4 ms·

Thanks for providing context. > It is literally not possible to adequately safeguard personal data in the US, because there are no redress mechanisms to improp

by cj 5y ago

Thanks for providing context. > It is literally not possible to adequately safeguard personal data in the US, because there are no redress mechanisms to improper access from US law enforcement. Isn’t it possible by signing a DPA with the standard contractual clauses? (Of course it’s usefulness is limited mostly to B2B use cases) Assuming a DPA + SCCs are signed, I suppose the redress mechanism would be a lawsuit.

bryanrasmussen 5y ago
a lawsuit against the company that gave the data to the U.S government when compelled? I think they want a redress action that also allows you delete the data, but the U.S government isn't going to do that I guess.
wbeckler 5y ago
The Schrems II ruling was that DPA+SCCs are insufficient for transferring data to a US company. You need to have "supplementary measures" in addition to the SCCs.
olliej 5y ago
No. Because the US courts have repeatedly declared that non-Americans have no due process rights. There is no contract or agreement an US company can provide or commit to that overrides US law. US law is that data from non-Americans does not have 4th amendment protection, and so any US entity is required to hand over data on request. It may require an NSL, I really can’t recall, but an NSL is a rubber stamp that is no harder to get than a subpoena. There is also no facility for redress in the event that a US entity illegally retrieves your data, largely because the aforementioned belief that US law enforcement is literally entitled to that data. In other words it is inherently impossible for any “illegal” search or retrieval. The US government has also ruled the old workaround of keeping data of EU folk in the EU does not work: if the data is under the control of a US entity, then the data is subject to arbitrary demands from US law enforcement. Even if you put those aside, the US doesn’t provide its own residents with the level of data protection ostensibly guaranteed by the EU. That’s unlikely to change as long as google, Facebook, continue paying to stop any data protection legislation.
deleted 5y ago
[deleted]

by cj 5y ago

bryanrasmussen 5y ago

a lawsuit against the company that gave the data to the U.S government when compelled? I think they want a redress action that also allows you delete the data, but the U.S government isn't going to do that I guess.

wbeckler 5y ago

The Schrems II ruling was that DPA+SCCs are insufficient for transferring data to a US company. You need to have "supplementary measures" in addition to the SCCs.

olliej 5y ago

No. Because the US courts have repeatedly declared that non-Americans have no due process rights. There is no contract or agreement an US company can provide or commit to that overrides US law. US law is that data from non-Americans does not have 4th amendment protection, and so any US entity is required to hand over data on request. It may require an NSL, I really can’t recall, but an NSL is a rubber stamp that is no harder to get than a subpoena. There is also no facility for redress in the event that a US entity illegally retrieves your data, largely because the aforementioned belief that US law enforcement is literally entitled to that data. In other words it is inherently impossible for any “illegal” search or retrieval. The US government has also ruled the old workaround of keeping data of EU folk in the EU does not work: if the data is under the control of a US entity, then the data is subject to arbitrary demands from US law enforcement. Even if you put those aside, the US doesn’t provide its own residents with the level of data protection ostensibly guaranteed by the EU. That’s unlikely to change as long as google, Facebook, continue paying to stop any data protection legislation.

deleted 5y ago

[deleted]