UNDER European Union law, companies are prohibited from sending EU citizens’ private information abroad to a country that does not meet European standards. According to a ruling in October 2015 by the European Court of Justice, the EU’s top judicial body, America does not meet those standards, largely because of the intrusiveness of its National Security Agency (NSA). That ruling ended the 15-year-old “Safe Harbour” agreement, which had enabled American firms to move data around easily. It also raised big questions about the future of the internet as a global, borderless commons.

Those questions now have real urgency. A deadline to draw up a new Safe Harbour agreement expires on January 31st; the EU’s 28 national agencies dealing with data protection will meet on February 2nd. At least one has said that—unless a new agreement has been reached by then—the EU will immediately prohibit the transfer of data relating to its countries’ citizens to the United States. That would affect all European companies with American customers or suppliers, as well as 4,500 American companies that had used the Safe Harbour provision to do business in Europe.

Cross-border data flows are central to transatlantic trade. Services that can be delivered over the internet make up a majority of services exports from America to the EU, and vice versa. Big companies such as Facebook or Microsoft can cope with a more stringent regime: they are already establishing Europe-only data centres. But the burden on smaller firms would be heavy: many may decide that it is simply not worth the trouble of doing business on the other side of the Atlantic. And where America and Europe lead, others would surely follow. Even more governments would insist that all data about their citizens be held on servers within their own territory (as Russia already does).

Europe’s concerns are not groundless. America has lots to learn from Europe on data protection: the idea that customers and citizens own their data, and should not give companies free rein with their private information as a condition of doing business, is admirable. And the desire of the American authorities to get hold of data held abroad still inflames suspicion. The EU’s unhappiness about Safe Harbour stemmed principally from the allegations of Edward Snowden, a fugitive contractor, about what he portrayed as the unrestrained espionage activities of the NSA. But the American government is also suing Microsoft to gain access to Hotmail accounts held in Dublin, arguing that these are mere business records, rather than personal data. Microsoft reasonably argues that its Irish customers’ e-mails are protected by Irish law: if the American authorities want them, they must apply via the Irish courts.

Safe enough

Even so, enough common ground exists to construct a replacement for Safe Harbour. Setting aside the fact that the NSA’s huge capabilities to spy on foreigners were gratefully exploited by plenty of national intelligence agencies in Europe, much has changed since Mr Snowden’s revelations. A presidential directive in January 2014 limits the agency’s right to collect bulk data to six grounds: dealing with espionage, terrorism, cybersecurity, proliferation of weapons of mass destruction, threats to the American military, and organised crime. It specifically prohibits gathering electronic intelligence to give American firms a commercial advantage. And the NSA must apply for warrants to gain private customer data from American-owned companies.

America has also ended the bulk storage of telephone records. It is offering an annual review mechanism, and a privacy ombudsman. A bill offering judicial redress in America to foreigners whose data privacy has been breached has passed the House, but not yet the Senate. Such measures go well beyond the protection that European countries offer to their own citizens, let alone to foreigners.

If a deal has not been reached by February 2nd, European data-privacy watchdogs should tell their negotiators to keep talking, not start a cascade of prohibitions. A serious stoppage in data flows would not just hurt transatlantic trade, it would also set a terrible example to the rest of the world. If the EU and America cannot forge an agreement that balances individual privacy and public security, who can?