3 ms·

The EC has issued an "adequacy decision" regarding the new EU–US Data Privacy Framework (the replacement for Privacy Shield): https://commission.europa.eu/docum

by AlanYx 2y ago

The EC has issued an "adequacy decision" regarding the new EU–US Data Privacy Framework (the replacement for Privacy Shield): https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae6... and has begun "certifying" compliance with the Framework: https://www.dataprivacyframework.gov/list https://www.dataprivacyframework.gov/list So maybe the DPAs will defer to the EC's interpretation of adequacy under the GDPR for this new Framework? Lots of unknowns though, since Schrems has already announced a challenge to the Framework. The only "safe" option without any uncertainty seems to be architect every system so that data never transits to the US and is also never in the custody of a subsidiary of a US-domiciled corporate parent.

pyrale 2y ago
> The EC has issued an "adequacy decision" regarding the new EU–US Data Privacy Framework To bad the EC isn't the body that can judge whether that deal is legal, and has been caught repeatedly lying about past deals [1]. > So maybe the DPAs will defer to the EC's interpretation of adequacy under the GDPR for this new Framework? As before, cases will go to the actual authority on the matter: the CJUE. I personally don't have high hopes for this deal to last. [1]: https://noyb.eu/en/european-commission-gives-eu-us-data-transfers-third-round-cjeu https://noyb.eu/en/european-commission-gives-eu-us-data-tran...
- AlanYx 2y ago
  I tend to agree with you about what will happen, but it illustrates the depth of legal uncertainty that exists in architecting software systems in Europe that process personal information. Corporations can't necessarily trust the EC's own published interpretations of their own laws, nor the certification processes the EC has created, so the only risk-minimizing route is a maximally pessimistic approach about what is permissible.
  - pyrale 2y ago
    > but it illustrates the depth of legal uncertainty that exists in architecting software systems in Europe that process personal information. Oh I agree with that. EC's behaviour in that case is appalling. > Corporations can't necessarily trust the EC's own interpretations of their own laws There is a way to be safe with regards to EU law, and it's to engineer systems where European data stays in Europe. Of course, the issue is that corporations would then be liable under US' FISA 702. That's the big issue: the United States made a law that basically states that no US company should follow EU law, and the US admin manages to beat EC officials into submission every few years with another flawed agreement to keep the ball rolling.
    - AlanYx 2y ago
      It's not that easy really. Several European countries have FISA s.702 functional equivalents that enable intelligence to get orders for interception of personal information on servers and entities within their legal jurisdiction. (e.g., The French Law on Intelligence and the German BND Act) It's easy to say that the US should just scrap s.702, but unless it's reciprocal with Europe scrapping their interception powers as well, that's a pretty unrealistic ask.
      - mananaysiempre 2y ago
        Hm. I was aware that French law was kind of awful on this, but never investigated the specifics. As, say, a non-EU person, would I be able to bring suit to a French court (and, if that fails, to the CJEU) regarding foreign-intelligence eavesdropping violating my privacy rights? (AFAIU the US answer is that if I’m a foreigner on foreign soil I don’t have any of those).
        AlanYx 2y ago
        Yes, you could bring a suit if you knew about the interception. However, like FISA s.702, intelligence collection warrants under the French LI and German BND are generally secret, so most targets have no knowledge they are under surveillance. All three pieces of legislation have an oversight mechanism in terms of oversight bodies who have access to secret warrants and are supposed to ensure that they are being used appropriately.
pembrook 2y ago
Exactly, compliance is currently impossible since this is a geopolitical spat between the US and EU over US law. The goalposts on this move every 6 months, so the fines are easy money for the EU. The companies are just collateral damage. For some reason HN is full of people who don’t actually understand this issue but feel very emotionally passionate that all US tech companies are evil and doing this on purpose. “Just follow the law, you evil companies!” Lol. They would if there was a clear law/process to follow that didn’t get shot down every few months. As it stands, you cannot operate in the EU as a US company if you want to be totally immune from fines. I urge you to talk to your government representatives (on both sides of the pond) if you care about this issue. This benefits nobody except for EU government coffers.
- Vinnl 2y ago
  > feel very emotionally passionate that all US tech companies are evil and doing this on purpose. Oh no, it's the US government that claims authority to use these companies to surveil EU citizens that is the problem here. One that, unfortunately, does affect all US companies.
- pyrale 2y ago
  > Lol. They would if there was a clear law/process to follow that didn’t get shot down every few months. There isn't a process because US law makes it clear that US companies should be auxiliary to illegal acts abroad. And we find out every few months, that even when they aren't forced to, they disregard the law. Sure, maybe they're not "evil", but they apparently can't find a way to be law-abiding entities.
judge2020 2y ago
> The only "safe" option without any uncertainty seems to be architect every system so that data never transits to the US and is also never in the custody of a subsidiary of a US-domiciled corporate parent. If i'm not mistaken, because of this (via[0]) > The CLOUD Act primarily amends the Stored Communications Act (SCA) of 1986 to allow federal law enforcement to compel U.S.-based technology companies via warrant or subpoena to provide requested data stored on servers regardless of whether the data are stored in the U.S. or on foreign soil. It sounds like compliance is only possible* if "the US company doesn't have any influence on the EU data-holding company" which is insane. This might be satisfied if the US company simply licenses their software product (e.g. the Uber backend) to an EU company. But this might not be adequate since chances are updates would be somewhat automated, and thus the US-based Uber might be compelled by the government to ship malware with their update to catch some US criminal (or otherwise enact some US spying). * edit: only possible in lieu of a data agreement like Privacy Shield or its successor as mentioned above 0: top comment on https://news.ycombinator.com/item?id=33561222 https://news.ycombinator.com/item?id=33561222
- 6510 2y ago
  > catch some US criminal https://en.wikipedia.org/wiki/CIA_black_sites https://en.wikipedia.org/wiki/CIA_black_sites
- marcosdumay 2y ago
  > which is insane It's completely sane from the EU's point of view. Why would they submit their citizens to forceful government eavesdrop? I do agree it's insane. But the insanity is not on the GDPR.
  - blackeyeblitzar 2y ago
    You mean like the EU governments? Which country / countries have fundamental protections for free speech and censorship free social media? Which are seeking to force encryption backdoors?
- jeroenhd 2y ago
  It's true, the extensive surveillance capabilities the American government demands from American businesses is one of the reasons American companies cannot enter the European market. I doubt this will change any time soon. The GDPR isn't going away, and the USA isn't known for loosening their data collection laws. Maybe in a few years the EU can find a legal ground to allow the USA to spy on EU citizens without acceptable legal defences, maybe the USA will give up their capability to use American businesses as a tool to spy on the EU, but for now surveillance law is a major roadblock for American companies expanding to Europe.
MyFedora 2y ago
No, the EC asked ChatGPT to rewrite the Privacy Shield but give it another name, and the CJEU is expected to retroactively invalidate the law again. This will only change if the US provides essentially equivalent privacy protection laws, which they don't.

by AlanYx 2y ago

pyrale 2y ago

> The EC has issued an "adequacy decision" regarding the new EU–US Data Privacy Framework To bad the EC isn't the body that can judge whether that deal is legal, and has been caught repeatedly lying about past deals [1]. > So maybe the DPAs will defer to the EC's interpretation of adequacy under the GDPR for this new Framework? As before, cases will go to the actual authority on the matter: the CJUE. I personally don't have high hopes for this deal to last. [1]: https://noyb.eu/en/european-commission-gives-eu-us-data-transfers-third-round-cjeu https://noyb.eu/en/european-commission-gives-eu-us-data-tran...

AlanYx 2y ago
I tend to agree with you about what will happen, but it illustrates the depth of legal uncertainty that exists in architecting software systems in Europe that process personal information. Corporations can't necessarily trust the EC's own published interpretations of their own laws, nor the certification processes the EC has created, so the only risk-minimizing route is a maximally pessimistic approach about what is permissible.
- pyrale 2y ago
  > but it illustrates the depth of legal uncertainty that exists in architecting software systems in Europe that process personal information. Oh I agree with that. EC's behaviour in that case is appalling. > Corporations can't necessarily trust the EC's own interpretations of their own laws There is a way to be safe with regards to EU law, and it's to engineer systems where European data stays in Europe. Of course, the issue is that corporations would then be liable under US' FISA 702. That's the big issue: the United States made a law that basically states that no US company should follow EU law, and the US admin manages to beat EC officials into submission every few years with another flawed agreement to keep the ball rolling.
  - AlanYx 2y ago
    It's not that easy really. Several European countries have FISA s.702 functional equivalents that enable intelligence to get orders for interception of personal information on servers and entities within their legal jurisdiction. (e.g., The French Law on Intelligence and the German BND Act) It's easy to say that the US should just scrap s.702, but unless it's reciprocal with Europe scrapping their interception powers as well, that's a pretty unrealistic ask.
    - mananaysiempre 2y ago
      Hm. I was aware that French law was kind of awful on this, but never investigated the specifics. As, say, a non-EU person, would I be able to bring suit to a French court (and, if that fails, to the CJEU) regarding foreign-intelligence eavesdropping violating my privacy rights? (AFAIU the US answer is that if I’m a foreigner on foreign soil I don’t have any of those).
      - AlanYx 2y ago
        Yes, you could bring a suit if you knew about the interception. However, like FISA s.702, intelligence collection warrants under the French LI and German BND are generally secret, so most targets have no knowledge they are under surveillance. All three pieces of legislation have an oversight mechanism in terms of oversight bodies who have access to secret warrants and are supposed to ensure that they are being used appropriately.

pembrook 2y ago

Exactly, compliance is currently impossible since this is a geopolitical spat between the US and EU over US law. The goalposts on this move every 6 months, so the fines are easy money for the EU. The companies are just collateral damage. For some reason HN is full of people who don’t actually understand this issue but feel very emotionally passionate that all US tech companies are evil and doing this on purpose. “Just follow the law, you evil companies!” Lol. They would if there was a clear law/process to follow that didn’t get shot down every few months. As it stands, you cannot operate in the EU as a US company if you want to be totally immune from fines. I urge you to talk to your government representatives (on both sides of the pond) if you care about this issue. This benefits nobody except for EU government coffers.

Vinnl 2y ago
> feel very emotionally passionate that all US tech companies are evil and doing this on purpose. Oh no, it's the US government that claims authority to use these companies to surveil EU citizens that is the problem here. One that, unfortunately, does affect all US companies.
pyrale 2y ago
> Lol. They would if there was a clear law/process to follow that didn’t get shot down every few months. There isn't a process because US law makes it clear that US companies should be auxiliary to illegal acts abroad. And we find out every few months, that even when they aren't forced to, they disregard the law. Sure, maybe they're not "evil", but they apparently can't find a way to be law-abiding entities.

judge2020 2y ago

> The only "safe" option without any uncertainty seems to be architect every system so that data never transits to the US and is also never in the custody of a subsidiary of a US-domiciled corporate parent. If i'm not mistaken, because of this (via[0]) > The CLOUD Act primarily amends the Stored Communications Act (SCA) of 1986 to allow federal law enforcement to compel U.S.-based technology companies via warrant or subpoena to provide requested data stored on servers regardless of whether the data are stored in the U.S. or on foreign soil. It sounds like compliance is only possible* if "the US company doesn't have any influence on the EU data-holding company" which is insane. This might be satisfied if the US company simply licenses their software product (e.g. the Uber backend) to an EU company. But this might not be adequate since chances are updates would be somewhat automated, and thus the US-based Uber might be compelled by the government to ship malware with their update to catch some US criminal (or otherwise enact some US spying). * edit: only possible in lieu of a data agreement like Privacy Shield or its successor as mentioned above 0: top comment on https://news.ycombinator.com/item?id=33561222 https://news.ycombinator.com/item?id=33561222

6510 2y ago
> catch some US criminal https://en.wikipedia.org/wiki/CIA_black_sites https://en.wikipedia.org/wiki/CIA_black_sites
marcosdumay 2y ago
> which is insane It's completely sane from the EU's point of view. Why would they submit their citizens to forceful government eavesdrop? I do agree it's insane. But the insanity is not on the GDPR.
- blackeyeblitzar 2y ago
  You mean like the EU governments? Which country / countries have fundamental protections for free speech and censorship free social media? Which are seeking to force encryption backdoors?
jeroenhd 2y ago
It's true, the extensive surveillance capabilities the American government demands from American businesses is one of the reasons American companies cannot enter the European market. I doubt this will change any time soon. The GDPR isn't going away, and the USA isn't known for loosening their data collection laws. Maybe in a few years the EU can find a legal ground to allow the USA to spy on EU citizens without acceptable legal defences, maybe the USA will give up their capability to use American businesses as a tool to spy on the EU, but for now surveillance law is a major roadblock for American companies expanding to Europe.

MyFedora 2y ago

No, the EC asked ChatGPT to rewrite the Privacy Shield but give it another name, and the CJEU is expected to retroactively invalidate the law again. This will only change if the US provides essentially equivalent privacy protection laws, which they don't.