4 ms·

GDPR won't protect you from law enforcement, let alone intelligence agencies. The legal mechanisms these organizations use have broad carve outs from GDPR. Bef

GDPR won't protect you from law enforcement, let alone intelligence agencies. The legal mechanisms these organizations use have broad carve outs from GDPR. Before GDPR, there already were other protections against domestic three letter agency surveillance. As Snowden showed us, this was easily circumvented by getting UK to spy on US citizens instead and sending over the data (and vice versa).

morelisp 3y ago
Although GDPR doesn't restrict the activities of law enforcement, it does restrict what other companies have and therefore what LE can request of them. The biggest issue is not that LE can investigate specific things, it's that they have easy access to such a massive self-perpetuating dragnet of everything.
jeroenhd 3y ago
The GDPR may not protect you from law enforcement, but it's not like you're free to send over whatever you wish to the police without following the proper process, either. If you have information on someome the police asks for, there are strict processes that need to be followed. Sharing information with the police at a mere request, like what happened in this case, may even force you to inform the people whose information you have provided. Unless law enforcement can demand confidentiality, they're a normal party in the eyes of the law. For example, when the police requests security camera owners for footage in a wide area around where a crime took place, sharing that footage may be illegal without blurring or cropping if other innocent people not matching the suspect's description are in clear view, or you may need to inform those people that you have provided the police with footage they're visible in. This very much depends on where the camera is located and where it's pointed at, and I doubt anyone had ever filed a GDPR complaint with their DPA about it, but without following the proper legal process, the police is as valid a party to share information with as any other person or organisation. In this case, where the police asked Apple but did not fully utilise their investigatory powers (because Apple could've demanded a warrant), a GDPR-like law would've made it harder for governments to spy on people. It's not like warrants are hard to come by for spy agencies, but such warrants would at least produce a paper trail of some kind in the case of a witch hunt.

morelisp 3y ago

Although GDPR doesn't restrict the activities of law enforcement, it does restrict what other companies have and therefore what LE can request of them. The biggest issue is not that LE can investigate specific things, it's that they have easy access to such a massive self-perpetuating dragnet of everything.

jeroenhd 3y ago

The GDPR may not protect you from law enforcement, but it's not like you're free to send over whatever you wish to the police without following the proper process, either. If you have information on someome the police asks for, there are strict processes that need to be followed. Sharing information with the police at a mere request, like what happened in this case, may even force you to inform the people whose information you have provided. Unless law enforcement can demand confidentiality, they're a normal party in the eyes of the law. For example, when the police requests security camera owners for footage in a wide area around where a crime took place, sharing that footage may be illegal without blurring or cropping if other innocent people not matching the suspect's description are in clear view, or you may need to inform those people that you have provided the police with footage they're visible in. This very much depends on where the camera is located and where it's pointed at, and I doubt anyone had ever filed a GDPR complaint with their DPA about it, but without following the proper legal process, the police is as valid a party to share information with as any other person or organisation. In this case, where the police asked Apple but did not fully utilise their investigatory powers (because Apple could've demanded a warrant), a GDPR-like law would've made it harder for governments to spy on people. It's not like warrants are hard to come by for spy agencies, but such warrants would at least produce a paper trail of some kind in the case of a witch hunt.