3 ms·

What a depressing reality where hostile US corporate data privacy practices and hostile US surveillance law take de facto priority over the EU's own privacy leg

What a depressing reality where hostile US corporate data privacy practices and hostile US surveillance law take de facto priority over the EU's own privacy legislation meant to protect its own residents. I wish the EU politicians and regulators were more willing to enforce their own rules, and that the ECJ were more willing to be explicit rather than implicit about the meaning of its Schrems rulings, all of which would eventually force a privacy-protective solution to the problems you describe. They have more power over MS than they think if they're willing to exercise it, but they're mostly not willing. (Examples like the Dutch public sector do exist, where they were able to get different terms from MS that are more compliant with the GDPR, including effective audit rights that have successfully verified compliance with these terms.)

Silhouette 4y ago
What a depressing reality where hostile US corporate data privacy practices and hostile US surveillance law take de facto priority over the EU's own privacy legislation meant to protect its own residents. The EU has provisions for very similar "hostile surveillance law" in its own member states. It just gave them a get out of jail free card in the GDPR. There is a considerable amount of hypocrisy about the EU's positions on privacy and data protection. The trouble with this whole subject is that you get grandstanding politicians trying to make big statements that go so far that it becomes unrealistic to enforce them because you'd cause catastrophic economic and/or social damage. If you really want to improve things what you need is steady, incremental progress towards restricting unwanted invasions of privacy. You can start with the most invasive commercial spyware. After a while you have moved the Overton window so that the worst excesses of governments' own surveillance programmes start to become viable candidates for reform as well. Ideally you eventually move societies away from the politics of fear that motivates those kinds of mass surveillance laws but that doesn't seem likely any time soon.
- jkaplowitz 4y ago
  Yes, I'm not defending the EU hypocrisy or their own hostile surveillance laws. However, keep in mind that this report mentioned many issues about MS's own processing purposes, policies, and practices, and wasn't only about the problems posed by US surveillance law. It's those MS-specific issues for which the Dutch government got fixes applied to Dutch private sector use of MS 365; naturally they haven't changed US surveillance law. And as bad as government surveillance is in both the EU and the US, it's awful when local companies send the data of the majority of their population into the jurisdiction of surveillance law whose political bosses the population can't even indirectly vote against. This is rare in the US because US companies rarely send the data of US citizens to EU providers, which itself is because the big tech players are American. Whereas for exactly the same reason of where the big tech players are based, it's common for EU companies to send the data of EU citizens to US providers.
  - Silhouette 4y ago
    I think we probably agree on almost everything here. I'm not defending the corporate surveillance culture. On the contrary I think that should be the first target. I'm only saying that in politics you have to pick your battles if you want to make real progress instead of earning a ten second sound bite on tonight's news. The EU politicians aren't so good at that sometimes and the result is legal positions like Schrems II that are so impractical that they are widely ridiculed and compliance is negligible.
    - jkaplowitz 4y ago
      Yeah, well the reason the Schrems II ruling is widely ridiculed with negligible compliance is not because of the ECJ ruling - it's the natural result of the legal status quo on both sides of the Atlantic and was predicted accurately by plenty of lawyers who weren't forced by their financial incentives to ignore the obvious. It's ridiculed and ignored primarily because enforcement is irrelevantly rare and small in financial impact, just like enforcement of the rules around cookie consent and many other aspects of the GDPR. Companies calculate that true compliance costs more than pretending to comply plus occasional fines for not doing so. Therefore they don't implement the parts of true compliance under their own control, and don't feel a need to lobby politicians on either side of the Atlantic to fix the incompatibility between US surveillance law on the GDPR. Similarly, the politicians and regulators are okay pretending that new EU-US agreements with no real legal substance can solve the problem, such that nobody has to comply and the ECJ and Max Schrems stay busy spinning their wheels. If this were different and the EU were actually enforcing the rules, either companies in the EU would have to stop using American providers - helping build a home-grown EU software industry without being crowded out by American providers - or US companies like MS would have to change what internal practices they can and lobby the US government to make the necessary legislative changes for them to fully comply with the GDPR. To be honest, I don't think the EU politicians/regulators are bad at what they're trying to do. It's simply that what they're trying to do is to look tough on privacy while actually not pissing off the deep-pocketed megacorps and the politicians they can/do fund on either side of the Atlantic. Which is different than what I'd like them to do, of course.
sam345 4y ago

What a depressing reality where hostile US corporate data privacy practices and hostile US surveillance law take de facto priority over the EU's own privacy legislation meant to protect its own residents. I wish the EU politicians and regulators were more willing to enforce their own rules, and that the ECJ were more willing to be explicit rather than implicit about the meaning of its Schrems rulings, all of which would eventually force a privacy-protective solution to the problems you describe. They have more power over MS than they think if they're willing to exercise it, but they're mostly not willing. (Examples like the Dutch public sector do exist, where they were able to get different terms from MS that are more compliant with the GDPR, including effective audit rights that have successfully verified compliance with these terms.)

Silhouette 4y ago

What a depressing reality where hostile US corporate data privacy practices and hostile US surveillance law take de facto priority over the EU's own privacy legislation meant to protect its own residents. The EU has provisions for very similar "hostile surveillance law" in its own member states. It just gave them a get out of jail free card in the GDPR. There is a considerable amount of hypocrisy about the EU's positions on privacy and data protection. The trouble with this whole subject is that you get grandstanding politicians trying to make big statements that go so far that it becomes unrealistic to enforce them because you'd cause catastrophic economic and/or social damage. If you really want to improve things what you need is steady, incremental progress towards restricting unwanted invasions of privacy. You can start with the most invasive commercial spyware. After a while you have moved the Overton window so that the worst excesses of governments' own surveillance programmes start to become viable candidates for reform as well. Ideally you eventually move societies away from the politics of fear that motivates those kinds of mass surveillance laws but that doesn't seem likely any time soon.

jkaplowitz 4y ago
Yes, I'm not defending the EU hypocrisy or their own hostile surveillance laws. However, keep in mind that this report mentioned many issues about MS's own processing purposes, policies, and practices, and wasn't only about the problems posed by US surveillance law. It's those MS-specific issues for which the Dutch government got fixes applied to Dutch private sector use of MS 365; naturally they haven't changed US surveillance law. And as bad as government surveillance is in both the EU and the US, it's awful when local companies send the data of the majority of their population into the jurisdiction of surveillance law whose political bosses the population can't even indirectly vote against. This is rare in the US because US companies rarely send the data of US citizens to EU providers, which itself is because the big tech players are American. Whereas for exactly the same reason of where the big tech players are based, it's common for EU companies to send the data of EU citizens to US providers.
- Silhouette 4y ago
  I think we probably agree on almost everything here. I'm not defending the corporate surveillance culture. On the contrary I think that should be the first target. I'm only saying that in politics you have to pick your battles if you want to make real progress instead of earning a ten second sound bite on tonight's news. The EU politicians aren't so good at that sometimes and the result is legal positions like Schrems II that are so impractical that they are widely ridiculed and compliance is negligible.
  - jkaplowitz 4y ago
    Yeah, well the reason the Schrems II ruling is widely ridiculed with negligible compliance is not because of the ECJ ruling - it's the natural result of the legal status quo on both sides of the Atlantic and was predicted accurately by plenty of lawyers who weren't forced by their financial incentives to ignore the obvious. It's ridiculed and ignored primarily because enforcement is irrelevantly rare and small in financial impact, just like enforcement of the rules around cookie consent and many other aspects of the GDPR. Companies calculate that true compliance costs more than pretending to comply plus occasional fines for not doing so. Therefore they don't implement the parts of true compliance under their own control, and don't feel a need to lobby politicians on either side of the Atlantic to fix the incompatibility between US surveillance law on the GDPR. Similarly, the politicians and regulators are okay pretending that new EU-US agreements with no real legal substance can solve the problem, such that nobody has to comply and the ECJ and Max Schrems stay busy spinning their wheels. If this were different and the EU were actually enforcing the rules, either companies in the EU would have to stop using American providers - helping build a home-grown EU software industry without being crowded out by American providers - or US companies like MS would have to change what internal practices they can and lobby the US government to make the necessary legislative changes for them to fully comply with the GDPR. To be honest, I don't think the EU politicians/regulators are bad at what they're trying to do. It's simply that what they're trying to do is to look tough on privacy while actually not pissing off the deep-pocketed megacorps and the politicians they can/do fund on either side of the Atlantic. Which is different than what I'd like them to do, of course.

sam345 4y ago