4 ms·

It's quite clear any anybody that the safe habour and privacy shield type agreements are fig leaves and logically incompatible with UK/EU data protection laws.

It's quite clear any anybody that the safe habour and privacy shield type agreements are fig leaves and logically incompatible with UK/EU data protection laws. Safe Habour was struck down, privacy shield may be going the same way. Essentially UK data protection says you can't put data beyond UK's law ability to enforce data protection rights, as that's clearly 'getting around' the law. The privacy shield is the latest pretense that somehow having the data under US jurisdiction, with a promise to behave nicely, is ok. However that promise is fundamentally worthless as US law takes precedence over that promise. Specifically the US government can demand US companies hand over the data, whatever they have promised to UK customers. That kind of issue is exactly why UK data protection law talks about jurisdiction in the first place. The only real logical legal solution to this is to have a world court on these issues - but everybody is trying to avoid that politically unpalatable outcome. You can talk about Brexit- but this is the real sovereignty issue in the 21st century.

cameronh90 7y ago
I think the main reason safe harbour was struck down was just that the safe harbour laws didn't have the same level of protection and enforcement as the GDPR requires, rather than fear over the US government demanding access to data. As I understand it, The GDPR is mostly concerned with the protection of routine usage of data, mostly by business and lower levels of government, rather than the government or security agencies accessing the data as part of a legal request or investigation. Indeed, the UK pretty encourages the NSA to access data on UK citizens as part of Five Eyes (and other parts of the EU as SSEUR and Nine Eyes). I'm no expert, but I'm guessing the idea behind those safe harbour type agreements is that both the US government has a well developed legal framework and was willing to sign a law allowing EU companies to enforce DPA violations on their own companies in the relevant context. As long as the companies have the legal requirement to protect EU data in an equivalent way to an EU company, and there are legal routes to enforce it, I don't see anything particularly wrong about them in principle. The issue of US companies allowing access to EU citizen data is an important one, and one I believe needs more attention, but it's unlikely to get it because it's by design at this point. And storing data in AWS UK doesn't exactly get around that, because the US government can just force their UK subsidiary to exfiltrate the data. But also I don't think it's strictly relevant to the GDPR safe harbour style provisions.
- DrScientist 7y ago
  > As long as the companies have the legal requirement to protect EU data in an equivalent way to an EU company, and there are legal routes to enforce it, I don't see anything particularly wrong about them in principle. But if there is US law which overrides that promise then it's not legally enforceable. That's why jurisdiction is so important. I'm not picking on the US particularly - I might have the same concern if I was an EU citizen and my data was in the UK post brexit. Or I was a US citizen with data aboard. > And storing data in AWS UK doesn't exactly get around that, because the US government can just force their UK subsidiary to exfiltrate the data. I'd agree even keeping it in the UK is now not a help from a US law perspective. The following case is very instructive: https://en.wikipedia.org/wiki/Microsoft_Corp._v._United_States https://en.wikipedia.org/wiki/Microsoft_Corp._v._United_Stat... Essentially the CLOUD Act - tries to give US government the right to demand US companies move data to the US - as I said - any promise a company makes is worthless. A lot of countries might see this as a the US trying to extend it's legal reach beyond what is reasonable. The EU say the CLOUD act is not compatible with GDPR without further international agreements. https://www.insideprivacy.com/data-privacy/european-data-protection-board-issues-opinion-on-u-s-cloud-act/ https://www.insideprivacy.com/data-privacy/european-data-pro... Currently the EU is playing nice, but it could decide to then charge the US companies officers with crimes ( stopping them ever visiting the EU ), or investigate the local offices etc. If we don't sort this out internationally then it could easily escalate - with the companies stuck in the middle. At the moment that has been a lot of LALALAL nothing to see approach to this, but the law is catching up with the technology - these issues can't be glossed over forever.

cameronh90 7y ago

I think the main reason safe harbour was struck down was just that the safe harbour laws didn't have the same level of protection and enforcement as the GDPR requires, rather than fear over the US government demanding access to data. As I understand it, The GDPR is mostly concerned with the protection of routine usage of data, mostly by business and lower levels of government, rather than the government or security agencies accessing the data as part of a legal request or investigation. Indeed, the UK pretty encourages the NSA to access data on UK citizens as part of Five Eyes (and other parts of the EU as SSEUR and Nine Eyes). I'm no expert, but I'm guessing the idea behind those safe harbour type agreements is that both the US government has a well developed legal framework and was willing to sign a law allowing EU companies to enforce DPA violations on their own companies in the relevant context. As long as the companies have the legal requirement to protect EU data in an equivalent way to an EU company, and there are legal routes to enforce it, I don't see anything particularly wrong about them in principle. The issue of US companies allowing access to EU citizen data is an important one, and one I believe needs more attention, but it's unlikely to get it because it's by design at this point. And storing data in AWS UK doesn't exactly get around that, because the US government can just force their UK subsidiary to exfiltrate the data. But also I don't think it's strictly relevant to the GDPR safe harbour style provisions.

DrScientist 7y ago
> As long as the companies have the legal requirement to protect EU data in an equivalent way to an EU company, and there are legal routes to enforce it, I don't see anything particularly wrong about them in principle. But if there is US law which overrides that promise then it's not legally enforceable. That's why jurisdiction is so important. I'm not picking on the US particularly - I might have the same concern if I was an EU citizen and my data was in the UK post brexit. Or I was a US citizen with data aboard. > And storing data in AWS UK doesn't exactly get around that, because the US government can just force their UK subsidiary to exfiltrate the data. I'd agree even keeping it in the UK is now not a help from a US law perspective. The following case is very instructive: https://en.wikipedia.org/wiki/Microsoft_Corp._v._United_States https://en.wikipedia.org/wiki/Microsoft_Corp._v._United_Stat... Essentially the CLOUD Act - tries to give US government the right to demand US companies move data to the US - as I said - any promise a company makes is worthless. A lot of countries might see this as a the US trying to extend it's legal reach beyond what is reasonable. The EU say the CLOUD act is not compatible with GDPR without further international agreements. https://www.insideprivacy.com/data-privacy/european-data-protection-board-issues-opinion-on-u-s-cloud-act/ https://www.insideprivacy.com/data-privacy/european-data-pro... Currently the EU is playing nice, but it could decide to then charge the US companies officers with crimes ( stopping them ever visiting the EU ), or investigate the local offices etc. If we don't sort this out internationally then it could easily escalate - with the companies stuck in the middle. At the moment that has been a lot of LALALAL nothing to see approach to this, but the law is catching up with the technology - these issues can't be glossed over forever.