EU Data Protection Directive

The EU Data Protection Directive (the Directive) was brought into force in October 1995. Its official title ‘Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data’ speaks to the focus of the framework: individuals and their personal data, and on the movement of that data. The Directive states that ‘“personal data” shall mean any information relating to an identified or identifiable natural person (‘data subject’) (Directive 95/46/EC).

The Directive brought to the fore core differences in European and North American values, particularly in terms of how privacy is viewed in both regions (Long and Pang Quek, 2002; Ess, 2014). Both sides were ‘worried that these differences in approach could negatively affect many businesses and industries on both sides of the Atlantic, and potentially impact the U.S.–EU trade and investment relationship’ (Weiss and Archick, 2016: 5). And as noted by Schriver, ‘it soon became apparent the Directive would change the face of privacy protection not only in Europe, but also in the United States and the rest of the world’ (2002: 2778).

Safe Harbor agreement

To harmonise privacy protections with regard to EU–US data transfers, the Safe Harbor agreement was developed. The principles set out by the agreement sought to align US data collection processes with EU data protection measures whereby ‘under Safe Harbor, a U.S. company could self-certify annually to the Department of Commerce that it had complied with the seven basic principles and related requirements that have been deemed to meet the data privacy adequacy standard of the EU’ (Weiss and Archick, 2016: 5).

Negotiations on the Safe Harbor agreement took place from 1998 until 2000 with the Directive serving as an impetus for the development of such a framework. The Safe Harbor Decision was agreed in July 2000 and 4,500 companies self-certified in agreement with the framework over the subsequent fifteen years that it was in effect. Those who self-certified were seen as providing adequate protection which in turn meant that ‘European data-protection authorities [would] allow their transatlantic data transfers to continue unchallenged’ (Schriver, 2002: 2780). Self-certification was optional and thus a contested issue in terms of the sufficiency of the measures taken to protect personal data. However, Schriver argued that the ‘threat of data-flow shutoffs from Europe [made] the Safe Harbor an increasingly attractive option’ (2002: 2781). The perceived threat of such shutoffs has been questioned though, generally relating to enforcement or lack thereof.

During its tenancy questions were raised about the effectiveness of the Safe Harbor agreement and its suitability in terms of keeping abreast of increased datafication and the complexities that surround it. In response to concerns of inadequacy that suggested suspending Safe Harbor the ‘European Commission rejected doing so because of concerns that suspending Safe Harbor would adversely affect EU business interests and the transatlantic economy’ (Weiss and Archick, 2016: 9).

However, on 6 October 2015 the Court of Justice of the European Union (CJEU) ruled to invalidate the Safe Harbor agreement (effective immediately). The decision was based on the Schrems case in which Maximillian Schrems, an Austrian lawyer, questioned the level of data protection applied to the data Facebook collects and transfers from the EU and the US in light of the Snowden revelations in 2013.

The CJEU found that:

Without needing to establish whether that scheme ensures a level of protection essentially equivalent to that guaranteed within the EU, the Court observes that the scheme is applicable solely to the United States undertakings which adhere to it, and United States public authorities are not themselves subject to it. Furthermore, national security, public interest and law enforcement requirements of the United States prevail over the safe harbour scheme, so that United States undertakings are bound to disregard, without limitation, the protective rules laid down by that scheme where they conflict with such requirements.

(Court of Justice of the European Union Press Release, 6 October 2015)

Privacy Shield agreement

Although the abolition of the Safe Harbor agreement served as a stimulus to enact an updated transatlantic data transfer pact, discussions to amend the agreement began in late 2013. The CJEU ruling did however expedite the issue and the EU–US Privacy Shield was announced (in principle) on 2 February 2016. The full text of the Privacy Shield was released on 29 February 2016. Releasing the document opened the floor for debate with regard to the sufficiency of the modifications before the EU Commission made their adequacy decision. During this time the Article 29 Working Party (representatives of national data protection authorities, the European data protection supervisor and the European Commission) said they recognised ‘significant improvements’ noting that ‘many of the shortcomings’ of Safe Harbor had been addressed by negotiators. At the same time, the Working Party expressed ‘strong concerns’ regarding key commercial and national security aspects of the Privacy Shield agreement’ (Weiss and Archick, 2016: 11). Despite the perception that there are some unresolved issues the Privacy Shield was officially adopted on 12 July 2016 and 1,626 companies have self-certified in agreement with the principles of the Privacy Shield agreement as of 10 February 2017.

‘The EU–U.S. Privacy Shield imposes stronger obligations on U.S. companies to protect Europeans’ personal data. It reflects the requirements of the European Court of Justice, which ruled the previous Safe Harbour framework invalid’ (EU Commission Privacy Shield Factsheet). The amended framework includes ‘added protections’, three of which are bolstered as particularly significant:

• Strong obligations on companies handling Europeans’ personal data and robust enforcement.

• Clear safeguards and transparency obligations on U.S. government access.

• Effective protection of EU citizens’ rights with several redress possibilities.

(European Commission Press Release, 2016)

Although there are questions remaining about the adequacy of the agreement, it remains to be seen whether the Privacy Shield will persist or be invalidated by legal challenge like its predecessor. Digital Rights Ireland have already launched a legal challenge against the Privacy Shield. The case could take up to a year to be considered but some are suggesting that it may be sooner rather than later given the urgency with which previous privacy cases have been considered recently (Public Interest Law Alliance, 2016).

The EU Data Protection Directive, which underpins the data protection landscape currently, was developed when the internet was nascent, when the breadth and complexities of digital data were not fully realised, and is thus also unequipped to serve as a pertinent framework. In response to its inadequacy the EU has developed the General Data Protection Regulation (GDPR) to which all EU member states will have to be in compliance by May 2018. The Privacy Shield was developed with the forthcoming GDPR in mind.

Newspapers

The Lexis Nexis dataset consisted of 52 European and North American newspaper articles containing the key words privacy shield dating from 1 July to 1 September 2016. Of the articles 61.5 per cent were European, 38.5 per cent were North American, and 42 per cent of the overall sample was from Irish newspapers. The sample was based on English language newspapers, therefore potentially pertinent articles from other EU countries were not gathered and this research is thus a partial snapshot of public communications on the topic. However, the prevalence of Irish newspapers could also speak to the relevance of the Privacy Shield in the Irish context whereby its adoption is particularly significant for American multinational companies (MNCs) stationed here. Ireland’s position is also notable given the role of the Irish Data Protection Commissioner in the EU, again because of the number of MNCs with headquarters in Ireland, which may account for increased Irish interest.

The articles were largely in the finance, business and news sections of the newspapers when specified in LexisNexis but their placement varied between EU and US papers. EU articles were almost equally split between finance and news sections whereas US articles were predominately in the finance or business sections. Although the articles often appear in the opening pages of the finance or business sections, they never appeared as front-page news and only once made it as front page in the business section of a US newspaper.

Twitter

The Twitter dataset consisted of 2,692 tweets containing #privacyshield on 12 July 2016; the day the Privacy Shield framework was adopted: 766 were original tweets and 1,928 were retweets; 75 per cent of retweets were retweeted more than ten times – this sample is made up of 130 tweets. Although the level of influence attributed to retweets is debated in academia the content of those 130 tweets is the primary base for our Twitter analysis, given that we are interested in the discourse disseminated by key actors, i.e. we wanted to know what those who were being retweeted were saying. Twitter is a platform for public communications that is considered to be flexible in terms of the various levels of ‘public-ness’ than can be achieved (Bruns and Moe, 2014). There are various communicative conventions on Twitter and the two most relevant to this research are hashtags and retweets. Hashtags are commonly used to signify that a tweet is relevant to a certain topic and hashtagged tweets can be picked up outside of one’s follower base. Retweets are often used to relay information to a user’s followers. Users utilise the conventions of Twitter to create ad-hoc publics and by combining hashtags and retweets (and to a lesser extent mentions) the actors in this dataset are communicating vertically and horizontally (ibid.) to reach the widest possible public. Using a bottom up approach we developed three tiers of significance based on the quantity of retweets generated by each actor. Tier one relates to tweets retweeted more than one hundred times, tier two relates to tweets retweeted 50–100 times, and tier three relates to tweets retweeted between 10–50 times whereby the actors located in the top tier of significance disseminate their views to the widest public. The 130 tweets were generated by 34 users; three from tier one, seven from tier two and twenty-five from tier three. Eight of the accounts framed the Privacy Shield in a positive way in their tweets, nine framed the privacy shield in a negative way and fifteen accounts tweeted about the Privacy Shield in an objective, impartial manner. The tiers of significance are considered useful in determining the level to which key actors are recognised in online spaces and the level to which their views are proliferated. It is acknowledged that the tiers of significance are biased toward actors whose tweets have gained popularity in the discussion, possibly eliminating significant actors who, at the time of data collection, had yet to comment on the discussion. We also acknowledge that retweets are not the only measure of significance in Twitter analysis and also compared retweets and mentions to identify other pertinent actors for example the US Secretary of Commerce Penny Pritzker was retweeted 24 times but was mentioned 268 times in the dataset situating her as a key actor in the online discussion. It is also recognised that a twenty-four-hour period on Twitter may fail to capture some key actors/voices and subsequent discourses given the international significance of the framework and the varied time differences from which actors are operating.

Key actors

A range of key actors were identified across both platforms. We categorised these actors as individuals, institutions and organisations, and trade companies as depicted in Figure 1 below. We have identified both primary and secondary actors in the dataset. Primary actors are those who are directly in conversation with the writer, quoted directly in the piece, mentioned in direct accordance with the Privacy Shield, or those who have been retweeted more than ten times. Secondary actors are those who are mentioned with regard to the implications of the Privacy Shield or with regard to self-certifying in accordance with the Privacy Shield. Secondary actors are primarily trade companies, in particular information communications technology companies. Several of which (WhatsApp, Google, etc.) are mentioned frequently in the dataset, more often than some of the key individuals and their recurrence is considered to be notable. It is also recognised that although these companies are not always directly in the conversation, their involvement in trade association with a presence in Brussels situate them as significant actors that are central to the development of transatlantic data transfer agreements.

Figure 1

Modified table of key actors.

Some actors were active across both media (e.g. Vera Jourova, Max Schrems, the EU Commission, etc.) but in general there was a division between the actors deemed pertinent in each space. For example, although lawyers were identified in each medium, they were more prevalent in the newspapers articles, and although several MEPs were identified in each space, they were more prominent on Twitter (there were not many but those who were active were frequently retweeted). Core institutions were identified across both mediums but advocacy groups were more prominent on Twitter, both in number of organisations and frequency of retweets. Some key actors’ inability to transcend the Twittersphere raises questions about their ability to exert political influence beyond the realm of social media. It also raises issues regarding the ability or desire of the press to identify the importance of key actors in the online discussion which unearths potential prestige press issues.

Key discourses

There is a dominance of trade, market and security language and a focus on individual informational privacy across both datasets. Trade is central to the conversation with the associated discourse largely replicated across both media. The underpinning rhetoric is that data flows between the EU and US are essential. In the Twitter data, official EU actors are proponents of the discourse valuing the importance of intercontinental data flows. When comparing the EU and US newspapers though, the emphasis tends to be on the importance of the trade agreement in the US context and data protection in the EU context, although both are considered salient in the EU newspapers. US newspapers also place higher value on US actors’ roles in the development of the Privacy Shield whilst at the same time down play the importance of the Privacy Shield for US citizens. It is perceived as a European endeavour to protect their citizens’ data privacy in line with the EU right to privacy, which is often explained by way of referencing the American value of the freedom of speech, which is seen as a similar weighted right in the US.

Whether stating that the Privacy Shield has adequate or inadequate privacy protections, the content in the EU newspapers suggest that privacy is something to be protected and the language surrounding references to privacy is largely securitising, e.g. safeguarding, enforcing, protecting. Those serving to bolster privacy rights (e.g. the Electronic Frontier Foundation) are often referred to as watchdogs which furthers the securitising imaginary.

We also identified a range of referent objects, i.e. those whom the Privacy Shield is employed to aid, as depicted in Figure 2 below. EU citizens was the term used most frequently, which reflects the endeavour to provide increased data protection to personal data being transferred from the EU to the US. Somewhat surprising though is the infrequent reference to consumers or customers given the dominance of trade language in the datasets.

Figure 2

Breakdown of referent object across Newspaper and Twitter datasets.

How is privacy framed in the online and offline discussion?

Privacy is largely framed in the context of an individuals’ right to information privacy, which reflects the dominant concept of privacy as an individual right (Post, 1989; Westin, 1970). The issue of privacy in the context of the Privacy Shield is framed particularly as EU citizens’ right to informational privacy. This is logical given that the framework is enacted to provide stronger data privacy protections to data being transferred from the EU to the US. Privacy protection is continuously referred to as an EU obligation, with US newspapers often explaining it in terms of the right of free speech:

The depth of feeling in the EU over privacy is similar to the feeling we have in the U.S. toward free speech – one of the absolutely critical civil rights that is the basis for our values and our relationship with the government. Privacy is clearly important in the U.S., however it is cherished in the EU.

(Metropolitan Corporate Council, July 2016)

Whilst the value of privacy is weighted differently in the EU and US (Long and Pang Quek, 2002; Ess, 2014) the data portrays intercontinental agreement across both media with regard to the value of protecting personal privacy in terms of bolstering international trade.

Although issues of trust appear in both datasets, their infrequent mentions were unanticipated given the primacy of trust in current privacy discussions. While self-certification in accordance with the Privacy Shield principles afford companies with a ‘badge of trust’, the discourse focuses more on the legal enforcement of the Privacy Shield at the state level rather than on the commitment of commercial actors to comply. Significant here is the emphasis on policies and frameworks around technology that endeavour to protect privacy not on technological solutionism mechanisms that state code is law (Lessig, 1999).

We have established that the dominant framings of privacy in the online and offline coverage are dominated by trade, market and security language that are propagated primarily by state and legal actors which reify traditional conceptualisations of privacy as an individual right (Post, 1989; Westin, 1970). We argue that privacy is not being redefined in this context but narrowed to a neoliberal free trade framing of information privacy.

Who is active in the debate?

Despite the rise of privacy by design and code is law discourses, what is clear from our analysis is that traditional state and transnational political institutions are increasingly playing a role in internet governance through policies related to data protection and privacy. Both EU and US actors are significant in our sample, specifically the European Commission, Vera Jourova (EU Commissioner for Justice, Consumers and Gender Equality), the Digital Single Market (DSM), Andrus Ansip (VP EU Commission and Commissioner for the DSM) from the EU and the US Department of Commerce, the Federal Trade Commission and Penny Pritzker (US Secretary of Commerce) from the US. These actors are pivotal to the development of mainstream institutional framings of privacy at the political level. The government institutions in particular are important.

The EU voice is particularly prominent across both media, as exemplified by the eminence of actors such as Vera Jourova, the European Commission, the DSM and several MEPs, and disseminates a largely positive framing of the Privacy Shield particularly in terms of providing ‘stronger protection for transatlantic data flows’ in line with the official discourse as propagated by the EU Commission (EU Commission Press Release, 2016). However, a strong countervailing discourse is visible in the Twitter dataset with many sceptical of the perceived stronger protections and others directly disagreeing and stating that personal data is not protected by the framework (Netizen Rights; Privacy International; Jan Phillip Albrecht MEP), often in reference to mass or bulk surveillance undertaken by the US government. The countervailing discourse on Twitter is also largely (but not exclusively) EU based, with just one of the MEPs identified in the dataset challenging the Privacy Shield.

US governmental surveillance is a common theme throughout both datasets (primarily newspapers) and the Snowden revelations in 2013 are frequently attributed to being an impetus for the abolition of the safe harbour agreement and the subsequent development of the Privacy Shield framework. However, the polarised narrative on Twitter is not reproduced in the print press. Newspaper articles referencing the Privacy Shield are predominantly factual/informative with a small sample offering opinions on the framework, for example the op-ed piece in the Irish Times co-written by Max Schrems and Jan Albrecht that questions the adequacy of the Privacy Shield on the day it was adopted. It is notable that the piece appeared in the Irish Times. Given that the Schrems case was against Facebook Ireland, Irish interest in the outcome is significant. It could also be seen as a way of influencing the Data Protection Commissioner, also central to the Schrems case and to the Privacy Shield.

Although there are many informative tweets that are impartial, there is a definitive distinction between pro-Privacy Shield and anti-Privacy Shield sentiment. The Twitter dataset was hand coded for sentiment because sentiment analysis software has difficulties with identifying humour and sarcasm etc. and thus could have miscoded some of the tweets for example:

@hackerfantastic: #PrivacyShield allows companies to “self-certify”. Great news everyone! It’s a certified data company!

The above tweet could be read as genuine or sarcastic but hand coding allowed the researcher to gauge this sentiment against other tweets the user had posted and confirmed that it was sarcasm, therefore cementing it as a ‘negative framing’ tweet.

Although some lawyers are only mentioned once in the dataset (e.g. Tene, Bond, Butler, etc.), collectively the legal voice is strong which speaks to one dominant framing of privacy with regard to the Privacy Shield; privacy as a constitutional right. Given that the privacy shield is a legislative framework it is expected that one of the most prominent collective voices would be that of the legal sphere however it is still significant in terms of identifying who is considered to be important in terms of creating and disseminating a discourse on privacy in the context of the Privacy Shield.

Who is absent in the debate?

In the offline coverage, there is a distinct absence of the critical discourse that is present in the online coverage. The critical discourse is largely propagated by privacy advocacy groups (European Digital Rights; Privacy International; Open Rights Groups, etc.) on Twitter, who are noticeably absent in the newspapers. Whilst some cognate organisations are visible in the newspaper data (Electronic Frontier Foundation; International Privacy Information Centre), their positioning is related to being ‘amicus curiae’ (impartial advisor to the court) in the Schrems case with their perspective not referred to. MEP Jan Phillip Albrecht is also a strong dissenting voice on Twitter but he only appears in the newspapers once, in the op-ed piece mentioned previously. As we already established, this raises questions about certain key actors’ ability to exert political influence beyond the realm of social media. Also significant here is the perceived inability of the press to identify such actors as pertinent. Or perhaps more interestingly is the potential intentional omission of certain actors or discourses in the prestige press. Although there are privacy advocates challenging the framing of privacy in the context of the Privacy Shield, the prominence of neoliberal proponents dictate a free trade framing that contextually (Nissembaum, 2010) narrows rather than redefines the concept of privacy.