3 ms·

With the precedent of Safe Harbor and the Snowden revelations, I'm surprised any European company preparing for GDPR wouldn't at least have flagged US services

by pluma 8y ago

With the precedent of Safe Harbor and the Snowden revelations, I'm surprised any European company preparing for GDPR wouldn't at least have flagged US services as high risk even when they're Privacy Shield certified. Privacy Shield is a fig leaf more than anything. Using any US company (or non-EU company from a country without adequacy) is a major risk for compliance. This is a bit like when people complained their companies were going bankrupt because Facebook/Apple/Twitter/Google shut down an API without warning. If you build your business on such a wobbly foundation, it's a calculated risk and you need to be aware of it.

Silhouette 8y ago
If you build your business on such a wobbly foundation, it's a calculated risk and you need to be aware of it. It is entirely unconstructive to call US-based foundations wobbly when the EU-based equivalents (a) sometimes don't exist at all, and (b) where they do exist, suffer from analogous privacy concerns around government snooping. The allegation here isn't that, to pick one relevant example, Stripe is abusing the personal data they process when they collect payments from our customers. The objections to Privacy Shield, like Safe Harbor before it, are mostly about the US government itself having rights under US law to gain access to that data, regardless of the actions or intentions of US-based businesses. Now, I don't like the current heavy-handed approach to data hoarding by governments under the guise of national security any more than the next HN reader. But let's be clear: the EU and its member states do essentially the same thing, routinely writing special cases into privacy laws that exclude governments when they want to pry for supposedly security-related reasons. It is the height of hypocrisy for the EU authorities to allege that processing data in the US is unsafe because of the risk of US government interference, while at the same time turning a blind eye to what's going on in their own back yard. In any case, since sadly there is little prospect of any of the governments involved on either side of the Atlantic giving up these powers any time soon, undermining otherwise reasonable privacy laws because of them serves no useful purpose. It just hurts businesses who are trying to do reasonable things, even if they are careful and considerate in how they handle personal data, and by extension it also hurts both their customers and the economies they operate within.
- Tomte 8y ago
  > The objections to Privacy Shield, like Safe Harbor before it, are mostly about the US government itself having rights under US law to gain access to that data No, and I rarely hear that as the main concern. The main concern with Safe Harbor et al. (where US businesses are dealing with EU businesses and – more importantly – EU people) is commercial abuse of data (Facebook!) and data breaches. Government access isn't seen as particularly problematic in criminal and anti-terror cases, but in mass surveillance of Internet and telephone connections, as well as in the context of industrial espionage.
  - Silhouette 8y ago
    No, and I rarely hear that as the main concern. For the record, we have heard very different concerns then. One big concern I have seen expressed, particularly in the more recent context of the GDPR, is that the government surveillance powers constitute a legal obligation on businesses, but only EU versions of such powers are recognised as legal obligations on EU businesses. Thus EU businesses cannot avail themselves of that lawful basis for processing if they export data they control to a US business (even one covered by Safe Harbor before or Privacy Shield now) for processing and the US government then grabs the data. The logical conclusion if all such schemes are struck down is that exporting any personal data to the US for any reason will become illegal, with obvious catastrophic consequences if the law is then enforced to the letter. The main concern with Safe Harbor et al. (where US businesses are dealing with EU businesses and – more importantly – EU people) is commercial abuse of data (Facebook!) and data breaches. The entire point of Privacy Shield, like Safe Harbor before it, is to give EU businesses reassurance that they are not breaking data protection law by transferring personal data to a compliant US business. Businesses that are doing things with the data that would not be permitted under the stronger EU regulatory regime aren't supposed to qualify for Safe Harbor/Privacy Shield status in the first place.
    - Tomte 8y ago
      > The entire point of Privacy Shield, like Safe Harbor before it Exactly, I didn't mean that Privacy Shield is the problem, but that it is trying to address that problem, but I can see that I expressed myself ambiguously. > The logical conclusion if all such schemes are struck down is that exporting any personal data to the US for any reason will become illegal But that's good! Not in the sense that we should wish for that outcome, but in the sense that the US should offer real assurances to us that allow us to enter such an agreement..

by pluma 8y ago

Silhouette 8y ago

If you build your business on such a wobbly foundation, it's a calculated risk and you need to be aware of it. It is entirely unconstructive to call US-based foundations wobbly when the EU-based equivalents (a) sometimes don't exist at all, and (b) where they do exist, suffer from analogous privacy concerns around government snooping. The allegation here isn't that, to pick one relevant example, Stripe is abusing the personal data they process when they collect payments from our customers. The objections to Privacy Shield, like Safe Harbor before it, are mostly about the US government itself having rights under US law to gain access to that data, regardless of the actions or intentions of US-based businesses. Now, I don't like the current heavy-handed approach to data hoarding by governments under the guise of national security any more than the next HN reader. But let's be clear: the EU and its member states do essentially the same thing, routinely writing special cases into privacy laws that exclude governments when they want to pry for supposedly security-related reasons. It is the height of hypocrisy for the EU authorities to allege that processing data in the US is unsafe because of the risk of US government interference, while at the same time turning a blind eye to what's going on in their own back yard. In any case, since sadly there is little prospect of any of the governments involved on either side of the Atlantic giving up these powers any time soon, undermining otherwise reasonable privacy laws because of them serves no useful purpose. It just hurts businesses who are trying to do reasonable things, even if they are careful and considerate in how they handle personal data, and by extension it also hurts both their customers and the economies they operate within.

Tomte 8y ago
> The objections to Privacy Shield, like Safe Harbor before it, are mostly about the US government itself having rights under US law to gain access to that data No, and I rarely hear that as the main concern. The main concern with Safe Harbor et al. (where US businesses are dealing with EU businesses and – more importantly – EU people) is commercial abuse of data (Facebook!) and data breaches. Government access isn't seen as particularly problematic in criminal and anti-terror cases, but in mass surveillance of Internet and telephone connections, as well as in the context of industrial espionage.
- Silhouette 8y ago
  No, and I rarely hear that as the main concern. For the record, we have heard very different concerns then. One big concern I have seen expressed, particularly in the more recent context of the GDPR, is that the government surveillance powers constitute a legal obligation on businesses, but only EU versions of such powers are recognised as legal obligations on EU businesses. Thus EU businesses cannot avail themselves of that lawful basis for processing if they export data they control to a US business (even one covered by Safe Harbor before or Privacy Shield now) for processing and the US government then grabs the data. The logical conclusion if all such schemes are struck down is that exporting any personal data to the US for any reason will become illegal, with obvious catastrophic consequences if the law is then enforced to the letter. The main concern with Safe Harbor et al. (where US businesses are dealing with EU businesses and – more importantly – EU people) is commercial abuse of data (Facebook!) and data breaches. The entire point of Privacy Shield, like Safe Harbor before it, is to give EU businesses reassurance that they are not breaking data protection law by transferring personal data to a compliant US business. Businesses that are doing things with the data that would not be permitted under the stronger EU regulatory regime aren't supposed to qualify for Safe Harbor/Privacy Shield status in the first place.
  - Tomte 8y ago
    > The entire point of Privacy Shield, like Safe Harbor before it Exactly, I didn't mean that Privacy Shield is the problem, but that it is trying to address that problem, but I can see that I expressed myself ambiguously. > The logical conclusion if all such schemes are struck down is that exporting any personal data to the US for any reason will become illegal But that's good! Not in the sense that we should wish for that outcome, but in the sense that the US should offer real assurances to us that allow us to enter such an agreement..