3 ms·

Can anyone explain how this relates to the EU-US Data Privacy Framework (also sometimes called the Trans-Atlantic Data Privacy Framework)? I thought that that

by AlanYx 2y ago

Can anyone explain how this relates to the EU-US Data Privacy Framework (also sometimes called the Trans-Atlantic Data Privacy Framework)? I thought that that framework was supposed to allow this (as a replacement for the EU–US Privacy Shield framework)? Presumably this wouldn't have been a problem under Privacy Shield (i.e., pre-2020), or am I getting that wrong?

di4na 2y ago
You are getting this wrong. Basically the framework, like the Shield before, is the Commission trying to show "look, we fixed it". Sadly, for the previous two times, the ECJ pointed out after the fact that no framework can fix the lack of data privacy law in the US, and that as such, the Shield, just like its predecessor, was not allowing what it claimed to do. The Framework has not been tested in the ECJ so far, but the US has not significantly altered its laws so...
- AlanYx 2y ago
  Thanks. So basically the new framework hasn't accomplished anything that can be relied upon when architecting a system to reduce the risk of GDPR compliance issues?
  - di4na 2y ago
    Depends who you talk to.
jorams 2y ago
This article[1] by the Dutch DPA has some details about it: The Privacy Shield was invalidated in 2020, leaving only the Standard Contractual Clauses as a valid transfer tool. Uber stopped using Standard Contractual Clauses in August of 2021, before adopting the new Privacy Framework in 2023. For a period of two years they were transmitting extremely sensitive information without a valid way to do so. [1]: https://www.autoriteitpersoonsgegevens.nl/en/current/dutch-dpa-imposes-a-fine-of-290-million-euro-on-uber-because-of-transfers-of-drivers-data-to-the-us https://www.autoriteitpersoonsgegevens.nl/en/current/dutch-d...
- AlanYx 2y ago
  Thanks. That gives a lot more information. With respect to the new framework, the article you linked to just says "Since the end of last year, Uber uses the successor to the Privacy Shield." Do you know if the Dutch DPA endorsed the new framework, or did they leave it ambiguous/unresolved as to whether post-2023 transfers are GDPR compliant?
  - jorams 2y ago
    I don't think endorsing the new framework is something the DPA does. The EC declared the new framework adequate[1], Uber got certified for it[2], so there is now a valid method in place for Uber to transmit data. [1]: https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae6... [2]: https://www.dataprivacyframework.gov/list https://www.dataprivacyframework.gov/list (no deeplinks for some reason)

by AlanYx 2y ago

di4na 2y ago

You are getting this wrong. Basically the framework, like the Shield before, is the Commission trying to show "look, we fixed it". Sadly, for the previous two times, the ECJ pointed out after the fact that no framework can fix the lack of data privacy law in the US, and that as such, the Shield, just like its predecessor, was not allowing what it claimed to do. The Framework has not been tested in the ECJ so far, but the US has not significantly altered its laws so...

AlanYx 2y ago
Thanks. So basically the new framework hasn't accomplished anything that can be relied upon when architecting a system to reduce the risk of GDPR compliance issues?
- di4na 2y ago
  Depends who you talk to.

jorams 2y ago

This article[1] by the Dutch DPA has some details about it: The Privacy Shield was invalidated in 2020, leaving only the Standard Contractual Clauses as a valid transfer tool. Uber stopped using Standard Contractual Clauses in August of 2021, before adopting the new Privacy Framework in 2023. For a period of two years they were transmitting extremely sensitive information without a valid way to do so. [1]: https://www.autoriteitpersoonsgegevens.nl/en/current/dutch-dpa-imposes-a-fine-of-290-million-euro-on-uber-because-of-transfers-of-drivers-data-to-the-us https://www.autoriteitpersoonsgegevens.nl/en/current/dutch-d...

AlanYx 2y ago
Thanks. That gives a lot more information. With respect to the new framework, the article you linked to just says "Since the end of last year, Uber uses the successor to the Privacy Shield." Do you know if the Dutch DPA endorsed the new framework, or did they leave it ambiguous/unresolved as to whether post-2023 transfers are GDPR compliant?
- jorams 2y ago
  I don't think endorsing the new framework is something the DPA does. The EC declared the new framework adequate[1], Uber got certified for it[2], so there is now a valid method in place for Uber to transmit data. [1]: https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae6... [2]: https://www.dataprivacyframework.gov/list https://www.dataprivacyframework.gov/list (no deeplinks for some reason)