4 ms·

They're not insisting on keeping European user data in Europe, though. They've simply concluded that US surveillance laws provide too few protections to non-US

They're not insisting on keeping European user data in Europe, though. They've simply concluded that US surveillance laws provide too few protections to non-US citizens living in Europe for their data to be transferable to the US, and that neither Privacy Shield not Standard Contractual Clauses can overcome that. The EU still allows transfering data to other third countries if suitable protections can be effectively put in place, whether through some governmentally agreed program like what Privacy Shield tried to do or through Standard Contractual Clauses. They simply view the laws in the US as too hostile to most of their residents' data privacy rights. ("Most" instead of "all" because US citizens have more protections under US law even when living in Europe.) So, while sure it is a kind of border, it's a "privacy-protected vs privacy-dangerous" border rather than a blanket "us vs them" border. Or, phrased another way, it's not a border as a goal, but rather preventing the nature of the internet from overriding their separate privacy goal. I am fine with that attitude.

Nasrudith 6y ago
The concept is still worryingly dangerous given the precedent of "Can't move data outside our jurisdiction" could easily be applied to limit security and ensure snooping instead of preventing it. Given the usual habits and hypocrisies trusting them as far as you can throw them remains wise.
- jkaplowitz 6y ago
  Sure, but even now they're not saying "Can't move data outside our jurisdiction". They're just saying "if you move data outside our jurisdiction, you must put in place suitable safeguards to protect our residents' privacy - and this requirement is currently impossible to meet in the US". There are enough third countries worldwide where the laws would allow, for instance, the Standard Contractual Clauses plus suitable due diligence in practice by the parties concerned to make legal transfers outside of the EU.

Nasrudith 6y ago

The concept is still worryingly dangerous given the precedent of "Can't move data outside our jurisdiction" could easily be applied to limit security and ensure snooping instead of preventing it. Given the usual habits and hypocrisies trusting them as far as you can throw them remains wise.

jkaplowitz 6y ago
Sure, but even now they're not saying "Can't move data outside our jurisdiction". They're just saying "if you move data outside our jurisdiction, you must put in place suitable safeguards to protect our residents' privacy - and this requirement is currently impossible to meet in the US". There are enough third countries worldwide where the laws would allow, for instance, the Standard Contractual Clauses plus suitable due diligence in practice by the parties concerned to make legal transfers outside of the EU.