4 ms·

Privacy Shield died in 2020, but as of 2023 the US has a new agreement with the EU [0] with additional safeguards preventing the US government from accessing ce

Privacy Shield died in 2020, but as of 2023 the US has a new agreement with the EU [0] with additional safeguards preventing the US government from accessing certain data. This moots all the prior decisions based on Privacy Shield's demise. [0] https://www.privacyshield.gov/article?id=EU-U-S-Privacy-Shield-Program-Update https://www.privacyshield.gov/article?id=EU-U-S-Privacy-Shie...

AdriaanvRossum 4y ago
There is only a draft [0] which needs to be voted by EU Member States in order to become effective. That might end up with a Schrems III ruling when it comes into effect. [0] https://www.simpleanalytics.com/blog/how-to-move-forward-with-data-transfers-between-the-eu-us#updates https://www.simpleanalytics.com/blog/how-to-move-forward-wit...
- granzymes 4y ago
  The EU and US signed an agreement-in-principle. The final ratification will happen as soon as ~March (but could realistically take until summer). The US already implemented their portion of the agreement. No matter how many agreements it takes, the US and the EU will ensure that data transfer between the continents is possible. There's too much trade at risk otherwise.
  - AdriaanvRossum 4y ago
    I would not be that sure. They didn't get to an agreement since 2020. It's 2023 now. Still no agreement. To be fair: the US killed the previous pre-2020 agreement.
    - granzymes 4y ago
      It took until 2022 to get an agreement-in-principle signed, but that's government for you. A two year turnaround on negotiation plus a year to get it implemented is honestly lightning speed all things considered.
tirpen 4y ago
However. 1. That has not yet been finalized and ratified. 2. It's only based on an presidential excecutive order, so it may become moot as soon as an insane president gets elected, as is tradition every 4-8 years in the US. So it's a very unstable ground to build a buissiness on. 3. Most GDPR experts I've talked think that the new agreement it will almost certainly get torn up the moment it gets challenged in the EU courts. 4. NOYB (The pro-privacy organization whose actions lead to the 2020 ruling) have already stated that they intend to challenge this new agreement. So we might get a new agreement, but it will immediately get challenged in courts and probably be struck down within a few year and even if it doesn't, it's one that can be unilaterally revoked with zero warning by whatever madman happens to get elected to president. So trying to minimize how much personal data you transfer to the US will still be a jolly good idea for the foreseeable future, at least until the US begin to respect basic human rights.
- granzymes 4y ago
  If it gets struck down, the EU and the US will just sign another agreement. That's not a hypothetical: we're already on v3. There's too much trade at risk for both economic zones if it is impossible to transfer data between continents. Cynically, it takes the EU courts a few years to strike down every agreement. The EU and US governments can keep this game going indefinitely.
  - chopin 4y ago
    These agreements are unconstitutional. I surely hope that these do not go on indefinitely.
  - deleted 4y ago
    [deleted]

AdriaanvRossum 4y ago

There is only a draft [0] which needs to be voted by EU Member States in order to become effective. That might end up with a Schrems III ruling when it comes into effect. [0] https://www.simpleanalytics.com/blog/how-to-move-forward-with-data-transfers-between-the-eu-us#updates https://www.simpleanalytics.com/blog/how-to-move-forward-wit...

granzymes 4y ago
The EU and US signed an agreement-in-principle. The final ratification will happen as soon as ~March (but could realistically take until summer). The US already implemented their portion of the agreement. No matter how many agreements it takes, the US and the EU will ensure that data transfer between the continents is possible. There's too much trade at risk otherwise.
- AdriaanvRossum 4y ago
  I would not be that sure. They didn't get to an agreement since 2020. It's 2023 now. Still no agreement. To be fair: the US killed the previous pre-2020 agreement.
  - granzymes 4y ago
    It took until 2022 to get an agreement-in-principle signed, but that's government for you. A two year turnaround on negotiation plus a year to get it implemented is honestly lightning speed all things considered.

tirpen 4y ago

However. 1. That has not yet been finalized and ratified. 2. It's only based on an presidential excecutive order, so it may become moot as soon as an insane president gets elected, as is tradition every 4-8 years in the US. So it's a very unstable ground to build a buissiness on. 3. Most GDPR experts I've talked think that the new agreement it will almost certainly get torn up the moment it gets challenged in the EU courts. 4. NOYB (The pro-privacy organization whose actions lead to the 2020 ruling) have already stated that they intend to challenge this new agreement. So we might get a new agreement, but it will immediately get challenged in courts and probably be struck down within a few year and even if it doesn't, it's one that can be unilaterally revoked with zero warning by whatever madman happens to get elected to president. So trying to minimize how much personal data you transfer to the US will still be a jolly good idea for the foreseeable future, at least until the US begin to respect basic human rights.

granzymes 4y ago
If it gets struck down, the EU and the US will just sign another agreement. That's not a hypothetical: we're already on v3. There's too much trade at risk for both economic zones if it is impossible to transfer data between continents. Cynically, it takes the EU courts a few years to strike down every agreement. The EU and US governments can keep this game going indefinitely.
- chopin 4y ago
  These agreements are unconstitutional. I surely hope that these do not go on indefinitely.
- deleted 4y ago
  [deleted]