3 ms·

I can understand it's bad for companies relying on US services, but honestly this decision is not very surprising and has been looming over EU companies for sev

I can understand it's bad for companies relying on US services, but honestly this decision is not very surprising and has been looming over EU companies for several years now, so there has been ample time to prepare for it. On the positive side this might give startups based in the EU a small edge over US competitors (I know, protectionism is evil, free market rules, Europe tech startups are not competitive...). US companies can still do business in the EU btw, they will just need to structure their services so that data from EU citizens stays within the EU. For the larger players this shouldn't be an issue really, I think, smaller startups with limited resources might forgo the expansion into the EU though.

geewee 6y ago
Worth noting is that the standard contractual clauses don't necessarily specify that the data has to remain within the EU - it just mandates that the company has to provide adequate protections.
- ThePhysicist 6y ago
  Yes, but I'm not sure if that would work for data stored in the US as the problem is that intelligence agencies can request access to the data without the data subjects ever being notified about this. If the clauses cannot be effectively enforced (which I don't think they can in the US) it's not possible to rely on them.
  - geewee 6y ago
    The press release seems to suggest that the standard contractual clauses are still good enough - It'd be weird to suggest that if it isn't true in practice. But I'm unsure, and you have some valid points.
    - ThePhysicist 6y ago
      Yes relying on standard contractual clauses is a valid approach in general, but not necessarily for transferring data to the US. You can use them e.g. when transferring data to countries that provide effective and enforceable privacy guarantees, as e.g. Switzerland, South Korea or Singapore do.
  - deleted 6y ago
    [deleted]
AmericanChopper 6y ago
> On the positive side this might give startups based in the EU a small edge over US competitors (I know, protectionism is evil, free market rules, Europe tech startups are not competitive...) Most of these regulations are just anti-US protectionism in disguise. Regardless of the underlying merits of any such regulation, they’re used as trade barriers to give EU companies an edge over US ones, without doing anything as controversial as tariffs. I mean is there any material difference for a German citizen if their surveilled French intelligence over US intelligence? Sure, they have the EU courts to rely on, but if you’re caught up in a foreign (or even domestic) surveillance dragnet the outcome is going to be exactly the same, and there’s nothing you can do about it. All these agencies share huge amounts of data anyway, so the difference becomes quite academic. > US companies can still do business in the EU btw, they will just need to structure their services so that data from EU citizens stays within the EU I’d suggest people look at all of the privacy enforcement action in the EU, and ask themselves whether they think the actual outcome is protecting the privacy interest of EU citizens, or just the economic interests of member states.
- greatpatton 6y ago
  I think that you are kidding yourself. US has a massive surveillance/spying program of EU citizen data, as demonstrated by the different leaks, this is not speculation but hard facts. US judiciary system with secret courts and gag order is a joke from a European point of view (Justice is rendered in the name of the people not secretly). Surveillance by EU spying agency can really rely on EU court to make them stop (and yes having worked for legal interception system in Europe, people really take into account judiciary decision), and ISP are fighting back without the threat of gag order. BTW, I have to guess that your logic doesn't apply when the US refuse its data to go to China. Are you also saying that this is also pure US protectionism in disguise?
  - AmericanChopper 6y ago
    All the EU states have mass surveillance programs too. EU member states do very little to regulate dragnet surveillance, and processes around targeted surveillance are mostly equivalent to the US processes. Do you really think the target of an EU counter terrorism investigation is going to be notified that somebody is seeking a warrant to spy on them? Or do you think that would all be handled be secret processes and secret court orders? > BTW, I have to guess that your logic doesn't apply when the US refuse its data to go to China. This is the more hilarious aspect of this. EU and US intelligence agencies share huge amounts of information. If an EU citizen is spied on by say, France. Not only are they not going to know it’s happening, not only is there essentially nothing they can do about it, but the French government are more than happy to share anything they find with the NSA [0]. If the EU actually had a legitimate concern about US intelligence gaining access to EU citizen data, then these intelligence sharing arrangements would be illegal. This ruling doesn’t prevent US agencies from spying on EU citizens. The only thing it achieves is forcing US companies to do more business in the EU. [0]: https://theintercept.com/2018/03/01/nsa-global-surveillance-sigint-seniors/ https://theintercept.com/2018/03/01/nsa-global-surveillance-...

geewee 6y ago

Worth noting is that the standard contractual clauses don't necessarily specify that the data has to remain within the EU - it just mandates that the company has to provide adequate protections.

ThePhysicist 6y ago
Yes, but I'm not sure if that would work for data stored in the US as the problem is that intelligence agencies can request access to the data without the data subjects ever being notified about this. If the clauses cannot be effectively enforced (which I don't think they can in the US) it's not possible to rely on them.
- geewee 6y ago
  The press release seems to suggest that the standard contractual clauses are still good enough - It'd be weird to suggest that if it isn't true in practice. But I'm unsure, and you have some valid points.
  - ThePhysicist 6y ago
    Yes relying on standard contractual clauses is a valid approach in general, but not necessarily for transferring data to the US. You can use them e.g. when transferring data to countries that provide effective and enforceable privacy guarantees, as e.g. Switzerland, South Korea or Singapore do.
- deleted 6y ago
  [deleted]

AmericanChopper 6y ago

> On the positive side this might give startups based in the EU a small edge over US competitors (I know, protectionism is evil, free market rules, Europe tech startups are not competitive...) Most of these regulations are just anti-US protectionism in disguise. Regardless of the underlying merits of any such regulation, they’re used as trade barriers to give EU companies an edge over US ones, without doing anything as controversial as tariffs. I mean is there any material difference for a German citizen if their surveilled French intelligence over US intelligence? Sure, they have the EU courts to rely on, but if you’re caught up in a foreign (or even domestic) surveillance dragnet the outcome is going to be exactly the same, and there’s nothing you can do about it. All these agencies share huge amounts of data anyway, so the difference becomes quite academic. > US companies can still do business in the EU btw, they will just need to structure their services so that data from EU citizens stays within the EU I’d suggest people look at all of the privacy enforcement action in the EU, and ask themselves whether they think the actual outcome is protecting the privacy interest of EU citizens, or just the economic interests of member states.

greatpatton 6y ago
I think that you are kidding yourself. US has a massive surveillance/spying program of EU citizen data, as demonstrated by the different leaks, this is not speculation but hard facts. US judiciary system with secret courts and gag order is a joke from a European point of view (Justice is rendered in the name of the people not secretly). Surveillance by EU spying agency can really rely on EU court to make them stop (and yes having worked for legal interception system in Europe, people really take into account judiciary decision), and ISP are fighting back without the threat of gag order. BTW, I have to guess that your logic doesn't apply when the US refuse its data to go to China. Are you also saying that this is also pure US protectionism in disguise?
- AmericanChopper 6y ago
  All the EU states have mass surveillance programs too. EU member states do very little to regulate dragnet surveillance, and processes around targeted surveillance are mostly equivalent to the US processes. Do you really think the target of an EU counter terrorism investigation is going to be notified that somebody is seeking a warrant to spy on them? Or do you think that would all be handled be secret processes and secret court orders? > BTW, I have to guess that your logic doesn't apply when the US refuse its data to go to China. This is the more hilarious aspect of this. EU and US intelligence agencies share huge amounts of information. If an EU citizen is spied on by say, France. Not only are they not going to know it’s happening, not only is there essentially nothing they can do about it, but the French government are more than happy to share anything they find with the NSA [0]. If the EU actually had a legitimate concern about US intelligence gaining access to EU citizen data, then these intelligence sharing arrangements would be illegal. This ruling doesn’t prevent US agencies from spying on EU citizens. The only thing it achieves is forcing US companies to do more business in the EU. [0]: https://theintercept.com/2018/03/01/nsa-global-surveillance-sigint-seniors/ https://theintercept.com/2018/03/01/nsa-global-surveillance-...