour is dead - but Safe Harbour been dead for a long time," one privacy advisor told us this morning. "It's a zombie that's put on stage when people start asking awkward questions," he says. "It's the been the big white fat elephant in Silicon Valley boardrooms for years."

Experts say that the Schrems decision nukes the uncomfortable political compromise of creating a "safe harbour" for data exports that the EU and the USA thrashed out in 2000, that became untenable after former NSA sysadmin Edward Snowden spilled the beans. No matter how much Brussels bureaucrats want their latest Safe Harbour fudge to work - the cat's out of the bag. US companies that export data are fundamentally illegal in Europe.

Safe Harbour allowed the EU to pretend that Europeans' data was still subject to European-standard protection, and US data processing giants like Facebook and Google to pretend they were still legal in Europe. But two factors made the pretence untenable. One was the introduction of anti-terror legislation in the USA, and the second was Edward Snowden. Peter Houppermans, a privacy advisor based in Switzerland, explains:



He illustrates with a practical example of how US companies are now in breach of EU rights.



That's because the recipient of the email - in this case you - export the data to a third party without the sender's permission.

The reason Humpty can't be put back together again - and this is vital to understanding the story - is the United States' view of territoriality.

Crudely put, the US doesn't recognise an "abroad" - and fears that if it starts to do so, it will open a Pandora's Box of criminal evasion. This is being fought in Europe, where Microsoft is challenging a US Court order to access emails stored in Ireland. The DoJ fears that a future Enron would store its data offshore, and claim data protection.

Houppermans notes:

Mike Weston, CEO of data science consultancy Profusion said the decision was not surprising, but “it will still have a profound impact on the global tech industry. American companies are going to have to restructure how they manage, store and use data in Europe and this will take a lot of time and money”.

“The biggest casualties will not be companies such as Google and Facebook – as they already have significant data centre infrastructure in countries such as the Republic of Ireland – it will be medium-sized, data-heavy tech companies that don’t have the resources to react to this decision," said Weston.

"Many of these businesses will reconsider how and whether they operate in Europe, which is bad news for everyone,” added Weston, who also warned about the possibility of “retaliation from US authorities”

“Safe Harbor was flawed in principle and flawed in practice,” said Joe McNamee, executive director of European Digital Rights group, EDRi. “After last year’s data retention ruling, this is the second time in two years that the ECJ has struck down an instrument that the European Commission had spent years defending.”

“In reality, however, the case is much deeper than 'just' mass surveillance. The European Commission has never had the political courage to recognise that Safe Harbor was never safe. Even before the Snowden revelations, reports from the Commission itself and from independent research showed over and over again that the entire framework was inadequate,” said McNamee.

They'll probably just point you here

As I say, to believe this has caught any large US corporation completely on the hop and they're all running aroudn waving their arms in the air is foolish.

Right, because newspaper headlines are always 100% accurate and complete.