10 ms·

EU-US privacy shield 2.0 is again a political show

63 points by pumkesjaan 4y ago

richwater 4y ago
- Barrin92 4y ago
  This is like blaming the government for making you look at black lungs on cigarette packages. It's not the government that's making you cough, they're just showing the result to you.
- stevesearer 4y ago
  I routinely visit the same websites on a daily basis and don’t understand why I have to accept cookies to the same sites over and over again. Shouldn’t they keep track of that?
  - MoSattler 4y ago
    Your browser might be blocking third party cookies.
  - Lariscus 4y ago
    Are you blocking cookies by default? Quite often your consent is saved in a cookie. There is of course also the possibility that the website operator is hoping that you get so annoyed that you consent to tracking sooner or later.
- turbinerneiter 4y ago
  It's not the EU who makes you do that, it's the companies making the website. They could not use cookies, they could respect DNT browser setting, they could have not abused tracking technology, and they couldmhave chosen to comply with the law in a user friendly way, instead of user-hostile way. They didn't. That's why now there is an imperfect law.
  - deleted 4y ago
    [deleted]
- Lariscus 4y ago
  The GDPR in no way requires cookie banners, that is the choice of the website you visited. Cookies required for functionality of a website do not require consent, privacy invading tracking cookies on the other hand do.
- MereInterest 4y ago
  Good news! It's not the EU at all. The websites you visit have the following alternative options: * Serve static content with no user-tracking. * Serve per-user dynamic content, where * Perform tracking that is essential to the service provided. (e.g. Recording GPS coordinates are essential to the service that Strava offers to users, so no explicit consent is required. Recording GPS coordinates is not essential to the service that Google, Facebook, or Amazon provide, so they must have consent to collect GPS coordinates.) So if a website is displaying a banner request to track you, it's because that website has made a deliberate choice not to use the other options available. Not only that, but you have additional options as well. * Hide each GDPR banner, such as using a custom filter in your ad-blocker. Consent to be tracked must be explicit, and ignoring/hiding a banner is not explicit consent. * Click the "I reject cookies" button instead. The GDPR requires that it be as easy to retract permission as it is to accept. Since the website has an "I accept cookies" button that only requires one click to complete, they must also have a "I reject cookies" button.
  - Macha 4y ago
    > Click the "I reject cookies" button instead. The GDPR requires that it be as easy to retract permission as it is to accept. Since the website has an "I accept cookies" button that only requires one click to complete, they must also have a "I reject cookies" button. As for when that'll be a reality, they are working on that: https://blog.google/around-the-globe/google-europe/new-cookie-choices-in-europe/ https://blog.google/around-the-globe/google-europe/new-cooki...
- olliej 4y ago
  No, those websites chose to make you do that. They could stop selling your data to google, Facebook, etc Or I guess you could blame the legislation that at least makes it obvious that that’s what they’re doing?
- JCWasmx86 4y ago
  Without the urge of the companies to track everything they can, you wouldn't have to deal with cookie banners. The only fault the EU has is that the fines for companies are far, far too low and the enforcement is too slow and rare
- o_m 4y ago
  Don't be angry at the EU, be angry of the owners of the website that makes it hard to say no to tracking.
dataking 4y ago
> For example, we’ve built a privacy-friendly alternative to Google Analytics called Simple Analytics. This is mostly a plug for their EU-compliant alternative to Google Analytics.
- rmbyrro 4y ago
  Let'em plug in peace, they also have bills (and perhaps employee salaries) to pay...
  - ILMostro7 4y ago
    Scrape a lil more off my backside, please. Of course I understand that as soon as I bend down, I have given consent and two enthusiastic thumbs up! You could either enjoy the hint of vulgarity there or the lack thereof; otherwise lazy reading, imo. Unless you are of the opinion that the only way a company can make money is through intrusive/abusive data analytics.
lmkg 4y ago
Quick refresher on context: Under GDPR, personal data sent from the EU to another country must have some level of protections in that country. By far the easiest option is an "adequacy decision," where the EU says "that country has good data protections" and no extra work must be done. USA has jack-diddly-squat for data protections in most contexts, but Privacy Shield was the work-around where companies could opt-in to additional legal restrictions, and EU had an adequacy decision for companies that did so. Schrems II is the EU court case that struck down the Adequacy Decision. The heart of the decision is the correct and accurate observation US law enforcement can compel a company to hand over data about an EU individual, and that EU individual has no recourse. There have been a series of court cases since Schrems II which expand upon the logical consequences of this ruling. Short version is, not only is the adequacy decision gone, but none of the other options in GDPR will work either. It is literally not possible to adequately safeguard personal data in the US, because there are no redress mechanisms to improper access from US law enforcement. There have been high-level talks about "Privacy Shield 2.0," and there were some announcements from both US and EU government agencies about a milestone in those talks. The linked article is making it clear, correctly, that the observable substance of those agreements extends no further than the name "Privacy Shield 2.0" The details of how this agreement will work are important. There is no evidence that such details exist, even in the form of smudged handwritten notes on the back of a used cocktail napkin. The EU and US have agreed that they would like it if something called Privacy Shield 2.0 were to exist in the future. That's great, I would like that as well. But we don't have one. This article is content marketing from Simple Analytics. Their marketing spin is that if you're deciding what Website Analytics solution to buy, you should not pin your hopes on Google Analytics being acceptable under GDPR in the near- or medium-term future. As someone whose professional interests mean I pay a lot of attention to both GDPR and Google Analytics, I think that statement is accurate.
- cj 4y ago
  Thanks for providing context. > It is literally not possible to adequately safeguard personal data in the US, because there are no redress mechanisms to improper access from US law enforcement. Isn’t it possible by signing a DPA with the standard contractual clauses? (Of course it’s usefulness is limited mostly to B2B use cases) Assuming a DPA + SCCs are signed, I suppose the redress mechanism would be a lawsuit.
turbinerneiter 4y ago
The biggest issue I have here is this: the EU is unable to uphold their own laws. They do things violating their own rules. They are unable to either patch their rules or stop the violation. I have seen similar things in German legislation, where the government tried to pass data retention laws that were cancelled by the constitutional court over and over again. The rules of business in the EU are such that the user has to have a certain control over the data a company has on them. The US rules giving law and intelligence access to this kind of data are fundamentally incompatible with that. Either the EU changes their rules, the US changes theirs (granting EU citizens some form of recourse) or the companies change where they store their data. Instead, they write agreements that will never hold up in court.
- twoneurons 4y ago
  They are kind of useful to levy billions of dollars from a handful of US companies. Laws are absurd, over complicated, and unevenly applied, but at least they finance the Brussels bureaucracy. I wonder if the Catholic Church applies the laws of data protection. If they retain or delete the records of the approximately 80% of baptized population.
  - xdennis 4y ago
    Privacy Shield died because the US explicitly believes in citizen rights, not human rights: > Agencies shall, to the extent consistent with applicable law, ensure that their privacy policies exclude persons who are not United States citizens or lawful permanent residents from the protections of the Privacy Act regarding personally identifiable information. -- https://en.wikipedia.org/wiki/EU%E2%80%93US_Privacy_Shield https://en.wikipedia.org/wiki/EU%E2%80%93US_Privacy_Shield It's easy to be cynical and blame the EU for being bureaucratic, but in this case the EU is actually doing its job: protecting its citizens from the abuses of foreign governments who won't grant us equal human rights.
    - legalcorrection 4y ago
      EU governments rampantly spy on their own citizens and domestically held data in ways that would make US agencies blush. This is exposed over and over again but no one cares because everyone is fixated on the US.
tims33 4y ago
Why not have this link to the Schrems article[0] rather than this advertisement for the Simple Analytics product? [0] https://noyb.eu/en/privacy-shield-20-first-reaction-max-schrems https://noyb.eu/en/privacy-shield-20-first-reaction-max-schr...
kkfx 4y ago
Honestly as an EU citizen... On one side there is no real development of a better IT infra to surpass/came back the giant data-centers model, witch means toward a real old-new connected desktop-centric IT AND there are not real EU competitors for many services from USA companies, so one one side EU do not really want to led again in tech nor to create a new and better IT. On the other side EU commission prove to be as oppressive and not representative of their Citizens interests as USA Gov for USA Citizens witch means that beside the formal democratic dress the substance is a neoliberal economically-driven dictatorship who tend as fast as it can to the Chinese model. We still have less ineffective justice, more protective norms, but differences are waning more and more. Swapping crappy and bad USA services that at least are battle tested with more crappy and even worse EU services does not help Citizens at all. For me until enough intellectual and techies rise training enough common citizens to IMPOSE BY LAW mandatory FLOSS and mandatory open hardware that makes the actual model not really sustainable we will not get anything really better. It's like those who flee GitHub for GitLab because "we do not want Microsoft" as if any other for-profit company would be better by magic. The real target should be surpassing the actual web model. not swapping an evil actor with another who being based on the very same principles will clearly be the very same.

63 points by pumkesjaan 4y ago

Barrin92 4y ago
This is like blaming the government for making you look at black lungs on cigarette packages. It's not the government that's making you cough, they're just showing the result to you.
stevesearer 4y ago
I routinely visit the same websites on a daily basis and don’t understand why I have to accept cookies to the same sites over and over again. Shouldn’t they keep track of that?
- MoSattler 4y ago
  Your browser might be blocking third party cookies.
- Lariscus 4y ago
  Are you blocking cookies by default? Quite often your consent is saved in a cookie. There is of course also the possibility that the website operator is hoping that you get so annoyed that you consent to tracking sooner or later.
turbinerneiter 4y ago
It's not the EU who makes you do that, it's the companies making the website. They could not use cookies, they could respect DNT browser setting, they could have not abused tracking technology, and they couldmhave chosen to comply with the law in a user friendly way, instead of user-hostile way. They didn't. That's why now there is an imperfect law.
- deleted 4y ago
  [deleted]
Lariscus 4y ago
The GDPR in no way requires cookie banners, that is the choice of the website you visited. Cookies required for functionality of a website do not require consent, privacy invading tracking cookies on the other hand do.
MereInterest 4y ago
Good news! It's not the EU at all. The websites you visit have the following alternative options: * Serve static content with no user-tracking. * Serve per-user dynamic content, where * Perform tracking that is essential to the service provided. (e.g. Recording GPS coordinates are essential to the service that Strava offers to users, so no explicit consent is required. Recording GPS coordinates is not essential to the service that Google, Facebook, or Amazon provide, so they must have consent to collect GPS coordinates.) So if a website is displaying a banner request to track you, it's because that website has made a deliberate choice not to use the other options available. Not only that, but you have additional options as well. * Hide each GDPR banner, such as using a custom filter in your ad-blocker. Consent to be tracked must be explicit, and ignoring/hiding a banner is not explicit consent. * Click the "I reject cookies" button instead. The GDPR requires that it be as easy to retract permission as it is to accept. Since the website has an "I accept cookies" button that only requires one click to complete, they must also have a "I reject cookies" button.
- Macha 4y ago
  > Click the "I reject cookies" button instead. The GDPR requires that it be as easy to retract permission as it is to accept. Since the website has an "I accept cookies" button that only requires one click to complete, they must also have a "I reject cookies" button. As for when that'll be a reality, they are working on that: https://blog.google/around-the-globe/google-europe/new-cookie-choices-in-europe/ https://blog.google/around-the-globe/google-europe/new-cooki...
olliej 4y ago
No, those websites chose to make you do that. They could stop selling your data to google, Facebook, etc Or I guess you could blame the legislation that at least makes it obvious that that’s what they’re doing?
JCWasmx86 4y ago
Without the urge of the companies to track everything they can, you wouldn't have to deal with cookie banners. The only fault the EU has is that the fines for companies are far, far too low and the enforcement is too slow and rare
o_m 4y ago
Don't be angry at the EU, be angry of the owners of the website that makes it hard to say no to tracking.

> For example, we’ve built a privacy-friendly alternative to Google Analytics called Simple Analytics. This is mostly a plug for their EU-compliant alternative to Google Analytics.

rmbyrro 4y ago
Let'em plug in peace, they also have bills (and perhaps employee salaries) to pay...
- ILMostro7 4y ago
  Scrape a lil more off my backside, please. Of course I understand that as soon as I bend down, I have given consent and two enthusiastic thumbs up! You could either enjoy the hint of vulgarity there or the lack thereof; otherwise lazy reading, imo. Unless you are of the opinion that the only way a company can make money is through intrusive/abusive data analytics.

lmkg 4y ago

Quick refresher on context: Under GDPR, personal data sent from the EU to another country must have some level of protections in that country. By far the easiest option is an "adequacy decision," where the EU says "that country has good data protections" and no extra work must be done. USA has jack-diddly-squat for data protections in most contexts, but Privacy Shield was the work-around where companies could opt-in to additional legal restrictions, and EU had an adequacy decision for companies that did so. Schrems II is the EU court case that struck down the Adequacy Decision. The heart of the decision is the correct and accurate observation US law enforcement can compel a company to hand over data about an EU individual, and that EU individual has no recourse. There have been a series of court cases since Schrems II which expand upon the logical consequences of this ruling. Short version is, not only is the adequacy decision gone, but none of the other options in GDPR will work either. It is literally not possible to adequately safeguard personal data in the US, because there are no redress mechanisms to improper access from US law enforcement. There have been high-level talks about "Privacy Shield 2.0," and there were some announcements from both US and EU government agencies about a milestone in those talks. The linked article is making it clear, correctly, that the observable substance of those agreements extends no further than the name "Privacy Shield 2.0" The details of how this agreement will work are important. There is no evidence that such details exist, even in the form of smudged handwritten notes on the back of a used cocktail napkin. The EU and US have agreed that they would like it if something called Privacy Shield 2.0 were to exist in the future. That's great, I would like that as well. But we don't have one. This article is content marketing from Simple Analytics. Their marketing spin is that if you're deciding what Website Analytics solution to buy, you should not pin your hopes on Google Analytics being acceptable under GDPR in the near- or medium-term future. As someone whose professional interests mean I pay a lot of attention to both GDPR and Google Analytics, I think that statement is accurate.

cj 4y ago
Thanks for providing context. > It is literally not possible to adequately safeguard personal data in the US, because there are no redress mechanisms to improper access from US law enforcement. Isn’t it possible by signing a DPA with the standard contractual clauses? (Of course it’s usefulness is limited mostly to B2B use cases) Assuming a DPA + SCCs are signed, I suppose the redress mechanism would be a lawsuit.

turbinerneiter 4y ago

The biggest issue I have here is this: the EU is unable to uphold their own laws. They do things violating their own rules. They are unable to either patch their rules or stop the violation. I have seen similar things in German legislation, where the government tried to pass data retention laws that were cancelled by the constitutional court over and over again. The rules of business in the EU are such that the user has to have a certain control over the data a company has on them. The US rules giving law and intelligence access to this kind of data are fundamentally incompatible with that. Either the EU changes their rules, the US changes theirs (granting EU citizens some form of recourse) or the companies change where they store their data. Instead, they write agreements that will never hold up in court.

twoneurons 4y ago
They are kind of useful to levy billions of dollars from a handful of US companies. Laws are absurd, over complicated, and unevenly applied, but at least they finance the Brussels bureaucracy. I wonder if the Catholic Church applies the laws of data protection. If they retain or delete the records of the approximately 80% of baptized population.
- xdennis 4y ago
  Privacy Shield died because the US explicitly believes in citizen rights, not human rights: > Agencies shall, to the extent consistent with applicable law, ensure that their privacy policies exclude persons who are not United States citizens or lawful permanent residents from the protections of the Privacy Act regarding personally identifiable information. -- https://en.wikipedia.org/wiki/EU%E2%80%93US_Privacy_Shield https://en.wikipedia.org/wiki/EU%E2%80%93US_Privacy_Shield It's easy to be cynical and blame the EU for being bureaucratic, but in this case the EU is actually doing its job: protecting its citizens from the abuses of foreign governments who won't grant us equal human rights.
  - legalcorrection 4y ago
    EU governments rampantly spy on their own citizens and domestically held data in ways that would make US agencies blush. This is exposed over and over again but no one cares because everyone is fixated on the US.

tims33 4y ago

Why not have this link to the Schrems article[0] rather than this advertisement for the Simple Analytics product? [0] https://noyb.eu/en/privacy-shield-20-first-reaction-max-schrems https://noyb.eu/en/privacy-shield-20-first-reaction-max-schr...

kkfx 4y ago

Honestly as an EU citizen... On one side there is no real development of a better IT infra to surpass/came back the giant data-centers model, witch means toward a real old-new connected desktop-centric IT AND there are not real EU competitors for many services from USA companies, so one one side EU do not really want to led again in tech nor to create a new and better IT. On the other side EU commission prove to be as oppressive and not representative of their Citizens interests as USA Gov for USA Citizens witch means that beside the formal democratic dress the substance is a neoliberal economically-driven dictatorship who tend as fast as it can to the Chinese model. We still have less ineffective justice, more protective norms, but differences are waning more and more. Swapping crappy and bad USA services that at least are battle tested with more crappy and even worse EU services does not help Citizens at all. For me until enough intellectual and techies rise training enough common citizens to IMPOSE BY LAW mandatory FLOSS and mandatory open hardware that makes the actual model not really sustainable we will not get anything really better. It's like those who flee GitHub for GitLab because "we do not want Microsoft" as if any other for-profit company would be better by magic. The real target should be surpassing the actual web model. not swapping an evil actor with another who being based on the very same principles will clearly be the very same.