4 ms·
Quick refresher on context: Under GDPR, personal data sent from the EU to another country must have some level of protections in that country. By far the easies
by lmkg 4y ago
Quick refresher on context: Under GDPR, personal data sent from the EU to another country must have some level of protections in that country. By far the easiest option is an "adequacy decision," where the EU says "that country has good data protections" and no extra work must be done. USA has jack-diddly-squat for data protections in most contexts, but Privacy Shield was the work-around where companies could opt-in to additional legal restrictions, and EU had an adequacy decision for companies that did so.
Schrems II is the EU court case that struck down the Adequacy Decision. The heart of the decision is the correct and accurate observation US law enforcement can compel a company to hand over data about an EU individual, and that EU individual has no recourse. There have been a series of court cases since Schrems II which expand upon the logical consequences of this ruling. Short version is, not only is the adequacy decision gone, but none of the other options in GDPR will work either. It is literally not possible to adequately safeguard personal data in the US, because there are no redress mechanisms to improper access from US law enforcement.
There have been high-level talks about "Privacy Shield 2.0," and there were some announcements from both US and EU government agencies about a milestone in those talks. The linked article is making it clear, correctly, that the observable substance of those agreements extends no further than the name "Privacy Shield 2.0" The details of how this agreement will work are important. There is no evidence that such details exist, even in the form of smudged handwritten notes on the back of a used cocktail napkin.
The EU and US have agreed that they would like it if something called Privacy Shield 2.0 were to exist in the future. That's great, I would like that as well. But we don't have one.
This article is content marketing from Simple Analytics. Their marketing spin is that if you're deciding what Website Analytics solution to buy, you should not pin your hopes on Google Analytics being acceptable under GDPR in the near- or medium-term future. As someone whose professional interests mean I pay a lot of attention to both GDPR and Google Analytics, I think that statement is accurate.
- cj 4y agoThanks for providing context. > It is literally not possible to adequately safeguard personal data in the US, because there are no redress mechanisms to improper access from US law enforcement. Isn’t it possible by signing a DPA with the standard contractual clauses? (Of course it’s usefulness is limited mostly to B2B use cases) Assuming a DPA + SCCs are signed, I suppose the redress mechanism would be a lawsuit.
- bryanrasmussen 4y agoa lawsuit against the company that gave the data to the U.S government when compelled? I think they want a redress action that also allows you delete the data, but the U.S government isn't going to do that I guess.
- wbeckler 4y agoThe Schrems II ruling was that DPA+SCCs are insufficient for transferring data to a US company. You need to have "supplementary measures" in addition to the SCCs.
- olliej 4y agoNo. Because the US courts have repeatedly declared that non-Americans have no due process rights. There is no contract or agreement an US company can provide or commit to that overrides US law. US law is that data from non-Americans does not have 4th amendment protection, and so any US entity is required to hand over data on request. It may require an NSL, I really can’t recall, but an NSL is a rubber stamp that is no harder to get than a subpoena. There is also no facility for redress in the event that a US entity illegally retrieves your data, largely because the aforementioned belief that US law enforcement is literally entitled to that data. In other words it is inherently impossible for any “illegal” search or retrieval. The US government has also ruled the old workaround of keeping data of EU folk in the EU does not work: if the data is under the control of a US entity, then the data is subject to arbitrary demands from US law enforcement. Even if you put those aside, the US doesn’t provide its own residents with the level of data protection ostensibly guaranteed by the EU. That’s unlikely to change as long as google, Facebook, continue paying to stop any data protection legislation.
- deleted 4y ago[deleted]
- kkfx 4y agoThe issue is that proving the non-respect of those norms is aleatory. Alphabet or Zoom might say "we do respect GDPR, we do not record calls, perform behavioral analysis on them etc", IF for some reason I discover a third party have something that can only came from Zoom I might suspect a privacy violation and so file a formal complaint, otherwise I'm almost powerless in 99% of the case. Surely reverse engineering is not illegal, good luck to do so for any services, including the giants like Android, including their baseband etc. Such laws can only work with mandatory FLOSS and open hardware with verifiable builds. Only one absent and the norms are just smoke. Oh BTW USA or EU actors does not change much, formally the USA Patriot Act change things, but only formally because the business model of an USA actor is the same of an EU one.