7 ms·

This is bad news for everyone in the EU who has data in the US and uses the Privacy Shield act as the protection guarantee. We do that currently for some data p

• arpinum 6y ago
  The ruling notes that standard contractual clauses are still available. Most providers offer a Data Processing Agreement that can be signed and amended to the standard contract for businesses in the EU. It then gets muddy though as a DPA needs to be considered against possible legal demands of the US Gov and whether the processor will be forced to comply, assuming the data is stored unencrypted and it is possible to comply.
  • geewee 6y ago
    Yes hopefully it'll just be some extra paperwork.
  • ThePhysicist 6y ago
    You cannot rely on these clauses if they can't be effectively enforced, so I'm doubtful whether they will allow you transferring personal data to the US.
  • terom 6y ago
    Quoting from the press release, the data exporter must take into account both the contractual clauses AND the surveillance laws of the target country. It is not sufficient to rely on a contract with a US data processor where the US surveillance laws do not make it possible for the recipient to comply with that contract. > In those circumstances, the Court specifies that the assessment of that level of protection must take into consideration both the contractual clauses agreed between the data exporter established in the EU and the recipient of the transfer established in the third country concerned and, as regards any access by the public authorities of that third country to the data transferred, the relevant aspects of the legal system of that third country. > [...] that decision imposes an obligation on a data exporter and the recipient of the data to verify, prior to any transfer, whether that level of protection is respected in the third country concerned and that the decision requires the recipient to inform the data exporter of any inability to comply with the standard data protection clauses, the latter then being, in turn, obliged to suspend the transfer of data and/or to terminate the contract with the former.
• ThePhysicist 6y ago
  I can understand it's bad for companies relying on US services, but honestly this decision is not very surprising and has been looming over EU companies for several years now, so there has been ample time to prepare for it. On the positive side this might give startups based in the EU a small edge over US competitors (I know, protectionism is evil, free market rules, Europe tech startups are not competitive...). US companies can still do business in the EU btw, they will just need to structure their services so that data from EU citizens stays within the EU. For the larger players this shouldn't be an issue really, I think, smaller startups with limited resources might forgo the expansion into the EU though.
  • geewee 6y ago
    Worth noting is that the standard contractual clauses don't necessarily specify that the data has to remain within the EU - it just mandates that the company has to provide adequate protections.
    • ThePhysicist 6y ago
      Yes, but I'm not sure if that would work for data stored in the US as the problem is that intelligence agencies can request access to the data without the data subjects ever being notified about this. If the clauses cannot be effectively enforced (which I don't think they can in the US) it's not possible to rely on them.
      • geewee 6y ago
        The press release seems to suggest that the standard contractual clauses are still good enough - It'd be weird to suggest that if it isn't true in practice. But I'm unsure, and you have some valid points.
        • ThePhysicist 6y ago
          Yes relying on standard contractual clauses is a valid approach in general, but not necessarily for transferring data to the US. You can use them e.g. when transferring data to countries that provide effective and enforceable privacy guarantees, as e.g. Switzerland, South Korea or Singapore do.
• dx034 6y ago
  It might be good news for EU consumers. There's no technical reason for most vendors why customer data of EU customers has to be stored in US data centers.
  • geewee 6y ago
    As a consumer I'm all for it - but as a vendor it does make things a little more difficult
  • tdrp 6y ago
    I mean you can store EU users' data on an EU server but if any US users are allowed to communicate/look at EU users then obviously the data is going to travel across the ocean. Maybe I'm reading too much into what constitutes as "personal-data" but last I checked they had broadened that a lot. What happens if I view a EU user's linkedin profile from the US - isn't that all personal data? I hope there's at least an informed consent opt-out for this. If not, it's not super clear to me what the work-around is other than completely isolating the continents.
    • simion314 6y ago
      >What happens if I view a EU user's linkedin profile from the US How can you see a private profile if it is private?
  • woodhull 6y ago
    We're already running separate US/EU points of presence on AWS. The trouble is that as a small business we can't afford to have two separate operations teams for the US instance vs. the EU instance. We're all based in North America too and it is not practical for us to hire a whole separate devops team for Europe. Our US based engineers could in theory be compelled to hand over the data stored at rest in the EU. They could also in theory see PII like names or email addresses in the course of administering the application on their laptops in the US which counts as data export, so would still need Privacy Shield or now SCC to allow engineers to do their everyday work keeping the product up and working.
• M2Ys4U 6y ago
  >This is bad news for everyone in the EU who has data in the US and uses the Privacy Shield act as the protection guarantee. This ruling was in no way surprising, though. Anyone doing due diligence should have easily seen that Privacy Shield was going to be struck down by the CJEU eventually.