4 ms·

Illegal in what sense?

jeroenhd 6y ago
Not the parent, but here's my take: Email addresses are PII and Mailchimp is a US company. With the death of privacy shield, handing over your customers' PII to an American company is a gross violation of the GDPR and its implementations. An EU company sending email to customers using American services would be a legal minefield if the GDPR would actually get enforced. As far as I know, no data protection agency has looked into the practice as of yet. Of course, that could all change very quickly. Personally, I think the use of American services such as AWS, Azure and GCloud should be looked into first, though. Sharing a list of email addresses is nothing compared to placing your entire customer database into the hands of Amazon.
- LunaSea 6y ago
  It really isn't a mine field. You can simply sign a Data Processing Agreement (DPA with MailChimp containing Standard Contractual Clauses (SCC) and you're good to go.
  - KingOfCoders 6y ago
    No you're not. Standard clauses CAN be a solution if they address the problems with transfering data. Currently you can't have Standard clauses with the US, because EU citizens have no say against the NSA.
    - LunaSea 6y ago
      You absolutely can and it's the official solution proposed by the Court of Justice of the European Union since July 16th 2020, date of the Max Schrems II decision.
      - deleted 6y ago
        [deleted]
      - germanier 6y ago
        In theory. The court clearly stated that the data exporter has to suspend the data transfer if the recipient is unable to comply with that contract (which must ensure the level of protection required by EU law). This is currently not possible for an US entity in practice, as the court also found, because US law does not grant non-US-citizens actionable rights against US authorities in that matter. Official summary by the court https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf https://curia.europa.eu/jcms/upload/docs/application/pdf/202... Judgement itself http://curia.europa.eu/juris/document/document.jsf?text=&docid=228677&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=5223319 http://curia.europa.eu/juris/document/document.jsf?text=&doc...
        KingOfCoders 6y ago
        Deleted my comment because yours is much better.
        LunaSea 6y ago
        And in practice the website of the Court of Justice of the European Union loads YouTube videos so I'll follow what they are doing as an example and justification.
    - deleted 6y ago
      [deleted]
- bennyp101 6y ago
  The whole thing is a minefield - I think the idea is great - but the whole implementation is just such a fudge, and it came in with no real clear guidance on how things should work. I think that's why we don't see a lot of enforcement, unless it is a blindingly clear violation.
- KingOfCoders 6y ago
  German data protection agencies announced last week that they have compiled lists of companies because they want to start enforcing this 2021. "German companies are threatened with stricter controls because of the transfer of personal user data to the USA. The majority of the German data protection authorities are participating in a task force headed by Hamburg and Berlin, "which coordinates the implementation of the requirements of the Schrems II ruling," said the Hamburg data protection officer Johannes Caspar on request from Golem.de. The authorities wanted to randomly select and write to companies nationwide "for which there is reason to assume that they use service providers from third countries". [German] https://www.golem.de/news/datenschutz-task-force-will-nutzung-von-us-clouddiensten-pruefen-2102-154206.html https://www.golem.de/news/datenschutz-task-force-will-nutzun...
- dkersten 6y ago
  > I think the use of American services such as AWS, Azure and GCloud should be looked into first, though. Many EU companies use the EU hosted versions of these services. For example, I know of a number of EU companies that host their AWS stuff in eu-west in Dublin.
  - KingOfCoders 6y ago
    1. Yes. 2. https://en.wikipedia.org/wiki/CLOUD_Act https://en.wikipedia.org/wiki/CLOUD_Act is not tested yet with the ECJ.

Not the parent, but here's my take: Email addresses are PII and Mailchimp is a US company. With the death of privacy shield, handing over your customers' PII to an American company is a gross violation of the GDPR and its implementations. An EU company sending email to customers using American services would be a legal minefield if the GDPR would actually get enforced. As far as I know, no data protection agency has looked into the practice as of yet. Of course, that could all change very quickly. Personally, I think the use of American services such as AWS, Azure and GCloud should be looked into first, though. Sharing a list of email addresses is nothing compared to placing your entire customer database into the hands of Amazon.

LunaSea 6y ago
It really isn't a mine field. You can simply sign a Data Processing Agreement (DPA with MailChimp containing Standard Contractual Clauses (SCC) and you're good to go.
- KingOfCoders 6y ago
  No you're not. Standard clauses CAN be a solution if they address the problems with transfering data. Currently you can't have Standard clauses with the US, because EU citizens have no say against the NSA.
  - LunaSea 6y ago
    You absolutely can and it's the official solution proposed by the Court of Justice of the European Union since July 16th 2020, date of the Max Schrems II decision.
    - deleted 6y ago
      [deleted]
    - germanier 6y ago
      In theory. The court clearly stated that the data exporter has to suspend the data transfer if the recipient is unable to comply with that contract (which must ensure the level of protection required by EU law). This is currently not possible for an US entity in practice, as the court also found, because US law does not grant non-US-citizens actionable rights against US authorities in that matter. Official summary by the court https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf https://curia.europa.eu/jcms/upload/docs/application/pdf/202... Judgement itself http://curia.europa.eu/juris/document/document.jsf?text=&docid=228677&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=5223319 http://curia.europa.eu/juris/document/document.jsf?text=&doc...
      - KingOfCoders 6y ago
        Deleted my comment because yours is much better.
      - LunaSea 6y ago
        And in practice the website of the Court of Justice of the European Union loads YouTube videos so I'll follow what they are doing as an example and justification.
  - deleted 6y ago
    [deleted]
bennyp101 6y ago
The whole thing is a minefield - I think the idea is great - but the whole implementation is just such a fudge, and it came in with no real clear guidance on how things should work. I think that's why we don't see a lot of enforcement, unless it is a blindingly clear violation.
KingOfCoders 6y ago
German data protection agencies announced last week that they have compiled lists of companies because they want to start enforcing this 2021. "German companies are threatened with stricter controls because of the transfer of personal user data to the USA. The majority of the German data protection authorities are participating in a task force headed by Hamburg and Berlin, "which coordinates the implementation of the requirements of the Schrems II ruling," said the Hamburg data protection officer Johannes Caspar on request from Golem.de. The authorities wanted to randomly select and write to companies nationwide "for which there is reason to assume that they use service providers from third countries". [German] https://www.golem.de/news/datenschutz-task-force-will-nutzung-von-us-clouddiensten-pruefen-2102-154206.html https://www.golem.de/news/datenschutz-task-force-will-nutzun...
dkersten 6y ago
> I think the use of American services such as AWS, Azure and GCloud should be looked into first, though. Many EU companies use the EU hosted versions of these services. For example, I know of a number of EU companies that host their AWS stuff in eu-west in Dublin.
- KingOfCoders 6y ago
  1. Yes. 2. https://en.wikipedia.org/wiki/CLOUD_Act https://en.wikipedia.org/wiki/CLOUD_Act is not tested yet with the ECJ.