16 ms·
EU signs off on data transfers deal with US
- kogus 3y agoThe article says "The U.S. government on July 3 said it had fulfilled its requirements under the agreement." But the article detailing that "fulfillment" is behind a paywall. Does anyone know what changes the US made? It would be encouraging if pressure from the EU actually resulted in improved privacy protections in the US.
- Svip 3y agoThe decision from the Commission lists what the US did (linked from the article).[0] Although, I'll admit, I am not great at reading language that verbose. [0] https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae6...
- jszymborski 3y agoInteresting. If i understand correctly, this means US processors and controllers must be certified annually by the FTC and/or DoT. The certification is based on Principles outlined in the document and are very GDPR-ey
- yetanother12345 3y ago> FTC and/or DoT. ... none of which are European, or much aligned with European interests in any way I call BS.
- sgift 3y agoSo, reading section 3.2.1, which details the legal basis for collection under national security purposes, all of it seems to hang on EO 14086, which "replaces Presidential Policy Directive (PPD-28) to a large extent, strengthens the conditions, limitations and safeguards that apply to all signals intelligence activities (i.e. on the basis of FISA and EO 12333), regardless of where they take place, and establishes a new redress mechanism through which these safeguards can be invoked and enforced by individuals (see in more detail recitals 176-194). In doing so, it implements in U.S. law the outcome of the talks that took place between the EU and U.S. following the invalidation of the Commission’s adequacy decision on the Privacy Shield by the Court of Justice (see recital 6). It is, therefore, a particularly important element of the legal framework assessed in this Decision." A short check tells me that any current or future president can revoke an executive order at any time. So, the commissions decision in regards to FISA (which this is mainly about) hangs on Bidens word that neither he nor one of his successors will change it? Yeah ... I don't see how that's gonna fly with the EUCJ. (The article also stated it, but I wanted to check in the original documents if that's really all they base their "all is good with FISA now" decision on)
- mtmail 3y agoI believe the changes go back to an execute order from October 2022. https://www.linklaters.com/en/insights/blogs/digilinks/2022/october/eu-and-us--the-new-eu-us-data-privacy-framework-is-finally-here https://www.linklaters.com/en/insights/blogs/digilinks/2022/... has a summary. One key issue was that European citizens should have a way to make complaints (it wasn't clear which US agency was responsible and if they'd act), another that intelligence agencies don't get a blank check looking at all data.
- Dah00n 3y agoNothing has changed except some wording. Basically it boils down to this: Either GDPR is removed as law in the EU or Non-US citizens are given full constitutional rights under US law. That's it.
- Garvi 3y agoWoohoo. Does that also mean that we in the EU get US citizens data to play with?
- hef19898 3y agoOf course not, that would be outragious! Edit: Unless, of cpurse, some three letter agency front needs a non-US source to provide said data.
- deleted 3y ago[deleted]
- seydor 3y agoThe EU has strong restrictions on the use of US data so the US citizens are safe to sign this agreement
- deleted 3y ago[deleted]
- konschubert 3y agoI guess we would have to build some competitive internet companies first.
- tzs 3y agoNOTE: GDPR talks about "processors" and "controllers" but I'm going to simplify and just say "companies". GDPR purports to apply to the processing of personal data of people in these cases: 1. When the company is established in the Union, regardless of whether the processing takes place in the Union or not. 2. When the company is not established in the Union but the processing is related to offering goods or service (paid or free) to people in the Union. 3. When the company is not established in the Union but but the processing is related to monitoring behavior that takes place in the Union.
- dangus 3y ago> The European Commission adopted a so-called adequacy decision, recognizing the U.S. as a country with sufficient protection for Europeans’ personal data that's sent there, effectively sealing the agreement. That’s such a joke. What protections? The only protections I see are in a handful of states like California along with federal regulation for healthcare and payment data. I wish the EU had applied more pressure to US lawmakers to come up with a national data privacy law similar to GDPR and CCPA. All of that said, this agreement was inevitable. If data can’t be transferred between the EU and US, I don’t think it’s hyperbole to call that situation an economic disaster. The US and EU have too much commercial intermingling to have the EU actually cut off data movement to US data centers.
- m000 3y ago> I don’t think it’s hyperbole to call that situation an economic disaster. The US and EU have too much commercial intermingling to have the EU actually cut off data movement to US data centers. It hasn't been an economic disaster so far, why would it be now? And it is not that they will seal off datacenters. It just makes US companies liable for handling EU-user data in EU-jurisdiction. If they are caught red-handed exporting data to US, fines will be on the way. The only beneficiaries from this are FANG (lower costs) and 3-letter US agencies (they info they need at the reach of their hand).
- ChuckNorris89 3y ago>If they are caught red-handed exporting data to US Whiteout any proper audits or whistleblowers, how would you catch that?
- granzymes 3y agoNo matter how many agreements it takes, the US and the EU will ensure that data transfer between the continents is possible. There's too much trade at risk otherwise. This agreement puts products like Google Analytics back on firm legal footing. Bad luck for Meta that they were the one company singled out for a fine for doing what everyone else was doing in the period between agreements.
- hyperman1 3y agoI agree with the general idea of what you say, but this is not intended to put anything on a firm legal footing. As I understand it, EU privacy law is fundamentally incompatible with US spying requirements, both sides know it, neither side cares. The plan is to make one illegal agreement after another, each giving about 2 years of pseudo-protection until the slow EU legal procedures catch up. Then start anew with the next agreement.
- cccbbbaaa 3y agonoyb is ready to challenge this https://noyb.eu/en/european-commission-gives-eu-us-data-transfers-third-round-cjeu https://noyb.eu/en/european-commission-gives-eu-us-data-tran...
- granzymes 3y agoEventually one of these agreements will stick, and the US and EU will keep pumping them out until that happens. There is too much trade at risk otherwise. There are enough macro headwinds for the global economy without adding self-inflicted injuries.
- xethos 3y ago> self-inflicted injuries. > the EU's top court struck down two previous agreements over fears of U.S. intelligence agencies' snooping. Yeah, if only America's government agencies could keep within the confines of the law.
- tristor 3y agoAmerican government agencies are acting within US law when they spy on Europeans. They have legal remit, explicitly, to perform signals intelligence on foreign entities/persons. This is clearly abused in various ways (5EYES), but is also not illegal. It's only illegal for these American agencies to spy on Americans and within the boundaries of the US.
- gpm 3y agoIt's legal (under US law), but it's still a hostile act. It shouldn't be a surprise that it harms trade and international relations. To use an extreme example to drive the point home, going to war with someone is (or can be made) legal too...
- tristor 3y agoI'm not agreeing with it. I vehemently disagree with current US intelligence policy, and I think 5EYES is a travesty and clearly intended to do an end-run around legal protections for citizens of each of the signatories from their own government. It's clear the US government is acting unethically, but that does not mean their behavior is illegal, and I'm trying to clearly point out the distinction. There's a lot of Europeans in the comments who mistakenly believe that GDPR applies outside of the EU. It does not. The US is a sovereign nation with its own laws, and it does not have any analogous legal restrictions like GDPR, nor does it have any legal restrictions against the government using it's intelligence apparatus against non-Americans.
- Tomte 3y agoNext round for Max Schrems. Is there even anyone who would bet against him, after winning all of the last rounds?
- Puts 3y agoI don't know what - but it says something that Max Schrems was still a law student when he brought on the Irish DPC, The EU Commission and an army of Facebook lawyers and got the Safe Harbor agreement invalidated.
- sylware 3y agoRead between the lines: it means EU got the access gateways to this data, probably for free (until they discover they actually don't have access to all of it). For instance the DNA database of the EU ppl stored in the US (you know the "where are your ancestry from" DNA stuff from the US, which were actually used by the "services", caught right handed). Urban legends say\ they can "find" somebody who got one of his/her relative do such DNA sampling.
- rkagerer 3y agoHere's the decision, would love if anyone reading it could share some highlights: https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae6...
- deleted 3y ago[deleted]
- pyrale 3y agoI really don't know why the commission keeps floating these agreements in which they don't even try to address the issues raised by the court. At this point, they have zero credibility.
- granzymes 3y ago>I really don't know why the commission keeps floating these agreements Because cutting off a substantial amount of EU <-> US trade would be a disaster for the continent.
- pyrale 3y agoThis outcome is independent from the commission's decision, as the final decision is with the court.
- drcongo 3y agoWhich continent?
- yetanother12345 3y ago> amount of EU <-> US trade if "illicit transfer of PII for nefarious purposes" = "trade" then... I'm out of words.
- cf141q5325 3y agoIts a great example how democracies fail yet again to address a threat from within. They know it to be illegal, yet they keep doing it thanks to immunity from prosecution.
- greatgib 3y agoJust a reminder that the commission itself is not democracy contrary to the parlement. No one elected the traitors of our rights that take such decisions in the commission...
- AndyMcConachie 3y ago> The deal, known as EU-U.S. Data Privacy Framework, revives transatlantic exchanges underpinning billions' worth of digital trade after the EU's top court struck down two previous agreements over fears of U.S. intelligence agencies' snooping. Can someone explain to me what trade this underpins? AFAICT it's basically a one way street. Large corporations in the USA get to advertise to citizens of the EU. How does anyone in the EU benefit from this? Or even, how does any large EU corporation benefit from this?
- pyrale 3y ago> How does anyone in the EU benefit from this? https://www.lemonde.fr/en/les-decodeurs/article/2022/07/12/uber-files-european-commissioner-neelie-kroes-secretly-lobbied-for-uber_5989901_8.html https://www.lemonde.fr/en/les-decodeurs/article/2022/07/12/u...
- pier25 3y agoWhat does this mean in practice? Can EU startups finally use US providers?
- lessaligned 3y agocool so in cloudland, Azure ca finally face some strong competition as orgs who were only using its crappy stuff solely bc it seemed to be a "safer" bet from a EU regulatory perspective get to do more AWS and GCP now...
- WhereIsTheTruth 3y agoThe EU dropped their pants, yet again But this is no surprise since the US is basically the funder of the EU, they get what they want That's very sad
- lessaligned 3y agowhat pants it only had a skirt with GDPR branded on it and nothing under...
- konschubert 3y agoYou don’t think the EU has a self-interest in trading with the biggest economy in the world? Do you think that I, as a European, want to be cut off from using ChatGPT or Google Docs?
- graftak 3y agoWhy not, the tech isn’t all that impressive, just needs a lot of time and money, something that will never happen before google docs are cut off.
- konschubert 3y agook
- WhereIsTheTruth 3y agoNo, the EU has interest protecting its users and industry The US is a failing economy with half of the world starting to detach from the USD The US already starting to tinker with Copyright laws in order to boost and be leader in AI.. this is a red flag This is another attempt for the US to save its economy EU should do like the US and Asia, protect its industry
- konschubert 3y agohttps://recruitonomics.com/wp-content/uploads/2023/04/Germany1-GDP-comparison-2048x1327.png https://recruitonomics.com/wp-content/uploads/2023/04/German...
- Dah00n 3y agoBy EU law there has to be “essentially equivalent protection” in the destination country, so this might as well be clickbait by the EU Commission as FISA 702 is absolutely incompatible with GDPR. One of those two needs to go before CJEU will allow this. This is likely Big Business and Three Letter Agency lobbyism at work, to try to draw out the final break-up of the very one-sided data transfers. It won't stick unless US gives non-US citizens constitutional rights (as if).
- tmikaeld 3y agoThe EU-US data transfer deal is yet another instance of the EU bending over for the US. The US oversteps, the EU retaliates, they negotiate, rinse and repeat. It's frustrating to see the EU continually put trade over privacy and trusting the US not to enforce the Cloud Act. It's not just about the big names like Google or Meta. What about EU startups? They're left in limbo, unsure of what this means for them or the cost involved with complying with an additional set of rules. The final decision is with the court on a case by case basis, just as before! Honestly, I doubt this will make any company at ease about EU to US data transfers - there's too much risk & cost for EU companies.
- tristor 3y ago> If the US respected the law Whose law? The US is a sovereign nation. US law explicitly allows them to snoop on foreign entities/persons/data. GDPR doesn't have jurisdiction outside the EU. I wish it were otherwise, but it is not. The EU isn't a world government, it's a regional government/alliance, somewhat analogous to the US. The US often manipulates other nations to agreeing to pass laws that align to their policy goals globally, but ultimately it's a decision of sovereign nations to pass laws. I don't think the EU wants to call into question the entire concept of sovereignty in a policy conflict with the US, since the US is the a hegemony and one of only two global superpowers (and arguably the only one).
- tmikaeld 3y agoBad choice of word, maybe agreement? In essence, as long as the Cloud Act exist and is enforced, I fail to see how US <-> EU data transfers can ever be GDPR compliant.
- tankenmate 3y agoThe GDPR applies to EU citizens regardless of where they are, and if the EU courts can apply fines (for example the company has a presence in the EU) then the court will probably fine the company.
- garyclarke27 3y agoDoes this mean Meta will launch Threads in the EU?
- ikekkdcjkfke 3y agoThe dynamics at play are interesting. Establishmebt wants an alternative to Twitter I assume.
- yxhuvud 3y ago> The agreement ends years of legal limbo and revives free transatlantic digital exchanges. I will believe this when it is challenged in court and it stands. As the article noted, this has been tried before.
- V__ 3y agoThe courts will strike this down as well. I don't see it ever happening as long as the U.S. doesn't change its laws regarding privacy of non US citizens and possibly US citizens as well. Everyone in my surroundings (yes, anecdotal) is switching more and more to EU alternatives, and only uses US cloud-based software, if it can be used on-prem or inside EU datacenters.
- deleted 3y ago[deleted]
- voidr 3y agoI guess this is the end of Data Protection now that data can freely flow to the country of the Patriot Act and government agencies that aren't the most trustworthy. The EU should just drop all Data Protection laws to make it fair, otherwise all they are doing is increasing the advantage of those agencies that play fast and loose with people's data.