How NSA Surveillance May Result In Fragmenting The Internet: EU Court Leaning Towards Ending 'Privacy Safe Harbor'
from the this-could-be-a-mess dept
If you haven't dealt with it, the "EU-US data protection safe harbor" is somewhat confusing to deal with. The basics, however, are that under an agreement between the US and the EU, if US companies wish to transfer data out of Europe and to American servers, they have to abide by this "safe harbor" process, whereby they agree to take certain steps to keep that data safe and out of prying eyes. The process itself is something of a joke (we at Techdirt have actually gone through it to make sure we weren't violating the law -- though I imagine many small American internet companies don't even know it exists). You basically have to pay a company to declare you in compliance, which in reality often just means that the company reviews your terms of service/privacy policy to make sure it has specific language in it. There have been plenty of (potentially reasonable) complaints out of the EU that the safe harbor process doesn't actually do much to protect Europeans' data. That may be true, but the flipside of it isn't great either. Without the safe harbor framework, it's possible that it would be much more difficult for American internet companies to operate in Europe -- or for Europeans to use American internet companies. Some in Europe may think that's a good idea, until they suddenly can't use large parts of the internet.Either way, the whole safe harbor system has come under attack on a variety of fronts, and it looks close to breaking... all because of the NSA. Max Schrems, who made news back in 2011 by asking Facebook for a copy of all the data it had on him, argued that the NSA's PRISM surveillance program violated EU data protection rules. The European Court of Justice's Advocate General, Yves Bot, has now sided with Schrems and basically said that the NSA surveillance has made the safe harbor process invalid.
The European Court of Justice still needs to come out with its final decision, but it usually (though not always!) agrees with the Advocate General's recommendation. Here, the Advocate General basically says that NSA surveillance has completely undermined the idea that the US can keep Europeans' data safe, and thus the safe harbor cannot stand.
According to the Advocate General, that interference with fundamental rights is contrary to the principle of proportionality, in particular because the surveillance carried out by the United States intelligence services is mass, indiscriminate surveillance. Indeed, the access which the United States intelligence authorities may have to the personal data covers, in a generalised manner, all persons and all means of electronic communication and all the data transferred (including the content of the communications), without any differentiation, limitation or exception according to the objective of general interest pursued. The Advocate General considers that, in those circumstances, a third country cannot in any event be regarded as ensuring an adequate level of protection, and this is all the more so since the safe harbour scheme as defined in the Commission decision does not contain any appropriate guarantees for preventing mass and generalised access to the transferred data. Indeed, no independent authority is able to monitor, in the United States, breaches of the principles for the protection of personal data committed by public actors, such as the United States security agencies, in respect of citizens of the EU.In short, thanks to indiscriminate mass surveillance by the NSA, we may witness a fractured and fragmented internet. That's a big deal.
The EU Commission and the US have been negotiating for a while to change the EU-US Safe Harbor setup anyway, so it's possible that even if the court follows the Advocate General's suggestion, a new, more acceptable, safe harbor process will be put in place. But, in the short term, this could create quite a mess for the internet. Once again, we see how the NSA's actions, which it claims are to "protect" America could end up doing massive economic damage to the internet.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: advocate general, cjeu, data privacy, eu, eu court of justice, eucj, fragmentation, localization, max schrem, nsa, privacy, safe harbor, surveillance
Reader Comments
Subscribe: RSS
View by: Time | Thread
Good.
[ link to this | view in chronology ]
Re: Good.
[ link to this | view in chronology ]
Re: Good.
All the unemployed workers will be in the streets protesting (maybe rioting) to end the NSA.
You will see signs like:
"NSA spying cost me my job"
"Jail all NSA employees"
"NSA: Not Safe America"
They will be breaking into your house to steal your food.
National Security Agency will be disbanded and replaced with the National Soylent Agency tasked with feeding the unemployed.
[ link to this | view in chronology ]
Re: Re: Good.
[ link to this | view in chronology ]
Re: Re: Re: Good.
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Well that's dumb.
Oh yeah. Germany and Britannia want to spy on all of Europe and encrypting everything would defeat that agenda.
And ironically, the UK, a part of Five Eyes will report everything the NSA asks for, making the whole exercise moot.
[ link to this | view in chronology ]
Re: Well that's dumb.
[ link to this | view in chronology ]
Result In Fragmenting The Internet
There will come a time when mankind will think fondly of the past, and the opine the loss of the worldwide community that had once been possible due to a free and open Internet.
[ link to this | view in chronology ]
[ link to this | view in chronology ]
EU jurisidiction over US websites?
Isn't that rather like having to make sure you're in compliance with Chinese law simply because your website can be accessed by people in China?
[ link to this | view in chronology ]
Re: EU jurisidiction over US websites?
It isn't the same harmonizing censorship (such as, you having to adopt the same measures as in China); that harmonizing privacy, that is a Human Right, and it's something that every country should respect.
[ link to this | view in chronology ]
Re: EU jurisidiction over US websites?
If you have an EU data centre then you must ensure that any data maintained outside the EU that was pulled from the EU data centre has the same protections.
Eg Amazon can't keep transactional data in the Netherlands and then move it to the US to do something that would be illegal in the EU.
[ link to this | view in chronology ]
Re: EU jurisidiction over US websites?
Nope. This is a US rule, put in place with the EU, to allow US companies to offer services to EU individuals. So, it's not a European mandate, but a US one (that was done together with the EU).
[ link to this | view in chronology ]
So? What we choose, fragmented internet, Big Brother or maybe, by any chance, putting in place proper and real personal data protection measures and consumer protection laws?
You see, the governments having access to your personal data is bad enough, but your personal data bouncing around different companies and who else (like identity thieves) is way worse.
Apart that their security may leave a lot for complaints, they tend to be quite unscrupulous about what they do (see Volkswagen or GM, corps are bad, no matter where they come from), and it usually has a bigger impact on your life.
Remember Ashley Madison? Or the Sony hack of millions of bank related data and that Sony got away free from that due to the consumer protection laws in California?
Seriously, I agree that we don't want a fragmented internet; but the price given for that isn't right either.
The issue with the personal data isn't if the company uses them for their own purposes (like, for example, directed ads), but what else they do with them, the security involved and what happens if that is broken.
You wouldn't want your data in North Korea even if it broke the internet, would you? Right now, the US is turning more like North Korea regarding respecting people's human rights.
And no, don't look only at the NSA. Is the whole US framework in such matters what it worries me too.
But don't worry. Even if the agreement with EU Commission and the US doesn't bring more "acceptable" safe harbour measures, the TTIP and TiSA agreements will fix all those pesky measures of the europeans wanting their privacy.
[ link to this | view in chronology ]
Re:
I see the internet as already fragmented. The fragmentation could be a lot worse, but it already exists.
[ link to this | view in chronology ]
Mandate encryption
The beauty of such a rule is that it would prompt many companies to simply encrypt everything in-transit and on-server, rather than trying to set up something specific to EU-US. That would be a good thing.
[ link to this | view in chronology ]
Re: Mandate encryption
[ link to this | view in chronology ]
vw cheating with emission was well known for a long time, so the question is why did they brought it up now. Same with this one.
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Tag
[ link to this | view in chronology ]
in america, europeans arent even regarded as humans.
[ link to this | view in chronology ]
Unlike U.S. courts, the European Court of Justice won't trump legal arguments that come before it with an appeal to U.S. security interests.
[ link to this | view in chronology ]