8 ms·

Big Tech can transfer Europeans’ data to US in win for Facebook and Google

163 points by isaacfrond 3y ago

the_mitsuhiko 3y ago
Pretty sure the underlying issues were not addressed so we shall see a Schrems III a few years from now.
- mschild 3y ago
  They've already prepared a challenge to it. https://noyb.eu/en/european-commission-gives-eu-us-data-transfers-third-round-cjeu https://noyb.eu/en/european-commission-gives-eu-us-data-tran...
- skrause 3y ago
  No problem, if that happens the EU commission will just introduce the same law under a different name for the fourth time. Rinse and repeat...
  - ocdtrekkie 3y ago
    How many times can they straight up cheese the court without facing any penalties themselves?
standing_user 3y ago
Well it was just a matter of time, the martech industry need that flow to work to make money
- ChatGTP 3y ago
  The lobbying wins again.
deleted 3y ago
[deleted]
htrwan 3y ago
[flagged]
- dragonelite 3y ago
  If it wasn't obvious before its becoming more and more obvious the last 2 years.
  - hxcan11 3y ago
    [flagged]
- pavlov 3y ago
  SWIFT, which is a Belgian co-op. I'm actually kind of surprised that this rhetoric hasn't been picked up by the Fox News crowd yet. "A group of Belgian communists holds the key to all international banking transactions made by Americans! Where is my liberty"
  - hxcan11 3y ago
    > SWIFT, which is a Belgian co-op. That is exactly the point. The U.S. snoops on European data: https://www.spiegel.de/international/europe/spying-on-terrorist-cash-flows-eu-to-allow-us-access-to-bank-transaction-data-a-663846.html https://www.spiegel.de/international/europe/spying-on-terror... As part of the war on terror, American intelligence services have been monitoring European bank transactions since 2001. When the EU found out about it in 2006, they were outraged. But now it looks like the bloc will agree to a controversial deal that will allow the covert data transfer to continue.
- tho2io34u23434 3y ago
  [flagged]
sarnowski 3y ago
In parallel, there is a quite different point of view and after the last two dramas (Safe Harbor, Privacy Shield), the outcome is quite predictable in my opinion. https://news.ycombinator.com/item?id=36677578 https://news.ycombinator.com/item?id=36677578 Edit: of course for the next 1-3 years, compliance departments in the EU can declare themselves not guilty and business will continue as usual.
- tguvot 3y ago
  i recently spent year+ on managing gdpr compliance implementation in company where I work (multinational *aaS). Our current stance that we will continue as usual, where usual been that there is no new agreement. Because breaking down all gdpr compliance is easy but to restore it to compliant state is hard.
Saphyel 3y ago
This is bad news for EU and the world but I guess congrats for meta and google.
- remus 3y ago
  Depends what you mean by bad news really. If it turns out that transferring personal data between the EU and US is fundamentally impossible due to irreconcilable differences in data protection legislation then it'd have huge consequences for businesses and consumers world wide. Short term it'd almost certainly be a net loss for consumers. Personally (and probably naively), I do hope the EU and US can find enough common ground. It'll make everyone's lives a lot easier [1]. [1] ...if the US can get out of the habit of rifling through the data of EU citizens at the drop of a hat.
  - VWWHFSfQ 3y ago
    > it'd have huge consequences for businesses and consumers world wide. Short term it'd almost certainly be a net loss for consumers. I think this would pretty much only be a net loss for EU consumers and businesses. Maybe no longer having access to American tech companies' services would be beneficial long-term but only if EU entrepreneurs build domestic alternatives, which we know is pretty unlikely. I think the reality is that they'll just loosen their laws so they don't get shut out. As we're seeing them do here.
    - protomolecule 3y ago
      "if EU entrepreneurs build domestic alternatives, which we know is pretty unlikely" Why is it unlikely?
      - jimnotgym 3y ago
        If the US tech companies are shut out I would say it is very likely.
      - thereddaikon 3y ago
        The EU has had a spotty history competing with SV. A large part of that is the different investment and regulatory environment for better or worse makes it much harder for tech startups to get going, especially after the fact when there are established players.
mediascreen 3y ago
Yes! Maybe we can start caring about stuff that actually matters now instead of obsessing over IP-addresses maybe touching US soil when loading a font from a CDN.
- deleted 3y ago
  [deleted]
dijit 3y ago
the most ironic part is that it's the US itself which is going to monitor compliance. The entire problem for me is basically what Snowden revealed. In most democratic western countries a certain level of privacy is actually enshrined into law due to it's propensity for abuse. -- the US spying on Swedens behalf means that technically Sweden is not spying on Swedes. The US having data on me by itself isn't a huge deal; there's no fucking way I will ever want to live there and factually: nobody is going to go sniffing into my life like in the movie "Enemy of the State" (though I suppose they could). However, the US sharing that information with Sweden can affect my life, because it's intentionally bypassing a protection that I am supposed to have in order to live in a free democratic system. Failure to respect privacy lends itself to authoritarianism as people will self-censor if they feel they are not able to express themselves. Maybe I'm overstating this but it's a real concern of mine.
- A4ET8a8uTh0 3y ago
  << Maybe I'm overstating this but it's a real concern of mine. I don't think you are. I live in US and its version of 'privacy' has been normalized to a horrifying degree ( click this button so that we can do whatever we want ). We are basically at a point where 'enemy of the state' movie comparison is not even apt, because in that movie the audience would be petrified by it. Most are comfortably post-privacy.
  - somenameforme 3y ago
    Just about every survey on this topic clarifies people are nowhere remotely near 'post-privacy.' [1] That's a random one, but they all say the exact same thing. Basically everybody, by an absolutely overwhelming margin, feels that the risks of mass surveillance (including from the government) outweigh the benefits, with a similarly overwhelming majority also concerned about how the data is being [mis]used. The problem is our democracy is completely broken, and the fact that 80%+ of people agree on something that would even be socially beneficial, means absolutely nothing in terms of getting it done. Politicians and corporations love hoovering data for the exact same reason - perceived power. So nothing changes. And no politicians run on topics that people care about because you don't get to the point of being able to run for the presidency unless they're a billionaire, or have become really good at greasing the bellies of those that matter. And those that matter, only want even more surveillance. It's topics like this, and others, that lead individuals like me to think our system is due to collapse. Not the issue in and of itself, but the fact we have a democracy that seems to have little to nothing to do with the interests of the people. Instead it's just propagandized crap after propagandized crap made into the issue of the day (that incidentally tends to have absolutely 0 benefit to the lives of the average American), while what people actually care about is completely ignored. Anyhow, rant over. Point being, no nobody is "post-privacy", let alone comfortably. It's more like we're a democracy that's become "post-democracy", and seemingly comfortably so. Plato is more a prophet than a philosopher at this point. [1] - https://www.pewresearch.org/internet/2019/11/15/americans-and-privacy-concerned-confused-and-feeling-lack-of-control-over-their-personal-information/ https://www.pewresearch.org/internet/2019/11/15/americans-an...
dmichulke 3y ago
... and then I wonder why people lose their trust in the EU commission
nologic01 3y ago
What a humiliating outcome for the EU. Big on words, dwarf in actions. The US is unlikely to ever properly regulate its treasured "big tech". As the footprint of digital services on our lives keeps increasing the EU must decide what sort of society and economy it really is.
- Nasrudith 3y ago
  Unlikely to regulate? This is the regulation.
  - floomk 3y ago
    Hardly.
- jsnell 3y ago
  The problem with the data transfer was never the (lack of) regulation of big tech. If a company doesn't have sufficient privacy safeguards and controls for the data, it'd be a problem no matter where the data is stored. And the EU is perfectly capable and willing to fine them for billions or more for it. The problem was with insufficient safeguards for data requests by the US government -- law enforcement and spy agencies. That's supposedly been addressed by the Biden executive order, but we'll see if the CJEU actually buys that argument.
  - shadowgovt 3y ago
    I'm surprised the EU was comfortable with an executive EO instead of, say, a treaty. They do know that (excepting special circumstances like insufficient justification) an EO can usually be overturned with minimal oversight by the next administration, right?
    - SpicyLemonZest 3y ago
      Statutes can be overturned too. It seems reasonable to bet that a future administration won’t want to invite the drama; if they do, the EU has revoked the agreement once so they’d presumably be willing to do it again.
thrwaway9 3y ago
Big win for the CIA who will now increase the database with 500 million citizens
- coffeebeqn 3y ago
  Isn’t it a bit naive to think that the US intelligence agencies are only able to harvest data from the United States?
DrThunder 3y ago
No one's fault but their own. Europe wants to form businesses created in other countries to their laws. Instead, they should focus on building infrastructure themselves and not always just getting 2nd hand US products. They sit idly by while these companies get made when they could be building their own alternatives.
isaacremuant 3y ago
This is just part for the course. Those who think "europe is good on privacy" and want others to "shut up about it" ignore the deep corruption that exists (with regional flavours) which is usually shielded in bureocracy and process to pretend it's doing things on behalf of people and not simply their corporate quid-pro-quo friends and their self preservation interests. But hey, it's easier to pretend "things are fine and that the problem is 'the right'" or some other boogeyman that dares criticize things outside the overton window.
- shadowgovt 3y ago
  Is it even corruption, or is it more a lack of philosophical cohesion? I know that the US and most of Europe differ wildly on their understanding of monopoly protection. Extrapolating, I wonder if different EU members differ broadly on what constitutes "privacy" and therefore one might expect somewhat inconsistent results on privacy decisions based on who's hand holds the tiller that day.
  - nani8ot 3y ago
    I don't think it's different views on privacy between countries, since there's ambition to limit privacy of citizens in most countries. My understanding is that there's always pressure from the executive to get more rights (surveillance, weapons, confinement). Depending on the administration and responsible minister, this results in slower or faster decrease in privacy. E.g. here in Germany the current administration stance is against mass surveillance. But the responsible minister of inner affairs calls for less limits on surveillance. Luckily the entire rest of the administration is against it...
  - isaacremuant 3y ago
    > Is it even corruption, or is it more a lack of philosophical cohesion? It's corruption. People just don't want to see it. The same way people compare health systems to the US to pretend they're not royally screwed and corrupt. > I know that the US and most of Europe differ wildly on their understanding of monopoly protection. Extrapolating, I wonder if different EU members differ broadly on what constitutes "privacy" and therefore one might expect somewhat inconsistent results on privacy decisions based on who's hand holds the tiller that day. Not really. Every other country is trying to ban encryption, further ban speech, ban criticism of politicians to "protect children", I'm sorry, to protect "minorites" this time around. And this is not just EU, UK and other non-EU members have the same issues. The point is, for whatever reason, these countries which are absolutely corrupt but have very status quo parliamentary systems with little political involvement, get treated as if they didn't have entrenched corrupt politicians who couldn't give less of a fuck, about privacy or the citizen in general. You just have to be involved a little in the country's politics and you see it.
marketingtech 3y ago
The EU issued fines to Google and Meta for billions of dollars a few weeks before they decided this data transfer would be allowed. Wonder if they'll actually be required to pay the full fines now.
CrzyLngPwd 3y ago
The EU is just a vassal of the USA anyway.
- Thiez 3y ago
  > The EU is just a vassal of the EU anyway. Are you trying to say they are their own master, or did you want to write "USA" instead of that second "EU"?
  - CrzyLngPwd 3y ago
    Yes I was trying to say they were vassals of the USA.
- denton-scratch 3y ago
  Of course. And the USA is a vassal of the USA? Be your own vassal. Perhaps it's like the converse of being a sovereign citizen.
lynx23 3y ago
Wel, its not easy to ban some big tech services from your life, but IMO, now is a good time to evaluate what can go. I have been toying with killing FaceBook for at least two years, this is likely a good moment to actually make it happen. THe USA is not trustworthy when it comes to datd privacy. Nor is any government. But opening the doors to send everything oversees to the "big brother" is simply not acceptable. I am not an US citizen. Since the EU obviously doesn't care for my citizen rights, I think it is time to vote for leaving the EU as well.
- shadowgovt 3y ago
  FWIW, replacing big tech with small tech doesn't really solve the problem unless you're willing to go all the way and sysadmin your own physical on-prem hardware. In my experience, small tech is even riskier because they have similar technological capabilities as big tech to aggregate data and less oversight. Google, for all its ills, has an incentive to protect user privacy: people stop sending them money if they think Google is letting rando criminals harvest userdata, and governments get really antsy if they can't provide audit records for where the data goes and how it's secured. User trust is a lot more valuable to Google than risking that data, and (while the way Google uses the data can be cringe from time to time) the data itself is extremely secure, relatively speaking. Smaller firms can be bribed by those criminals, or bought by another firm with a different idea of privacy, or they simply go under and it turns out the data was unencrypted this whole time and, oops, the physical hardware storing the data just got auctioned off without a proper scrubbing, or some mid-level engineer had a copy of the whole user database on their laptop, or etc. And governments are worse at chasing the long tail of small firms; the legal process is better tuned to plop Meta and Google's lawyers' asses in the chair of an inquiry board than the lawyers / CEOs / garage-bound owners of a thousand small firms.
  - lynx23 3y ago
    Well, I wasn't trying to say that small tech is better in any way then big tech. It is just that most for most standard users, most valuable data is likely going to big tech companies. Also, I disagree with your analysis, I wouldn't trust big companies more then small ones, for whatever reasons. US based is US based, and that is that. If the EU obviously fails to protect my data as a citizen by forcing these global players to keep the data roughly local, I am out.
shadowgovt 3y ago
Oh, interesting. So it looks like Meta made a bet and won: they didn't change their infrastructure over because they figured this is how the decision would go?
- disgruntledphd2 3y ago
  This actually makes their strategy make more sense. They kept claiming they'd need to leave the EU (which they would not have done), but it appears that the audience was the Commission rather than the regulators.
denton-scratch 3y ago
The ECJ has thrown out two schemes like this already; the new scheme is barely changed from the previous two. NOYB is likely to challenge this one too. The EU Commission is a lobbyist's playground, and the least-democratic of the EU institutions. I'm shocked that the Commission can do something like this by decree, without any review by other institutions.
- deleted 3y ago
  [deleted]
- mananaysiempre 3y ago
  > I'm shocked that the Commission can do something like this by decree, without any review by other institutions. I don’t actually understand what the legal status of the “adequacy decision” is—it seems that once it’s thrown out by CJEU anyone who’d trusted it is still considered to have been doing illegal things? What does the decision make possible that wasn’t before? That said, diplomacy has always been a part of the executive, which combined with the spread of democracy has led to weird hacks such as signatures on treaties not actually meaning anything until a parliament approves of (“ratifies”) them.
  - denton-scratch 3y ago
    I haven't gone into it. I think the idea is that the Commission maintains a list of countries to which it is OK to transfer data. The list is referenced from the regulation, but maintained by the Commission. Effectively, the Commission can adjust the legislation by buereaucratic pen-stroke, by altering the list. I don't know whether it can operate retrospectively; for example, if you were off the list for a few years, but are now OK again, does that mean that your tech companies can't be chased for what they were doing when it wasn't OK? I'd also like to know how this affects the UK. I don't know whether the UK implements the Commission's list in our legislation. Like I said, I haven't had a chance to dig yet.
- blibble 3y ago
  > I'm shocked that the Commission can do something like this by decree, without any review by other institutions. the entire point of the EU is the transfer of power from member state elected parliaments to a continent wide appointed executive and it's designed as a ratchet: once transferred it's impossible to get back (other than leaving the entire thing)
throwaway2016a 3y ago
Everyone is focussing on the negatives but I think this is a big win for US based startup companies. This is through a program called Privacy Shield. For years Privacy Shield was allowed in the EU. It requires registering with theUS Gov't and having certain standards in place. It's not as strict as GDPR but it is still something. This does have implications for big tech as well but big tech could have always afforded to jump through hoops for Europe using loop holes and subsidiaries. This levels the fiend a bit.
- JohnFen 3y ago
  > This levels the fiend a bit. I'm not sure that letting smaller companies abuse people like the big companies do is a good kind of field-levelling.
joiqj 3y ago
Also a win for most users, who don't care about this stuff and just want to use free services of quality.
- high_5 3y ago
  Fake free services. You're paying them with personal information about you and your behaviour.
  - jen20 3y ago
    Indeed. Not even gratis, certainly not libre, unless you consider your personal information to be worthless (and “big adtech” has shown this not to be true).
  - joiqj 3y ago
    Which doesn't cost me a dime. Anybody with half a brain knows that TANSTAAFL, you have to pay somehow, but this way doesn't reduce the magic number in my bank. My information belongs to ME and I should be able to give it in exchange for anything I want. That is my right that was taken away by the EU and now I have it back.
    - nani8ot 3y ago
      You personally always had the right to give your data to US companies. As a company processing my EU citizen data, you couldn't since that would infringe on my right for privacy.
      - joiqj 3y ago
        That's not true. The law restricts what companies can do with my data even after I consent to their treatment of my data.
andersa 3y ago
Fucking finally! This isn't a "win for Facebook and Google", this is a win for every single small European business which can finally use industry standard services again without worrying about being fined.
- MaKey 3y ago
  It is barely different from the first Privacy Shield, so the chance of it being shot down again by the European Court of Justice seems quite high to me. Therefore as a small European business I'd avoid using "industry standard services" from the US anyways.
TacticalCoder 3y ago
I really don't mind much about private companies spying on citizens: it's surveillance capitalism after all and you certainly, for example, decide to give FB/WhatsApp/Threads/Instagram the big giant middle finger. What I do mind though is, once again, the EU Commission showing what they are: leeches fed on lobbyists money to pass laws favoring big corporations. It's insane but the EU Commission is, since it exists and relentlessly and endlessly, the bad guy. The EU Parliament, where there's at least a few hundreds elected people, tries to tone down the EU Commission but the Commission has been given so much power it pretty much writes the rules (which all the EU countries are forced to transpose into national laws). AFAIK more money is spend in lobbying in the EU than in the US. It's legal bribery and it's sad really.
- JohnFen 3y ago
  > it's surveillance capitalism after all and you certainly, for example, decide to give FB/WhatsApp/Threads/Instagram the big giant middle finger. Except that Facebook/Google/etc collects your data even if you do give them a giant middle finger and refuse to do business with them.
theknocker 3y ago
[dead]
richardfey 3y ago
What a joke... No big or small company is ever going to separate EU and non EU customers in different databases. Intelligence will just get whatever their filter matches.
- edmundsauto 3y ago
  Data sovereignty is indeed a thing, where companies separate customer data based on where they are located. A very expensive, pain-in-the-ass to deal with thing.
hulitu 3y ago
> Big Tech can transfer Europeans’ data to US in win for Facebook and Google Money well spent. Now it is clear why they spend milions for "lobby".
closeparen 3y ago
Modern distributed systems span sites. The same artifacts run in all the zones and regions. You may have partitioning schemes for certain datasets, but that’s generally abstracted from the people and systems accessing them (aside from latency). Any extra access controls or restrictions on certain kinds of processing are going to be implemented in software at the record level, not by where the code is physically running. If we were talking about doing a fully isolated instance of Facebook for the EU that would be one thing, but messing with where records physically live is dumb showboating. As long as US users connected to US backends can interact with EU friends’ content, it’s clear that the geographical separation is providing no meaningful secrecy of EU data.

163 points by isaacfrond 3y ago

the_mitsuhiko 3y ago

Pretty sure the underlying issues were not addressed so we shall see a Schrems III a few years from now.

mschild 3y ago
They've already prepared a challenge to it. https://noyb.eu/en/european-commission-gives-eu-us-data-transfers-third-round-cjeu https://noyb.eu/en/european-commission-gives-eu-us-data-tran...
skrause 3y ago
No problem, if that happens the EU commission will just introduce the same law under a different name for the fourth time. Rinse and repeat...
- ocdtrekkie 3y ago
  How many times can they straight up cheese the court without facing any penalties themselves?

standing_user 3y ago

Well it was just a matter of time, the martech industry need that flow to work to make money

ChatGTP 3y ago
The lobbying wins again.

deleted 3y ago

[deleted]

htrwan 3y ago

[flagged]

dragonelite 3y ago
If it wasn't obvious before its becoming more and more obvious the last 2 years.
- hxcan11 3y ago
  [flagged]
pavlov 3y ago
SWIFT, which is a Belgian co-op. I'm actually kind of surprised that this rhetoric hasn't been picked up by the Fox News crowd yet. "A group of Belgian communists holds the key to all international banking transactions made by Americans! Where is my liberty"
- hxcan11 3y ago
  > SWIFT, which is a Belgian co-op. That is exactly the point. The U.S. snoops on European data: https://www.spiegel.de/international/europe/spying-on-terrorist-cash-flows-eu-to-allow-us-access-to-bank-transaction-data-a-663846.html https://www.spiegel.de/international/europe/spying-on-terror... As part of the war on terror, American intelligence services have been monitoring European bank transactions since 2001. When the EU found out about it in 2006, they were outraged. But now it looks like the bloc will agree to a controversial deal that will allow the covert data transfer to continue.
tho2io34u23434 3y ago
[flagged]

sarnowski 3y ago

In parallel, there is a quite different point of view and after the last two dramas (Safe Harbor, Privacy Shield), the outcome is quite predictable in my opinion. https://news.ycombinator.com/item?id=36677578 https://news.ycombinator.com/item?id=36677578 Edit: of course for the next 1-3 years, compliance departments in the EU can declare themselves not guilty and business will continue as usual.

tguvot 3y ago
i recently spent year+ on managing gdpr compliance implementation in company where I work (multinational *aaS). Our current stance that we will continue as usual, where usual been that there is no new agreement. Because breaking down all gdpr compliance is easy but to restore it to compliant state is hard.

Saphyel 3y ago

This is bad news for EU and the world but I guess congrats for meta and google.

remus 3y ago
Depends what you mean by bad news really. If it turns out that transferring personal data between the EU and US is fundamentally impossible due to irreconcilable differences in data protection legislation then it'd have huge consequences for businesses and consumers world wide. Short term it'd almost certainly be a net loss for consumers. Personally (and probably naively), I do hope the EU and US can find enough common ground. It'll make everyone's lives a lot easier [1]. [1] ...if the US can get out of the habit of rifling through the data of EU citizens at the drop of a hat.
- VWWHFSfQ 3y ago
  > it'd have huge consequences for businesses and consumers world wide. Short term it'd almost certainly be a net loss for consumers. I think this would pretty much only be a net loss for EU consumers and businesses. Maybe no longer having access to American tech companies' services would be beneficial long-term but only if EU entrepreneurs build domestic alternatives, which we know is pretty unlikely. I think the reality is that they'll just loosen their laws so they don't get shut out. As we're seeing them do here.
  - protomolecule 3y ago
    "if EU entrepreneurs build domestic alternatives, which we know is pretty unlikely" Why is it unlikely?
    - jimnotgym 3y ago
      If the US tech companies are shut out I would say it is very likely.
    - thereddaikon 3y ago
      The EU has had a spotty history competing with SV. A large part of that is the different investment and regulatory environment for better or worse makes it much harder for tech startups to get going, especially after the fact when there are established players.

mediascreen 3y ago

Yes! Maybe we can start caring about stuff that actually matters now instead of obsessing over IP-addresses maybe touching US soil when loading a font from a CDN.

deleted 3y ago
[deleted]

dijit 3y ago

the most ironic part is that it's the US itself which is going to monitor compliance. The entire problem for me is basically what Snowden revealed. In most democratic western countries a certain level of privacy is actually enshrined into law due to it's propensity for abuse. -- the US spying on Swedens behalf means that technically Sweden is not spying on Swedes. The US having data on me by itself isn't a huge deal; there's no fucking way I will ever want to live there and factually: nobody is going to go sniffing into my life like in the movie "Enemy of the State" (though I suppose they could). However, the US sharing that information with Sweden can affect my life, because it's intentionally bypassing a protection that I am supposed to have in order to live in a free democratic system. Failure to respect privacy lends itself to authoritarianism as people will self-censor if they feel they are not able to express themselves. Maybe I'm overstating this but it's a real concern of mine.

A4ET8a8uTh0 3y ago
<< Maybe I'm overstating this but it's a real concern of mine. I don't think you are. I live in US and its version of 'privacy' has been normalized to a horrifying degree ( click this button so that we can do whatever we want ). We are basically at a point where 'enemy of the state' movie comparison is not even apt, because in that movie the audience would be petrified by it. Most are comfortably post-privacy.
- somenameforme 3y ago
  Just about every survey on this topic clarifies people are nowhere remotely near 'post-privacy.' [1] That's a random one, but they all say the exact same thing. Basically everybody, by an absolutely overwhelming margin, feels that the risks of mass surveillance (including from the government) outweigh the benefits, with a similarly overwhelming majority also concerned about how the data is being [mis]used. The problem is our democracy is completely broken, and the fact that 80%+ of people agree on something that would even be socially beneficial, means absolutely nothing in terms of getting it done. Politicians and corporations love hoovering data for the exact same reason - perceived power. So nothing changes. And no politicians run on topics that people care about because you don't get to the point of being able to run for the presidency unless they're a billionaire, or have become really good at greasing the bellies of those that matter. And those that matter, only want even more surveillance. It's topics like this, and others, that lead individuals like me to think our system is due to collapse. Not the issue in and of itself, but the fact we have a democracy that seems to have little to nothing to do with the interests of the people. Instead it's just propagandized crap after propagandized crap made into the issue of the day (that incidentally tends to have absolutely 0 benefit to the lives of the average American), while what people actually care about is completely ignored. Anyhow, rant over. Point being, no nobody is "post-privacy", let alone comfortably. It's more like we're a democracy that's become "post-democracy", and seemingly comfortably so. Plato is more a prophet than a philosopher at this point. [1] - https://www.pewresearch.org/internet/2019/11/15/americans-and-privacy-concerned-confused-and-feeling-lack-of-control-over-their-personal-information/ https://www.pewresearch.org/internet/2019/11/15/americans-an...

dmichulke 3y ago

... and then I wonder why people lose their trust in the EU commission

nologic01 3y ago

What a humiliating outcome for the EU. Big on words, dwarf in actions. The US is unlikely to ever properly regulate its treasured "big tech". As the footprint of digital services on our lives keeps increasing the EU must decide what sort of society and economy it really is.

Nasrudith 3y ago
Unlikely to regulate? This is the regulation.
- floomk 3y ago
  Hardly.
jsnell 3y ago
The problem with the data transfer was never the (lack of) regulation of big tech. If a company doesn't have sufficient privacy safeguards and controls for the data, it'd be a problem no matter where the data is stored. And the EU is perfectly capable and willing to fine them for billions or more for it. The problem was with insufficient safeguards for data requests by the US government -- law enforcement and spy agencies. That's supposedly been addressed by the Biden executive order, but we'll see if the CJEU actually buys that argument.
- shadowgovt 3y ago
  I'm surprised the EU was comfortable with an executive EO instead of, say, a treaty. They do know that (excepting special circumstances like insufficient justification) an EO can usually be overturned with minimal oversight by the next administration, right?
  - SpicyLemonZest 3y ago
    Statutes can be overturned too. It seems reasonable to bet that a future administration won’t want to invite the drama; if they do, the EU has revoked the agreement once so they’d presumably be willing to do it again.

thrwaway9 3y ago

Big win for the CIA who will now increase the database with 500 million citizens

coffeebeqn 3y ago
Isn’t it a bit naive to think that the US intelligence agencies are only able to harvest data from the United States?

DrThunder 3y ago

No one's fault but their own. Europe wants to form businesses created in other countries to their laws. Instead, they should focus on building infrastructure themselves and not always just getting 2nd hand US products. They sit idly by while these companies get made when they could be building their own alternatives.

isaacremuant 3y ago

This is just part for the course. Those who think "europe is good on privacy" and want others to "shut up about it" ignore the deep corruption that exists (with regional flavours) which is usually shielded in bureocracy and process to pretend it's doing things on behalf of people and not simply their corporate quid-pro-quo friends and their self preservation interests. But hey, it's easier to pretend "things are fine and that the problem is 'the right'" or some other boogeyman that dares criticize things outside the overton window.

shadowgovt 3y ago
Is it even corruption, or is it more a lack of philosophical cohesion? I know that the US and most of Europe differ wildly on their understanding of monopoly protection. Extrapolating, I wonder if different EU members differ broadly on what constitutes "privacy" and therefore one might expect somewhat inconsistent results on privacy decisions based on who's hand holds the tiller that day.
- nani8ot 3y ago
  I don't think it's different views on privacy between countries, since there's ambition to limit privacy of citizens in most countries. My understanding is that there's always pressure from the executive to get more rights (surveillance, weapons, confinement). Depending on the administration and responsible minister, this results in slower or faster decrease in privacy. E.g. here in Germany the current administration stance is against mass surveillance. But the responsible minister of inner affairs calls for less limits on surveillance. Luckily the entire rest of the administration is against it...
- isaacremuant 3y ago
  > Is it even corruption, or is it more a lack of philosophical cohesion? It's corruption. People just don't want to see it. The same way people compare health systems to the US to pretend they're not royally screwed and corrupt. > I know that the US and most of Europe differ wildly on their understanding of monopoly protection. Extrapolating, I wonder if different EU members differ broadly on what constitutes "privacy" and therefore one might expect somewhat inconsistent results on privacy decisions based on who's hand holds the tiller that day. Not really. Every other country is trying to ban encryption, further ban speech, ban criticism of politicians to "protect children", I'm sorry, to protect "minorites" this time around. And this is not just EU, UK and other non-EU members have the same issues. The point is, for whatever reason, these countries which are absolutely corrupt but have very status quo parliamentary systems with little political involvement, get treated as if they didn't have entrenched corrupt politicians who couldn't give less of a fuck, about privacy or the citizen in general. You just have to be involved a little in the country's politics and you see it.

marketingtech 3y ago

The EU issued fines to Google and Meta for billions of dollars a few weeks before they decided this data transfer would be allowed. Wonder if they'll actually be required to pay the full fines now.

CrzyLngPwd 3y ago

The EU is just a vassal of the USA anyway.

Thiez 3y ago
> The EU is just a vassal of the EU anyway. Are you trying to say they are their own master, or did you want to write "USA" instead of that second "EU"?
- CrzyLngPwd 3y ago
  Yes I was trying to say they were vassals of the USA.
denton-scratch 3y ago
Of course. And the USA is a vassal of the USA? Be your own vassal. Perhaps it's like the converse of being a sovereign citizen.

lynx23 3y ago

Wel, its not easy to ban some big tech services from your life, but IMO, now is a good time to evaluate what can go. I have been toying with killing FaceBook for at least two years, this is likely a good moment to actually make it happen. THe USA is not trustworthy when it comes to datd privacy. Nor is any government. But opening the doors to send everything oversees to the "big brother" is simply not acceptable. I am not an US citizen. Since the EU obviously doesn't care for my citizen rights, I think it is time to vote for leaving the EU as well.

shadowgovt 3y ago
FWIW, replacing big tech with small tech doesn't really solve the problem unless you're willing to go all the way and sysadmin your own physical on-prem hardware. In my experience, small tech is even riskier because they have similar technological capabilities as big tech to aggregate data and less oversight. Google, for all its ills, has an incentive to protect user privacy: people stop sending them money if they think Google is letting rando criminals harvest userdata, and governments get really antsy if they can't provide audit records for where the data goes and how it's secured. User trust is a lot more valuable to Google than risking that data, and (while the way Google uses the data can be cringe from time to time) the data itself is extremely secure, relatively speaking. Smaller firms can be bribed by those criminals, or bought by another firm with a different idea of privacy, or they simply go under and it turns out the data was unencrypted this whole time and, oops, the physical hardware storing the data just got auctioned off without a proper scrubbing, or some mid-level engineer had a copy of the whole user database on their laptop, or etc. And governments are worse at chasing the long tail of small firms; the legal process is better tuned to plop Meta and Google's lawyers' asses in the chair of an inquiry board than the lawyers / CEOs / garage-bound owners of a thousand small firms.
- lynx23 3y ago
  Well, I wasn't trying to say that small tech is better in any way then big tech. It is just that most for most standard users, most valuable data is likely going to big tech companies. Also, I disagree with your analysis, I wouldn't trust big companies more then small ones, for whatever reasons. US based is US based, and that is that. If the EU obviously fails to protect my data as a citizen by forcing these global players to keep the data roughly local, I am out.

shadowgovt 3y ago

Oh, interesting. So it looks like Meta made a bet and won: they didn't change their infrastructure over because they figured this is how the decision would go?

disgruntledphd2 3y ago
This actually makes their strategy make more sense. They kept claiming they'd need to leave the EU (which they would not have done), but it appears that the audience was the Commission rather than the regulators.

denton-scratch 3y ago

The ECJ has thrown out two schemes like this already; the new scheme is barely changed from the previous two. NOYB is likely to challenge this one too. The EU Commission is a lobbyist's playground, and the least-democratic of the EU institutions. I'm shocked that the Commission can do something like this by decree, without any review by other institutions.

deleted 3y ago
[deleted]
mananaysiempre 3y ago
> I'm shocked that the Commission can do something like this by decree, without any review by other institutions. I don’t actually understand what the legal status of the “adequacy decision” is—it seems that once it’s thrown out by CJEU anyone who’d trusted it is still considered to have been doing illegal things? What does the decision make possible that wasn’t before? That said, diplomacy has always been a part of the executive, which combined with the spread of democracy has led to weird hacks such as signatures on treaties not actually meaning anything until a parliament approves of (“ratifies”) them.
- denton-scratch 3y ago
  I haven't gone into it. I think the idea is that the Commission maintains a list of countries to which it is OK to transfer data. The list is referenced from the regulation, but maintained by the Commission. Effectively, the Commission can adjust the legislation by buereaucratic pen-stroke, by altering the list. I don't know whether it can operate retrospectively; for example, if you were off the list for a few years, but are now OK again, does that mean that your tech companies can't be chased for what they were doing when it wasn't OK? I'd also like to know how this affects the UK. I don't know whether the UK implements the Commission's list in our legislation. Like I said, I haven't had a chance to dig yet.
blibble 3y ago
> I'm shocked that the Commission can do something like this by decree, without any review by other institutions. the entire point of the EU is the transfer of power from member state elected parliaments to a continent wide appointed executive and it's designed as a ratchet: once transferred it's impossible to get back (other than leaving the entire thing)

throwaway2016a 3y ago

Everyone is focussing on the negatives but I think this is a big win for US based startup companies. This is through a program called Privacy Shield. For years Privacy Shield was allowed in the EU. It requires registering with theUS Gov't and having certain standards in place. It's not as strict as GDPR but it is still something. This does have implications for big tech as well but big tech could have always afforded to jump through hoops for Europe using loop holes and subsidiaries. This levels the fiend a bit.

JohnFen 3y ago
> This levels the fiend a bit. I'm not sure that letting smaller companies abuse people like the big companies do is a good kind of field-levelling.

joiqj 3y ago

Also a win for most users, who don't care about this stuff and just want to use free services of quality.

high_5 3y ago
Fake free services. You're paying them with personal information about you and your behaviour.
- jen20 3y ago
  Indeed. Not even gratis, certainly not libre, unless you consider your personal information to be worthless (and “big adtech” has shown this not to be true).
- joiqj 3y ago
  Which doesn't cost me a dime. Anybody with half a brain knows that TANSTAAFL, you have to pay somehow, but this way doesn't reduce the magic number in my bank. My information belongs to ME and I should be able to give it in exchange for anything I want. That is my right that was taken away by the EU and now I have it back.
  - nani8ot 3y ago
    You personally always had the right to give your data to US companies. As a company processing my EU citizen data, you couldn't since that would infringe on my right for privacy.
    - joiqj 3y ago
      That's not true. The law restricts what companies can do with my data even after I consent to their treatment of my data.

andersa 3y ago

Fucking finally! This isn't a "win for Facebook and Google", this is a win for every single small European business which can finally use industry standard services again without worrying about being fined.

MaKey 3y ago
It is barely different from the first Privacy Shield, so the chance of it being shot down again by the European Court of Justice seems quite high to me. Therefore as a small European business I'd avoid using "industry standard services" from the US anyways.

TacticalCoder 3y ago

I really don't mind much about private companies spying on citizens: it's surveillance capitalism after all and you certainly, for example, decide to give FB/WhatsApp/Threads/Instagram the big giant middle finger. What I do mind though is, once again, the EU Commission showing what they are: leeches fed on lobbyists money to pass laws favoring big corporations. It's insane but the EU Commission is, since it exists and relentlessly and endlessly, the bad guy. The EU Parliament, where there's at least a few hundreds elected people, tries to tone down the EU Commission but the Commission has been given so much power it pretty much writes the rules (which all the EU countries are forced to transpose into national laws). AFAIK more money is spend in lobbying in the EU than in the US. It's legal bribery and it's sad really.

JohnFen 3y ago
> it's surveillance capitalism after all and you certainly, for example, decide to give FB/WhatsApp/Threads/Instagram the big giant middle finger. Except that Facebook/Google/etc collects your data even if you do give them a giant middle finger and refuse to do business with them.

theknocker 3y ago

[dead]

richardfey 3y ago

What a joke... No big or small company is ever going to separate EU and non EU customers in different databases. Intelligence will just get whatever their filter matches.

edmundsauto 3y ago
Data sovereignty is indeed a thing, where companies separate customer data based on where they are located. A very expensive, pain-in-the-ass to deal with thing.

hulitu 3y ago

> Big Tech can transfer Europeans’ data to US in win for Facebook and Google Money well spent. Now it is clear why they spend milions for "lobby".

closeparen 3y ago

Modern distributed systems span sites. The same artifacts run in all the zones and regions. You may have partitioning schemes for certain datasets, but that’s generally abstracted from the people and systems accessing them (aside from latency). Any extra access controls or restrictions on certain kinds of processing are going to be implemented in software at the record level, not by where the code is physically running. If we were talking about doing a fully isolated instance of Facebook for the EU that would be one thing, but messing with where records physically live is dumb showboating. As long as US users connected to US backends can interact with EU friends’ content, it’s clear that the geographical separation is providing no meaningful secrecy of EU data.