5 ms·

The problem is more basic. EU companies illegally transferring billions of email adresses to Mailchimp. [Edit] The ECJ voided Privacy Shield because it did not

The problem is more basic. EU companies illegally transferring billions of email adresses to Mailchimp. [Edit] The ECJ voided Privacy Shield because it did not protect the data of EU citizens. The way forward would be Standard Contractual Clauses (SCC)as a tool the ECJ said. The EU comission formulated (an instance of) Standard Contractual Clauses. These have not been accepted by EU data protection agencies (yet). Until they are accepted they do not protect against being fined. Those are for every third country. In the special case of the US currently you can't create SCCs that work because the EU citizen has no lever against three letter US agencies. Until the US changes it's position here, you're not safe with SCCs. Private contracts can or can't safe you. e.g. if I have a contract with someone to steal something togther, the contract doesn't make it legal. Although it is legal to have a contract.

iamacyborg 6y ago
Illegal in what sense?
- jeroenhd 6y ago
  Not the parent, but here's my take: Email addresses are PII and Mailchimp is a US company. With the death of privacy shield, handing over your customers' PII to an American company is a gross violation of the GDPR and its implementations. An EU company sending email to customers using American services would be a legal minefield if the GDPR would actually get enforced. As far as I know, no data protection agency has looked into the practice as of yet. Of course, that could all change very quickly. Personally, I think the use of American services such as AWS, Azure and GCloud should be looked into first, though. Sharing a list of email addresses is nothing compared to placing your entire customer database into the hands of Amazon.
  - LunaSea 6y ago
    It really isn't a mine field. You can simply sign a Data Processing Agreement (DPA with MailChimp containing Standard Contractual Clauses (SCC) and you're good to go.
    - KingOfCoders 6y ago
      No you're not. Standard clauses CAN be a solution if they address the problems with transfering data. Currently you can't have Standard clauses with the US, because EU citizens have no say against the NSA.
      - LunaSea 6y ago
        You absolutely can and it's the official solution proposed by the Court of Justice of the European Union since July 16th 2020, date of the Max Schrems II decision.
        deleted 6y ago
        [deleted]
        germanier 6y ago
        In theory. The court clearly stated that the data exporter has to suspend the data transfer if the recipient is unable to comply with that contract (which must ensure the level of protection required by EU law). This is currently not possible for an US entity in practice, as the court also found, because US law does not grant non-US-citizens actionable rights against US authorities in that matter. Official summary by the court https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf https://curia.europa.eu/jcms/upload/docs/application/pdf/202... Judgement itself http://curia.europa.eu/juris/document/document.jsf?text=&docid=228677&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=5223319 http://curia.europa.eu/juris/document/document.jsf?text=&doc...
        KingOfCoders 6y ago
        Deleted my comment because yours is much better.
        LunaSea 6y ago
        And in practice the website of the Court of Justice of the European Union loads YouTube videos so I'll follow what they are doing as an example and justification.
  - bennyp101 6y ago
    The whole thing is a minefield - I think the idea is great - but the whole implementation is just such a fudge, and it came in with no real clear guidance on how things should work. I think that's why we don't see a lot of enforcement, unless it is a blindingly clear violation.
  - KingOfCoders 6y ago
    German data protection agencies announced last week that they have compiled lists of companies because they want to start enforcing this 2021. "German companies are threatened with stricter controls because of the transfer of personal user data to the USA. The majority of the German data protection authorities are participating in a task force headed by Hamburg and Berlin, "which coordinates the implementation of the requirements of the Schrems II ruling," said the Hamburg data protection officer Johannes Caspar on request from Golem.de. The authorities wanted to randomly select and write to companies nationwide "for which there is reason to assume that they use service providers from third countries". [German] https://www.golem.de/news/datenschutz-task-force-will-nutzung-von-us-clouddiensten-pruefen-2102-154206.html https://www.golem.de/news/datenschutz-task-force-will-nutzun...
  - dkersten 6y ago
    > I think the use of American services such as AWS, Azure and GCloud should be looked into first, though. Many EU companies use the EU hosted versions of these services. For example, I know of a number of EU companies that host their AWS stuff in eu-west in Dublin.
    - KingOfCoders 6y ago
      1. Yes. 2. https://en.wikipedia.org/wiki/CLOUD_Act https://en.wikipedia.org/wiki/CLOUD_Act is not tested yet with the ECJ.
bennyp101 6y ago
As long as it is being disclosed, then there is not a massive problem. They have a Data Processing Addendum [1] that covers GDPR stuff, and the whole Privacy Shield stuff from last year doesn't matter too much because Standard Contractual Clauses are still valid (which that DPA is a part of [2]) so nobody is doing anything illegal if they are following the rules that were set out. Obviously there are still plenty of companies that /don't/ follow it, but that doesn't rely on Mailchimp being involved. 1. https://mailchimp.com/legal/data-processing-addendum/ https://mailchimp.com/legal/data-processing-addendum/ 2. https://mailchimp.com/help/mailchimp-european-data-transfers/ https://mailchimp.com/help/mailchimp-european-data-transfers... Edit: That's my understanding from reading their docs last year, anyway
- KingOfCoders 6y ago
  Privacy Shield is void. Standard Contractual Clauses need to be validated by the EU on individual bases, those companies have with companies in the EU are most probably not enough - but this is not tested yet. At least for Germany it's clear that Standard Contractual Clauses in the way they are now, are not enough. Because they don't solve the problem of the NSA grabbing data without EU citiziens having any rights. German data protection agencies have started a project for 2021 where they have compiled lists. I would assume everyone using MailChimp will get a mail from an agency this year.

iamacyborg 6y ago

Illegal in what sense?

jeroenhd 6y ago
Not the parent, but here's my take: Email addresses are PII and Mailchimp is a US company. With the death of privacy shield, handing over your customers' PII to an American company is a gross violation of the GDPR and its implementations. An EU company sending email to customers using American services would be a legal minefield if the GDPR would actually get enforced. As far as I know, no data protection agency has looked into the practice as of yet. Of course, that could all change very quickly. Personally, I think the use of American services such as AWS, Azure and GCloud should be looked into first, though. Sharing a list of email addresses is nothing compared to placing your entire customer database into the hands of Amazon.
- LunaSea 6y ago
  It really isn't a mine field. You can simply sign a Data Processing Agreement (DPA with MailChimp containing Standard Contractual Clauses (SCC) and you're good to go.
  - KingOfCoders 6y ago
    No you're not. Standard clauses CAN be a solution if they address the problems with transfering data. Currently you can't have Standard clauses with the US, because EU citizens have no say against the NSA.
    - LunaSea 6y ago
      You absolutely can and it's the official solution proposed by the Court of Justice of the European Union since July 16th 2020, date of the Max Schrems II decision.
      - deleted 6y ago
        [deleted]
      - germanier 6y ago
        In theory. The court clearly stated that the data exporter has to suspend the data transfer if the recipient is unable to comply with that contract (which must ensure the level of protection required by EU law). This is currently not possible for an US entity in practice, as the court also found, because US law does not grant non-US-citizens actionable rights against US authorities in that matter. Official summary by the court https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf https://curia.europa.eu/jcms/upload/docs/application/pdf/202... Judgement itself http://curia.europa.eu/juris/document/document.jsf?text=&docid=228677&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=5223319 http://curia.europa.eu/juris/document/document.jsf?text=&doc...
        KingOfCoders 6y ago
        Deleted my comment because yours is much better.
        LunaSea 6y ago
        And in practice the website of the Court of Justice of the European Union loads YouTube videos so I'll follow what they are doing as an example and justification.
- bennyp101 6y ago
  The whole thing is a minefield - I think the idea is great - but the whole implementation is just such a fudge, and it came in with no real clear guidance on how things should work. I think that's why we don't see a lot of enforcement, unless it is a blindingly clear violation.
- KingOfCoders 6y ago
  German data protection agencies announced last week that they have compiled lists of companies because they want to start enforcing this 2021. "German companies are threatened with stricter controls because of the transfer of personal user data to the USA. The majority of the German data protection authorities are participating in a task force headed by Hamburg and Berlin, "which coordinates the implementation of the requirements of the Schrems II ruling," said the Hamburg data protection officer Johannes Caspar on request from Golem.de. The authorities wanted to randomly select and write to companies nationwide "for which there is reason to assume that they use service providers from third countries". [German] https://www.golem.de/news/datenschutz-task-force-will-nutzung-von-us-clouddiensten-pruefen-2102-154206.html https://www.golem.de/news/datenschutz-task-force-will-nutzun...
- dkersten 6y ago
  > I think the use of American services such as AWS, Azure and GCloud should be looked into first, though. Many EU companies use the EU hosted versions of these services. For example, I know of a number of EU companies that host their AWS stuff in eu-west in Dublin.
  - KingOfCoders 6y ago
    1. Yes. 2. https://en.wikipedia.org/wiki/CLOUD_Act https://en.wikipedia.org/wiki/CLOUD_Act is not tested yet with the ECJ.

bennyp101 6y ago

As long as it is being disclosed, then there is not a massive problem. They have a Data Processing Addendum [1] that covers GDPR stuff, and the whole Privacy Shield stuff from last year doesn't matter too much because Standard Contractual Clauses are still valid (which that DPA is a part of [2]) so nobody is doing anything illegal if they are following the rules that were set out. Obviously there are still plenty of companies that /don't/ follow it, but that doesn't rely on Mailchimp being involved. 1. https://mailchimp.com/legal/data-processing-addendum/ https://mailchimp.com/legal/data-processing-addendum/ 2. https://mailchimp.com/help/mailchimp-european-data-transfers/ https://mailchimp.com/help/mailchimp-european-data-transfers... Edit: That's my understanding from reading their docs last year, anyway

KingOfCoders 6y ago
Privacy Shield is void. Standard Contractual Clauses need to be validated by the EU on individual bases, those companies have with companies in the EU are most probably not enough - but this is not tested yet. At least for Germany it's clear that Standard Contractual Clauses in the way they are now, are not enough. Because they don't solve the problem of the NSA grabbing data without EU citiziens having any rights. German data protection agencies have started a project for 2021 where they have compiled lists. I would assume everyone using MailChimp will get a mail from an agency this year.