9 ms·

> Where data is processed should not affect the care with which it is processed. I can conceive of some verifiable processing package that ensures data can be p

> Where data is processed should not affect the care with which it is processed. I can conceive of some verifiable processing package that ensures data can be processed wherever and still meet regulations. Can that be part of the future? To an extent GDPR already allows this. The fines are only occurring because Facebook is transferring data into a jurisdiction which doesn’t have strong enough data protection laws to satisfy GDPR. In the U.S. case specifically, it’s issues around laws that allow the U.S. government to force U.S. companies to handover data arbitrarily with very little (if any) due process. If the U.S. modified their draconian laws to ensure that everyone was afforded due process before their data was scooped up by the U.S. government, then there wouldn’t be an issue. Unfortunately verifiable processes packages don’t solve the fundamental problem that the various three letter U.S. agencies can send a secret order, with effectively zero judicial oversight, to Facebook and compel them to handover data, plus gag Facebook from telling the individuals about the demand.

pembrook 3y ago
There’s a new EU-US data framework that’s expected to be ratified within a year which should make EU-US transfers possible again under new guidelines. Its possible this fine was intended to pre-empt the passing of any new frameworks and cash in on the uncertainty in the interim. Fining foreign big tech over EU privacy nuances is like taking candy from a baby. The narrative zeitgeist on both sides of the pond is in support (stories of rigged elections for 4 years turned public opinion brilliantly). While protecting your citizens rights is a noble cause, its hard not to see the moral hazard inherent in this approach. Abusing your position as a desirable market to impose post-hoc tariffs via an endless stream of fines is questionable IMO. Especially while the US provides Europe with its extremely expensive military support blanket (NATO) against the angry bear at its door.
- sgift 3y ago
  > Abusing your position as a desirable market to impose post-hoc tariffs via an endless stream of fines is questionable IMO. There's a simple scenario in which Meta wouldn't have had to pay these fines: Don't break the law. And don't continue breaking the law after being told to stop it. It's not abusive to remind companies that actions have consequences in the language they understand and respect.
  - kmlx 3y ago
    who says Meta will pay this fine? they will litigate until the end of times.
  - pembrook 3y ago
    Do you honestly believe that Meta's hundreds (possibly thousands) of both full-time and contracted out lawyers would collectively advise them to break the law? Knowing full well the outcome would be $Billions in fines? EU to US data transfers used to be okay for years, then there was a single ruling that brought that into question. Because government moves slow, there hasn't been a new framework implemented. Ruling for Billions in fines during the interim, while the US government and EU are still negotiating the details of the new framework is not an environment conducive to full compliance. US companies would essentially need to stop operating in the EU altogether if they wanted to be fully compliant. Combine this with giant companies which also are slow moving (albeit faster than government) and you have a recipe for never-ending fines no matter how much you try to comply in good faith.
    - malermeister 3y ago
      > US companies would essentially need to stop operating in the EU altogether if they wanted to be fully compliant. That's exactly what they should've done to not break the law while there was no legal basis for what they were doing. They didn't. Now they suffer the consequences for breaking the law.
      - pfannkuchen 3y ago
        I believe they can still at any point stop operating in the EU and not pay the fine? How would the EU implement the fine if Meta pulled out? I thought their leverage was just the threat of blocking the service in the EU.
        malermeister 3y ago
        I guess if no Facebook exec ever wants to touch European soil again, that is an option.
- blibble 3y ago
  > There’s a new EU-US data framework that’s expected to be ratified within a year which should make EU-US transfers possible again under new guidelines. this will likely be found to be unlawful too in the way the last two were the EU commission shouldn't be creating frameworks that it knows are unlawful (definition of malfeasance?)
  - bjornsing 3y ago
    Why not? It keeps bureaucrats employed. Thousands of them.
- detaro 3y ago
  > Its possible this fine was intended to pre-empt the passing of any new frameworks and cash in on the uncertainty in the interim. a new framework passing wouldn't retroactively legalize the transfers happening before that, so this doesn't make sense.
- standing_user 3y ago
  Most likely even that, if and when it will be done will have flaws that sooner or later will cause the fall Purely from a logical perspective, preventing the data of a company operating in the United States and Europe from contaminating or coming into contact is a pure utopia no matter how much effort it puts into goal or any other company operating in the same or similar field. There will always be a point of contact and a way for European data to be under the lens of some American agency or body. In addition to Facebook is not really famous for its transparency in data management so any commitment to the contrary I see it as a paper promise NATO's excuse that because the US finances then anything is allowed is a fallacious argument.
- mananaysiempre 3y ago
  > There’s a new EU-US data framework that’s expected to be ratified within a year which should make EU-US transfers possible again under new guidelines. Black Books (S01E01) put it best: > NICK VOLEUR: This new system, it's very closely modelled on the old system, isn't it? > BERNARD BLACK: I'd go further than that, Nick, I'd say it was more or less exactly the same[.] Given the US side of said framework is established by executive order[1] and the “court” it creates is part of the executive (much like the “ombudsperson” office that the CJEU struck down Privacy Shield over), it’s unclear if it will work, or if the Commission (an executive body who can establish these things but is subject to judicial review) is setting itself up for a Schrems III another ten years down the line for foreign-relations reasons. The EU privacy regulator very politely said it was dubious[2], while the relevant parliamentary committee[3] and later the full parliament[4] expressed open scorn. The US diplomats, for their part, are trying for a “you too” defence[5]—which might well be factually true to some extent, just does not change anything about EU law. > Its possible this fine was intended to pre-empt the passing of any new frameworks and cash in on the uncertainty in the interim. As the legal basis for a transfer is fixed at the time it’s performed, a framework cannot be retroactive (but “the Commission was wrong, the transfers weren’t lawful after all” decisions can be). So while the FUD may be real, the case could just as well have been decided after the new framework had been passed. [1] EO 14086, https://www.federalregister.gov/d/2022-22531 https://www.federalregister.gov/d/2022-22531 [2] https://iapp.org/news/a/edpb-welcomes-improvements-to-eu-us-adequacy-decision-concerns-remain/ https://iapp.org/news/a/edpb-welcomes-improvements-to-eu-us-... [3] https://iapp.org/news/a/meps-urge-european-commission-to-reject-eu-u-s-adequacy/ https://iapp.org/news/a/meps-urge-european-commission-to-rej... [4] https://www.europarl.europa.eu/news/en/press-room/20230505IPR85012/meps-against-greenlighting-personal-data-transfers-with-the-u-s https://www.europarl.europa.eu/news/en/press-room/20230505IP... [5] https://www.politico.eu/article/washington-to-brussels-we-want-to-check-your-surveillance-practices/ https://www.politico.eu/article/washington-to-brussels-we-wa...
- pjc50 3y ago
  > a new EU-US data framework that’s expected to be ratified within a year which should make EU-US transfers possible again under new guidelines What specifically has changed about US law relating to mass surveillance of foreign nationals that is going to make this one work?
- M2Ys4U 3y ago
  >There’s a new EU-US data framework that’s expected to be ratified within a year which should make EU-US transfers possible again under new guidelines. Until it's struck down by the court again. The agreement will not - it cannot - satisfy the requirements of the GDPR and CFR unless and until the US changes its law.
  - jonas21 3y ago
    > The agreement will not - it cannot - satisfy the requirements of the GDPR and CFR unless and until the US changes its law. Or unless and until the EU changes its laws.
    - Attrecomet 3y ago
      Lets hope not, given that the stances are US: "we demand the right to spy on anyone for any reason, except US citizens where we absolutely must recognize their constitutional rights" EU: "we demand basic protections for the rights of our citizens"
      - whimsicalism 3y ago
        Those two views sound the same? Or am I an idiot?
        Attrecomet 3y ago
        No. For one, even taken literally the way I wrote it it's about two different sets of people -- the EU must defend their citizens (and residents, BTW), of course! For another, if one looks past my vague wording, the EU (or at least Germany, which I'm most familiar with) doesn't have the dogma that it's required to set up a world spanning total surveillance state, no compromises beyond the ones absolutely necessary with their own constitution (and even those are followed within a rather "liberal" framework for the three-letter-agencies: they do have all possible data they can get their hands on, just pinky-promise to not abuse it, if US citizens are impacted, in the eyes of secret courts).
- Paradigma11 3y ago
  Why not do the data processing in the EU till the new framework comes into place?
  - scarface74 3y ago
    How do you process data about an international social graph only in the EU? When a friend in the EU posts something, should their post not be seen in the US? What happens when I have a group conversation between friends in the US and EU?
    - asvitkine 3y ago
      Well, if the US and other countries don't have equivalent laws, you can move everything to the EU. Of course, this doesn't work if another country has such a law. But if it's a smaller country, then it doesn't have as much leverage (e.g. Facebook could accept the smaller fine or pull out).
      - scarface_74 3y ago
        How do you move “everything” to the EU including messages sent to US citizens? What if the messages are in a group of people in the US and the EU?
        SideburnsOfDoom 3y ago
        What is your better suggestion: The world follows lax US law? Or anything goes, no law? These are not acceptable options to the EU.
        scarface_74 3y ago
        I don’t know, maybe let adults make their own informed decisions and weigh the tradeoffs versus benefits based on their own priorities instead of depending on the government?
- FpUser 3y ago
  >"Abusing your position as a desirable market" Sounds like something that the US does routinely. >"Especially while the US provides Europe with its extremely expensive military support blanket" 1) I think it is more than compensating by Europe agreeing to use USD as the reserve currency. The US gets enormous benefits as the result. 2) Angry bear seems not to be able to win over a single country. Beside the US does it for self serving reasons. It is not a charity. And if it did not I think the Europe is quite capable to create and maintain their own army and weapons.
- avianlyric 3y ago
  > There’s a new EU-US data framework that’s expected to be ratified within a year which should make EU-US transfers possible again under new guidelines. There’s already been two attempts at this, both of which were ratified, then struck down by the ECJ. There’s already clear indications that attempt there isn’t much better than attempt one and two, and the smart money is betting on it not being ratified, or being struck down if it is. In the meantime it’s been illegal for a years to transfer EU data to the U.S. So even if it did suddenly become legal, those laws aren’t going to retrospect, and Facebook still engaged in blatantly illegal behaviour.
fredgrott 3y ago
Note that you are wrong on zero Judicial oversight...as it has originally been reviewed by the courts numerous times. And, the 5-eyes(my term) still do collect some data behind the scenes that has minimal court oversight including GDPR.
scarface74 3y ago
Yes it’s not like the EU isn’t also trying to pass laws that force every encrypted communication to have a backdoor so they can spy….

pembrook 3y ago

There’s a new EU-US data framework that’s expected to be ratified within a year which should make EU-US transfers possible again under new guidelines. Its possible this fine was intended to pre-empt the passing of any new frameworks and cash in on the uncertainty in the interim. Fining foreign big tech over EU privacy nuances is like taking candy from a baby. The narrative zeitgeist on both sides of the pond is in support (stories of rigged elections for 4 years turned public opinion brilliantly). While protecting your citizens rights is a noble cause, its hard not to see the moral hazard inherent in this approach. Abusing your position as a desirable market to impose post-hoc tariffs via an endless stream of fines is questionable IMO. Especially while the US provides Europe with its extremely expensive military support blanket (NATO) against the angry bear at its door.

sgift 3y ago
> Abusing your position as a desirable market to impose post-hoc tariffs via an endless stream of fines is questionable IMO. There's a simple scenario in which Meta wouldn't have had to pay these fines: Don't break the law. And don't continue breaking the law after being told to stop it. It's not abusive to remind companies that actions have consequences in the language they understand and respect.
- kmlx 3y ago
  who says Meta will pay this fine? they will litigate until the end of times.
- pembrook 3y ago
  Do you honestly believe that Meta's hundreds (possibly thousands) of both full-time and contracted out lawyers would collectively advise them to break the law? Knowing full well the outcome would be $Billions in fines? EU to US data transfers used to be okay for years, then there was a single ruling that brought that into question. Because government moves slow, there hasn't been a new framework implemented. Ruling for Billions in fines during the interim, while the US government and EU are still negotiating the details of the new framework is not an environment conducive to full compliance. US companies would essentially need to stop operating in the EU altogether if they wanted to be fully compliant. Combine this with giant companies which also are slow moving (albeit faster than government) and you have a recipe for never-ending fines no matter how much you try to comply in good faith.
  - malermeister 3y ago
    > US companies would essentially need to stop operating in the EU altogether if they wanted to be fully compliant. That's exactly what they should've done to not break the law while there was no legal basis for what they were doing. They didn't. Now they suffer the consequences for breaking the law.
    - pfannkuchen 3y ago
      I believe they can still at any point stop operating in the EU and not pay the fine? How would the EU implement the fine if Meta pulled out? I thought their leverage was just the threat of blocking the service in the EU.
      - malermeister 3y ago
        I guess if no Facebook exec ever wants to touch European soil again, that is an option.
blibble 3y ago
> There’s a new EU-US data framework that’s expected to be ratified within a year which should make EU-US transfers possible again under new guidelines. this will likely be found to be unlawful too in the way the last two were the EU commission shouldn't be creating frameworks that it knows are unlawful (definition of malfeasance?)
- bjornsing 3y ago
  Why not? It keeps bureaucrats employed. Thousands of them.
detaro 3y ago
> Its possible this fine was intended to pre-empt the passing of any new frameworks and cash in on the uncertainty in the interim. a new framework passing wouldn't retroactively legalize the transfers happening before that, so this doesn't make sense.
standing_user 3y ago
Most likely even that, if and when it will be done will have flaws that sooner or later will cause the fall Purely from a logical perspective, preventing the data of a company operating in the United States and Europe from contaminating or coming into contact is a pure utopia no matter how much effort it puts into goal or any other company operating in the same or similar field. There will always be a point of contact and a way for European data to be under the lens of some American agency or body. In addition to Facebook is not really famous for its transparency in data management so any commitment to the contrary I see it as a paper promise NATO's excuse that because the US finances then anything is allowed is a fallacious argument.
mananaysiempre 3y ago
> There’s a new EU-US data framework that’s expected to be ratified within a year which should make EU-US transfers possible again under new guidelines. Black Books (S01E01) put it best: > NICK VOLEUR: This new system, it's very closely modelled on the old system, isn't it? > BERNARD BLACK: I'd go further than that, Nick, I'd say it was more or less exactly the same[.] Given the US side of said framework is established by executive order[1] and the “court” it creates is part of the executive (much like the “ombudsperson” office that the CJEU struck down Privacy Shield over), it’s unclear if it will work, or if the Commission (an executive body who can establish these things but is subject to judicial review) is setting itself up for a Schrems III another ten years down the line for foreign-relations reasons. The EU privacy regulator very politely said it was dubious[2], while the relevant parliamentary committee[3] and later the full parliament[4] expressed open scorn. The US diplomats, for their part, are trying for a “you too” defence[5]—which might well be factually true to some extent, just does not change anything about EU law. > Its possible this fine was intended to pre-empt the passing of any new frameworks and cash in on the uncertainty in the interim. As the legal basis for a transfer is fixed at the time it’s performed, a framework cannot be retroactive (but “the Commission was wrong, the transfers weren’t lawful after all” decisions can be). So while the FUD may be real, the case could just as well have been decided after the new framework had been passed. [1] EO 14086, https://www.federalregister.gov/d/2022-22531 https://www.federalregister.gov/d/2022-22531 [2] https://iapp.org/news/a/edpb-welcomes-improvements-to-eu-us-adequacy-decision-concerns-remain/ https://iapp.org/news/a/edpb-welcomes-improvements-to-eu-us-... [3] https://iapp.org/news/a/meps-urge-european-commission-to-reject-eu-u-s-adequacy/ https://iapp.org/news/a/meps-urge-european-commission-to-rej... [4] https://www.europarl.europa.eu/news/en/press-room/20230505IPR85012/meps-against-greenlighting-personal-data-transfers-with-the-u-s https://www.europarl.europa.eu/news/en/press-room/20230505IP... [5] https://www.politico.eu/article/washington-to-brussels-we-want-to-check-your-surveillance-practices/ https://www.politico.eu/article/washington-to-brussels-we-wa...
pjc50 3y ago
> a new EU-US data framework that’s expected to be ratified within a year which should make EU-US transfers possible again under new guidelines What specifically has changed about US law relating to mass surveillance of foreign nationals that is going to make this one work?
M2Ys4U 3y ago
>There’s a new EU-US data framework that’s expected to be ratified within a year which should make EU-US transfers possible again under new guidelines. Until it's struck down by the court again. The agreement will not - it cannot - satisfy the requirements of the GDPR and CFR unless and until the US changes its law.
- jonas21 3y ago
  > The agreement will not - it cannot - satisfy the requirements of the GDPR and CFR unless and until the US changes its law. Or unless and until the EU changes its laws.
  - Attrecomet 3y ago
    Lets hope not, given that the stances are US: "we demand the right to spy on anyone for any reason, except US citizens where we absolutely must recognize their constitutional rights" EU: "we demand basic protections for the rights of our citizens"
    - whimsicalism 3y ago
      Those two views sound the same? Or am I an idiot?
      - Attrecomet 3y ago
        No. For one, even taken literally the way I wrote it it's about two different sets of people -- the EU must defend their citizens (and residents, BTW), of course! For another, if one looks past my vague wording, the EU (or at least Germany, which I'm most familiar with) doesn't have the dogma that it's required to set up a world spanning total surveillance state, no compromises beyond the ones absolutely necessary with their own constitution (and even those are followed within a rather "liberal" framework for the three-letter-agencies: they do have all possible data they can get their hands on, just pinky-promise to not abuse it, if US citizens are impacted, in the eyes of secret courts).
Paradigma11 3y ago
Why not do the data processing in the EU till the new framework comes into place?
- scarface74 3y ago
  How do you process data about an international social graph only in the EU? When a friend in the EU posts something, should their post not be seen in the US? What happens when I have a group conversation between friends in the US and EU?
  - asvitkine 3y ago
    Well, if the US and other countries don't have equivalent laws, you can move everything to the EU. Of course, this doesn't work if another country has such a law. But if it's a smaller country, then it doesn't have as much leverage (e.g. Facebook could accept the smaller fine or pull out).
    - scarface_74 3y ago
      How do you move “everything” to the EU including messages sent to US citizens? What if the messages are in a group of people in the US and the EU?
      - SideburnsOfDoom 3y ago
        What is your better suggestion: The world follows lax US law? Or anything goes, no law? These are not acceptable options to the EU.
        scarface_74 3y ago
        I don’t know, maybe let adults make their own informed decisions and weigh the tradeoffs versus benefits based on their own priorities instead of depending on the government?
FpUser 3y ago
>"Abusing your position as a desirable market" Sounds like something that the US does routinely. >"Especially while the US provides Europe with its extremely expensive military support blanket" 1) I think it is more than compensating by Europe agreeing to use USD as the reserve currency. The US gets enormous benefits as the result. 2) Angry bear seems not to be able to win over a single country. Beside the US does it for self serving reasons. It is not a charity. And if it did not I think the Europe is quite capable to create and maintain their own army and weapons.
avianlyric 3y ago
> There’s a new EU-US data framework that’s expected to be ratified within a year which should make EU-US transfers possible again under new guidelines. There’s already been two attempts at this, both of which were ratified, then struck down by the ECJ. There’s already clear indications that attempt there isn’t much better than attempt one and two, and the smart money is betting on it not being ratified, or being struck down if it is. In the meantime it’s been illegal for a years to transfer EU data to the U.S. So even if it did suddenly become legal, those laws aren’t going to retrospect, and Facebook still engaged in blatantly illegal behaviour.

fredgrott 3y ago

Note that you are wrong on zero Judicial oversight...as it has originally been reviewed by the courts numerous times. And, the 5-eyes(my term) still do collect some data behind the scenes that has minimal court oversight including GDPR.

scarface74 3y ago

Yes it’s not like the EU isn’t also trying to pass laws that force every encrypted communication to have a backdoor so they can spy….