4 ms·
In the public sector of Denmark we suddenly had to view the risk factor of America not remaining a safe harbour for data in the wake of the 2016 election. I’d l
by EnKopVand 4y ago
In the public sector of Denmark we suddenly had to view the risk factor of America not remaining a safe harbour for data in the wake of the 2016 election. I’d like to point out by now that what I’m saying isn’t that we were seriously considering the US falling from democracy the way this may sound. Instead think of it along the lines of very long term planning in a very risk averse sector where you plan a back up for the back up of the back up. The process ended up raising some political concerns that I imagine were also raised by similar processes all over Europe in that what happens if we can no longer trust the American tech platforms with our data?
I think there are two sides to this, as you yourself point out, but I also think the concern over data sovereignty is a valid one. Just imagine what would have happened if Russia had relied as heavy on Azure and AWS as the Danish public sector. Now I’m not suggesting that we in Denmark are going to elect a dictator and invade Sweden, but as far as national sovereignty goes, you sort of have to consider a world where we would do something that insane.
Then there is the issue of the wider internet moving from a fun playground for geeks to becoming as much a part of our daily lives as crossing the street. Most countries have laws prohibiting you from crossing the street in your birthday suit, even very liberal countries like Denmark don’t allow that. It would be admirable, but perhaps a bit naive, to think the internet would not be affected by legalisation as it’s importance and influence grew. I think the fact that remains as free as it is, is mainly because the current western leadership is quite old. I don’t expect the coming generations of politicians to be as lenient toward the advertising industry that the previous ones have been. What the EU has done and is doing so far is only the beginning, we will se far more legislation on our rights in the future and I wouldn’t expect major advertising companies like Google and Facebook to have much of a future unless they adapt quicker than they are currently doing.
With legislation, however, comes complexity and sometimes side effects as you point out. We have a filter to guard against piracy and property rights in Denmark. As so many other countries, and while it was original intended to block the pirate bay, child protection NGOs lobbied and eventually got sites containing child pornography included in the filter. I’m in no way advocating that this was wrong, but maybe it should have been two desperate filters as stealing Independence Day and Coyote Ugly is hardly the same crime as abusing children. Because what followed was that other NGOs and political interest groups added more and more things to the filter. Leaving it a mixed box of things, most of which should very likely be banned, but I think you sort of get my point in that nobody really knows what can or cannot be added to it because it quickly stopped being a “anti-pirate” or “anti-child-abuse” filter and became a “anything the political majority agrees is bad filter”. Or a very good example of exactly what happens when legislators get involved. There are side-effects, but I don’t think you should fault the NYT for also mixing up things in something that is really far more complex, than what I have outlined here.
I think data sovereignty, privacy and censorship in general are interesting subjects that I hope established media will take more of an interesting so that we can have a proper public discourse about it that involves non-techies and non-technocrats.
- eqvinox 4y agoGreat writeup, thanks for taking the time to type out what I was too lazy to :) I'd like to add/clarify/point out that there's two very different kinds of law/policy nations can go for here: 1. passing requirements that anyone processing data needs to meet some set of guarantees, e.g. privacy (including against state actors, e.g. CIA/NSA), cyberbullying handling, or copyright enforcement. This also includes (the absence of) safe harbor agreements. 2. passing requirements that data processing happen in a particular place, regardless of intent (could be in the belief that place X provides better privacy guarantees, could be because place X can censor/control data) The latter doesn't solve anything from the citizen's perspective, even if that's the intention. But it does address the issue of "invading Sweden". I personally consider the former much more important, but the latter is sometimes necessary too. But they need to be clearly identified in discussion. They are not interchangeable and sometimes issues better addressed by one are used to try to argue the other.
- Dracophoenix 4y agoAnd how would either scenario work exactly? Who maintains jurisdiction over foreign-held data? How would such provisions be enforced without violating a counties sovereignty? Could the foreign country in question claim jurisdiction over all data in within its borders as well as businesses and related subsidiaries registered in it? Usually these questions would be solved with treaties, but how would that work if the other country refuses to play ball?
- eqvinox 4y agoI would argue: an entity is liable for how it treats user data, in the country where that data is generated. This original country is where interactions and transactions take place. If it chooses to move that data elsewhere, that is its choice, and also liability if moving that data runs afoul of regulations in the original country. The foreign country itself doesn't really matter, the entity is doing business in the original country, and would be held liable there by its users/business partners according to local laws.