3 ms·

The title seems to be misleading. According to the article, Google isn't removing data protection from UK users, it's moving their data to the US (which in theo

by makomk 7y ago

The title seems to be misleading. According to the article, Google isn't removing data protection from UK users, it's moving their data to the US (which in theory would be compliant with EU data protection laws even for EU citizens, though there are some arguments stuck in the courts that it shouldn't be) whilst following the same rules. This is most likely the result of some rather messy political disputes between the EU and the UK over data hosting and the GDPR that don't look like they're going to be solved any time soon.

ThePhysicist 7y ago
It might be compliant to move data from the EU to the US under the privacy shield agreement, but this agreement might soon be dead as there is a court case against it (for good reason): https://techcrunch.com/2019/12/19/more-legal-uncertainty-for-privacy-shield-ahead-of-crux-ruling-by-europes-top-court https://techcrunch.com/2019/12/19/more-legal-uncertainty-for... So it’s not unlikely that the US and UK will be considered unsafe countries for handling personal data of EU citizens due to their aggressive stance on digital spying and surveillance.
krageon 7y ago
> Google isn't removing data protection from UK users, it's moving their data to the US This means that Google is removing data protection from UK users. There is absolutely no way to claim in good faith that you can protect your users when the data exists (or is touched in any way by, but that's another story) in the US, the examples for which we've seen often enough that every reader can be assumed to be familiar with them by now.
- makomk 7y ago
  The EU's position is that you can, in fact, claim in good faith that you're protecting your users when the data exists in the US, despite evidence to the contrary. There have been a few court cases about this, one of which is currently in progress, and at least one of which they lost and carried on doing it anyway. In any case, it's not something you can rely on EU data protection rules to protect against right now. On the other hand, the EU has been threatening to refuse to agree on the same for the UK, despite both having the exact same data protection frameworks as it currently stands. The actual rules have at least as much to do with internaational politics as they do with protecting people's privacy.
- thu2111 7y ago
  The physical location of the data doesn't matter. US employees can access any datacenter remotely around the world, so I often wonder why this topic comes up at all. For a while playing games with physical location was a neat legal hack in the US specifically, but the USG closed that loophole a few years back if I recall correctly and can now force US firms to give up data even if it's in a foreign datacenter.
  - toyg 7y ago
    US employees accessing EU data held in the EU in manners that contravene EU laws, would be breaking the law and would expose their company to prosecution in EU courts. The issue is not about technical feasibility, it’s about exposure to legal repercussions. You can argue that respecting EU laws might expose you to prosecution in US and vice-versa, and that’s absolutely true. International law is messy.
DrScientist 7y ago
It's quite clear any anybody that the safe habour and privacy shield type agreements are fig leaves and logically incompatible with UK/EU data protection laws. Safe Habour was struck down, privacy shield may be going the same way. Essentially UK data protection says you can't put data beyond UK's law ability to enforce data protection rights, as that's clearly 'getting around' the law. The privacy shield is the latest pretense that somehow having the data under US jurisdiction, with a promise to behave nicely, is ok. However that promise is fundamentally worthless as US law takes precedence over that promise. Specifically the US government can demand US companies hand over the data, whatever they have promised to UK customers. That kind of issue is exactly why UK data protection law talks about jurisdiction in the first place. The only real logical legal solution to this is to have a world court on these issues - but everybody is trying to avoid that politically unpalatable outcome. You can talk about Brexit- but this is the real sovereignty issue in the 21st century.
- cameronh90 7y ago
  I think the main reason safe harbour was struck down was just that the safe harbour laws didn't have the same level of protection and enforcement as the GDPR requires, rather than fear over the US government demanding access to data. As I understand it, The GDPR is mostly concerned with the protection of routine usage of data, mostly by business and lower levels of government, rather than the government or security agencies accessing the data as part of a legal request or investigation. Indeed, the UK pretty encourages the NSA to access data on UK citizens as part of Five Eyes (and other parts of the EU as SSEUR and Nine Eyes). I'm no expert, but I'm guessing the idea behind those safe harbour type agreements is that both the US government has a well developed legal framework and was willing to sign a law allowing EU companies to enforce DPA violations on their own companies in the relevant context. As long as the companies have the legal requirement to protect EU data in an equivalent way to an EU company, and there are legal routes to enforce it, I don't see anything particularly wrong about them in principle. The issue of US companies allowing access to EU citizen data is an important one, and one I believe needs more attention, but it's unlikely to get it because it's by design at this point. And storing data in AWS UK doesn't exactly get around that, because the US government can just force their UK subsidiary to exfiltrate the data. But also I don't think it's strictly relevant to the GDPR safe harbour style provisions.

by makomk 7y ago

ThePhysicist 7y ago

It might be compliant to move data from the EU to the US under the privacy shield agreement, but this agreement might soon be dead as there is a court case against it (for good reason): https://techcrunch.com/2019/12/19/more-legal-uncertainty-for-privacy-shield-ahead-of-crux-ruling-by-europes-top-court https://techcrunch.com/2019/12/19/more-legal-uncertainty-for... So it’s not unlikely that the US and UK will be considered unsafe countries for handling personal data of EU citizens due to their aggressive stance on digital spying and surveillance.

krageon 7y ago

> Google isn't removing data protection from UK users, it's moving their data to the US This means that Google is removing data protection from UK users. There is absolutely no way to claim in good faith that you can protect your users when the data exists (or is touched in any way by, but that's another story) in the US, the examples for which we've seen often enough that every reader can be assumed to be familiar with them by now.

makomk 7y ago
The EU's position is that you can, in fact, claim in good faith that you're protecting your users when the data exists in the US, despite evidence to the contrary. There have been a few court cases about this, one of which is currently in progress, and at least one of which they lost and carried on doing it anyway. In any case, it's not something you can rely on EU data protection rules to protect against right now. On the other hand, the EU has been threatening to refuse to agree on the same for the UK, despite both having the exact same data protection frameworks as it currently stands. The actual rules have at least as much to do with internaational politics as they do with protecting people's privacy.
thu2111 7y ago
The physical location of the data doesn't matter. US employees can access any datacenter remotely around the world, so I often wonder why this topic comes up at all. For a while playing games with physical location was a neat legal hack in the US specifically, but the USG closed that loophole a few years back if I recall correctly and can now force US firms to give up data even if it's in a foreign datacenter.
- toyg 7y ago
  US employees accessing EU data held in the EU in manners that contravene EU laws, would be breaking the law and would expose their company to prosecution in EU courts. The issue is not about technical feasibility, it’s about exposure to legal repercussions. You can argue that respecting EU laws might expose you to prosecution in US and vice-versa, and that’s absolutely true. International law is messy.

DrScientist 7y ago

It's quite clear any anybody that the safe habour and privacy shield type agreements are fig leaves and logically incompatible with UK/EU data protection laws. Safe Habour was struck down, privacy shield may be going the same way. Essentially UK data protection says you can't put data beyond UK's law ability to enforce data protection rights, as that's clearly 'getting around' the law. The privacy shield is the latest pretense that somehow having the data under US jurisdiction, with a promise to behave nicely, is ok. However that promise is fundamentally worthless as US law takes precedence over that promise. Specifically the US government can demand US companies hand over the data, whatever they have promised to UK customers. That kind of issue is exactly why UK data protection law talks about jurisdiction in the first place. The only real logical legal solution to this is to have a world court on these issues - but everybody is trying to avoid that politically unpalatable outcome. You can talk about Brexit- but this is the real sovereignty issue in the 21st century.

cameronh90 7y ago
I think the main reason safe harbour was struck down was just that the safe harbour laws didn't have the same level of protection and enforcement as the GDPR requires, rather than fear over the US government demanding access to data. As I understand it, The GDPR is mostly concerned with the protection of routine usage of data, mostly by business and lower levels of government, rather than the government or security agencies accessing the data as part of a legal request or investigation. Indeed, the UK pretty encourages the NSA to access data on UK citizens as part of Five Eyes (and other parts of the EU as SSEUR and Nine Eyes). I'm no expert, but I'm guessing the idea behind those safe harbour type agreements is that both the US government has a well developed legal framework and was willing to sign a law allowing EU companies to enforce DPA violations on their own companies in the relevant context. As long as the companies have the legal requirement to protect EU data in an equivalent way to an EU company, and there are legal routes to enforce it, I don't see anything particularly wrong about them in principle. The issue of US companies allowing access to EU citizen data is an important one, and one I believe needs more attention, but it's unlikely to get it because it's by design at this point. And storing data in AWS UK doesn't exactly get around that, because the US government can just force their UK subsidiary to exfiltrate the data. But also I don't think it's strictly relevant to the GDPR safe harbour style provisions.