Top EU Data Protection Body Asks US To Fix Problems Of 'Privacy Shield' Or Expect A Referral To Region's Highest Court

from the please-don't-make-us-do-this dept

The Privacy Shield framework is key to allowing personal data to flow legally across the Atlantic from the EU to the US. As we've noted several times this year, there are a number of reasons to think that the EU's highest court, the Court of Justice of the European Union (CJEU), could reject Privacy Shield just as it threw out its predecessor, the Safe Harbor agreement. An obscure but influential advisory group of EU data protection officials has just issued its first annual review of Privacy Shield (pdf). Despite its polite, bureaucratic language, it's clear that the privacy experts are not happy with the lack of progress in dealing with problems pointed out by them previously. As the "Article 29 Data Protection Working Party" -- the WP29 for short -- explains:

Based on the concerns elaborated in its previous opinions ... the WP29 focused on the assessment of both the commercial aspects of the Privacy Shield and on the government access to personal data transferred from the EU for the purposes of Law Enforcement and National Security, including the legal remedies available to EU citizens. The WP29, assessed whether these concerns have been solved and also whether the safeguards provided under the EU-U.S. Privacy Shield are workable and effective.

As far as the commercial aspects of Privacy Shield are concerned, the WP29 is unhappy about a number of important "unresolved" issues such as "the lack of guidance and clear information on, for example, the principles of the Privacy Shield, on onward transfers [of personal data] and on the rights and available recourse and remedies for data subjects." The issue of US government access to the personal data of EU citizens is even thornier. Although the WP29 welcomed efforts by the US government to become more "transparent on their use of their surveillance powers", the collection of and access to personal data for national security purposes under both section 702 of FISA and Executive Order 12333 were still a problem. On the former, WP29 suggests:

Instead of authorizing surveillance programs, section 702 should provide for precise targeting, along with the use of the criteria such as that of "reasonable suspicion", to determine whether an individual or a group should be a target of surveillance, subject to stricter scrutiny of individual targets by an independent authority ex-ante.

As regards the Executive Order 12333, WP29 wants the Privacy and Civil Liberties Oversight Board (PCLOB) "to finish and issue its awaited report on EO 12333 to provide information on the concrete operation of this Executive Order and on its necessity and proportionality with regard to interferences brought to data protection in this context." That's likely to be a bit tricky, because the PCLOB is understaffed due to unfilled vacancies, and possibly moribund. In conclusion, the WP29 "acknowledges the progress of the Privacy Shield in comparison with the invalidated Safe Harbor Decision", but underlines that the EU group has "identified a number of significant concerns that need to be addressed by both the [European] Commission and the U.S. authorities." It spells out what will happen if they aren't sorted out:

In case no remedy is brought to the concerns of the WP29 in the given time frames, the members of WP29 will take appropriate action, including bringing the Privacy Shield Adequacy decision to national courts for them to make a reference to the CJEU for a preliminary ruling.

That is, it will ask the EU's highest court to rule on the so-called "adequacy decision" of the European Commission, where it decided that Privacy Shield offered enough protection for EU personal data moving to the US. There's a clear implication that WP29 doubts the CJEU's ruling will be favorable unless all the changes it has requested are made soon. And without the Privacy Shield framework, it will be much harder to transfer personal data legally across the Atlantic. Moreover, the EU's data protection laws are about to become even more stringent next year, when the new General Data Protection Regulation (GDPR) is enforced. Organizations in breach of the GDPR can be fined up to 4% of annual global turnover, which means even the biggest Internet companies will have a strong incentive to comply.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: eu, executive order 12333, privacy, privacy shield, safe harbor, section 702, surveillance

As Expected, EU Court Of Justice To Review If Internet Company's Privacy Practices Are Acceptible

from the here-we-go dept

The European Court of Justice is going to look into the acceptability of US internet company's privacy practices under the so-called "Privacy Shield" framework that was put in place last year. As you may recall, for years, the EU and the US had a "safe harbor" agreement, under which tech companies underwent a fairly silly and almost entirely pointless process (I know, because we did it ourselves...) by which the companies effectively promised to live up to the EU's data protection rules, in order to move data from servers in the EU across the Atlantic to the US. It is important that companies be allowed to do this, because without it, the internet doesn't function all that well. But, because of NSA snooping, it became clear that what companies were promising couldn't match what was actually happening. And thus, the EU Court of Justice tossed out the framework, saying that it violated EU data protection rules.

After a bit of a scramble, the EU and the US came to an agreement on another framework, called the "Privacy Shield" that both argued was acceptable. It required US companies to do better in handling Europeans' data, to make sure EU residents had redress over data protection and included some transparency requirements regarding US government access to the data. However, as we noted at the time, unless the US was drastically changing how the NSA did surveillance, it seemed nearly impossible for the Privacy Shield to be valid under EU law. And, indeed, Max Schrems, the guy whose lawsuit brought down the original "safe harbor" quickly challenged the Privacy Shield in an Irish court. Over the past few months, we've pointed out that some of Trump's statements on surveillance made it clear that the Privacy Shield was not likely to survive.

Earlier this week, the Irish court asked the European Court of Justice to review. The ruling is long (over 150 pages) and pretty detailed. The court clearly recognizes how important this issue is:

The case raises issues of very major, indeed fundamental, concern to millions of people within the European Union and beyond. Firstly, it is relevant to the data protection rights of millions of residents of the European Union. Secondly, it has implications for billions of euros worth of trade between the EU and the US and, potentially, the EU and other non-EU countries. It also has potentially extremely significant implications for the safety and security of residents within the European Union. There is considerable interest in the outcome of these proceedings by any parties having a very real interest in the issues at stake.

The court hasn't yet officially asked the CJEU to weigh in, but rather has said that it will -- but first it wants the parties involved in the case to more or less argue about what exactly should be the questions submitted to the CJEU.

Most of the ruling itself is basically around whether or not there's anything to discuss here at all. Facebook -- the service whose privacy practices are at issue in this particular case -- tried to argue that because surveillance issues are "national security" and there's a carve out for national security, there's no issue with the Privacy Shield But the court doesn't buy that. First, it says that the issue under scrutiny is about the relationship between the EU and its member states (and how the data protection rules work) rather than a question about "national security" in the US. Similarly, it points to the original Schrems ruling that got the old safe harbor tossed out and notes that no one had a problem with saying the law applied in that case:

The submission is inconsistent with the ruling of the High Court in Schrems v. The Data Protection Commissioner [2014] 3 I.R. 75 and the CJEU in Schrems where the court proceeded on the basis that it had jurisdiction to rule on the reference. If Facebook’s submission in this case is correct, it did not have jurisdiction so to proceed. Eight Member States, the European Parliament, the European Commission and the European Data Protection Supervisor intervened in those proceedings. If Facebook’s point was well made, it is remarkable that none of these participants raised this fundamental matter of jurisdiction.

So, there's still time before the CJEU will sort this out, but we stand by our initial statement. Unless the US changes its NSA surveillance practices, it's difficult to see how the Privacy Shield comes to an end any different than the old privacy safe harbors. If the US doesn't want to have the Privacy Shield rejected again, it might want to start by reforming surveillance -- and it can do that right away in refusing to renew Section 702 of the FISA Amendments Act without significant reform and modifications.

Filed Under: cjeu, data protection, max schrems, nsa, privacy shield, surveillance
Companies: facebook

All Quiet On The Tech Front As The Clock Ticks Down On Section 702 Renewal

from the a-little-help? dept

Things have been mostly quiet as Congress heads towards the possible renewal of Section 702 surveillance powers. The NSA, oddly, made the most noise by dropping its "about" collection because it simply couldn't (or wouldn't) stop harvesting US persons' communications. As usual, privacy activists are sounding the alarm but the general level of noise at the Congressional level is nothing compared to the runup to Section 215's renewal.

Quieter is better for the Trump administration, which has already expressed its desire for a clean reauthorization. There are plenty of surveillance hawks who would rather no one messed with the approval process and a few of those have the power to stonewall any legislative reforms that might make their way to the House or Senate in the coming months.

But the noisiest silence is emanating from the tech sector, whose platforms and services are integral to the NSA's harvesting of internet communications and data.

Facebook, Alphabet's Google, Apple and other major technology firms are largely absent from a debate over the renewal of a broad U.S. internet surveillance law, weakening prospects for privacy reforms that would further protect customer data, according to sources familiar with the matter.

While tech companies often lobby Washington on privacy issues, the major firms have been hesitant to enter a fray over a controversial portion of the Foreign Intelligence Surveillance Act (FISA), industry lobbyists, congressional aides and civil liberties advocates said.

Some of this could be due to the fact that some surveillance activities happen without any direct assistance from these companies. The NSA also pulls communications from internet backbones and taps on transatlantic cables. Speaking up against this surveillance may subject companies to additional demands, rather than allow them to go comparatively unmolested.

Other contributing factors are mostly business-related. Interfering with collections (or their authority) may make the worldwide transmission of internet communications a bit more hazardous, especially if the NSA's collections run afoul of foreign privacy laws.

The companies' relative inactivity is explained by several legal challenges in Europe to an agreement between the United States and the European Union, known as the Privacy Shield, the sources said. The litigation hinges on whether U.S. surveillance practices afford enough privacy safeguards. A coalition of human rights organizations has urged Europe to suspend Privacy Shield unless Section 702 is substantially reformed.

U.S. technology companies have privately bristled at those efforts, three industry lobbyists [said], in part because expectations that 702 reforms will pass Congress are low.

"If you link them and you lose one, you lose both," said one of the lobbyists, who like the others requested anonymity to discuss private conversations with technology companies.

Rather than step into the fight, tech companies are on the sideline, holding their collective breaths. The chances of serious reform are minimal, what with the President preferring a clean re-auth. If the European Union decides the United States isn't taking foreigners' privacy seriously, it may act to block collections by booting American tech companies out or requiring sequestered servers that can't be reached by American surveillance efforts.

Obviously, neither outcome works for the NSA either. It needs as much cooperation as possible from foreign partners in order to elude privacy protections the US extends to other nations' citizens. Casting its net in international waters muddies jurisdictions, as do information-routing efforts like Google's that send communications from server to server based on efficiency, rather than country of origin. Relying on foreign intelligence agencies' intercepts also helps both partners evade local restrictions.

The Fortune article also notes there's a distinct lack of clarity to the Section 702 debate at this point, one that doesn't encourage any company to open its mouth when there's billions of dollars of services on the line. Some privacy activists hope this changes as the debate moves forward, but considering the programs aren't directly affecting Americans (unlike Section 230's domestic collections), it's a harder sell. No one is asking for the collections authorized by this statute to be shut down completely. Even ardent privacy activists admit the programs are more targeted and more respectful of Americans' privacy. The problems lie in its oversight, of which there is very little, and other authorities (Executive Order 12333, for one) that aren't open to debate or periodic renewals.

Despite these possible explanations, the silence isn't exactly heartening. Tech companies made plenty of noise when the Snowden leaks hit, exposing multiple programs that gathered communications from international cables and service providers. But they've said little since, at least in terms of Section 702 programs. Many are fighting for users' privacy in court, but those efforts deal with demands from law enforcement, rather than surveillance programs that bypass regular courts completely. If the level of noise doesn't increase in the next few months, it will probably be safe to assume the companies are more interested in salvaging European relationships than possibly upsetting the NSA's Section 702 apple cart.

Filed Under: nsa, privacy shield, section 702, surveillance, tech

Mounting Privacy Problems In Europe For Facebook's Acquisition Of WhatsApp

from the statement-of-objections dept

When it comes to online privacy, the European data protection authorities tend to be quite interventionist as they try to police the movement of personal data within and out of the EU. The concerns over the Safe Harbor and Privacy Shield frameworks are one manifestation of this. Another is the increasing EU scrutiny of Facebook's purchase of WhatsApp.

A couple of years after Facebook acquired WhatsApp, the latter announced that it was updating its terms and privacy policy so as to allow user data to be transferred to its parent company. Johannes Caspar, the Commissioner for Data Protection and Freedom of Information in Hamburg, where Facebook has its German headquarters, was unhappy with that move. He saw it as harmful to users' privacy, not least because there was no way to opt out of the data sharing. In September last year, he ordered Facebook to stop collecting data from WhatsApp, and to delete anything it had already brought across. Facebook appealed against the decision, and the Administrative Court of Hamburg has now handed down its ruling, which is to deny the US giant's request for Caspar's order to be revoked (pdf):

Facebook has appealed to the administrative court against the order in the preliminary proceedings. The goal was to repeal the immediate enforcement. The court rejected this request today and clarified the fact that it does not see any legal basis for the planned data exchange. Facebook can not invoke interests of its own business because the complete data exchange is neither necessary for the purpose of network security or business analysis nor for advertising optimization. Furthermore, the court clarifies that there is no effective consent from WhatsApp users for a data exchange with Facebook. As a result, the administrative court is making a clear consideration in the context of the preliminary legal proceedings: the interests of the approximately 35 million German WhatsApp users predominates the economic interest of Facebook in a suspension of immediate enforceability.

That's not the only problem Facebook faces in Europe. A little while after WhatsApp announced that it would be consolidating its user data with Facebook, the European Commission sent what is called a "Statement of Objections" to Facebook, alleging that:

the company provided incorrect or misleading information during the Commission's 2014 investigation under the EU Merger Regulation of Facebook's planned acquisition of WhatsApp.

The problem is that:

When reviewing Facebook's planned acquisition of WhatsApp, the Commission looked, among other elements, at the possibility of Facebook matching its users' accounts with WhatsApp users' accounts. In its notification of the transaction in August 2014 and in a reply to a request of information, Facebook indicated to the Commission that it would be unable to establish reliable automated matching between the two companies' user accounts.

Once WhatsApp and Facebook started carrying out precisely that kind of automated data matching last year, the Commission naturally wondered whether Facebook had been totally frank in its answers. The company had until January 31 to explain itself, and the Commission is now deciding whether it feels it was given misleading information. If it does, the consequences may be quite costly. Under EU law, Facebook could be fined 1% of its global turnover -- which would amount to around $179 million based on 2015 revenues. On its own, that probably wouldn't be too much of a problem for the deep-pocketed company. But combined with the ruling in Germany, and the possibility that data protection authorities in other countries will follow suit -- the law is the same throughout the EU, after all -- these European concerns about privacy are turning into a major a headache for Facebook.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: data protection, data sharing, eu, germany, privacy, privacy shield
Companies: facebook, whatsapp

Civil Liberties Groups Point Out More Reasons Why The 'Privacy Shield' Framework For Transatlantic Data Flows Is At Risk

from the much-more-serious-than-it-looks dept

Earlier this year, we wrote about growing concerns that President Trump's executive order stripping those who are not US citizens of certain rights under the Privacy Act could have major consequences for transatlantic data flows. Now two leading civil liberties groups -- the American Civil Liberties Union (ACLU) and Human Rights Watch (HRW) -- have sent a joint letter to the EU's Commissioner for Justice, Consumers and Gender Equality, and other leading members of the European Commission and Parliament, urging the EU to re-examine the Privacy Shield agreement, which regulates transatlantic data flows, as well as the US-EU umbrella agreement, a data protection framework for EU-US law enforcement cooperation. The joint letter calls on European politicians to take into account what the ACLU and HRW delicately term "changed circumstances" -- essentially, the arrival of Donald Trump and his new agenda.

The first worry concerns the Executive Order that excluded foreigners from privacy protections. The joint letter goes into more detail about why other laws, for example, the Judicial Redress Act, are not an adequate replacement for those protections. The ACLU and HRW also raise another issue: the lack of a functioning Privacy and Civil Liberties Oversight Board (PCLOB). That matters, because the Court of Justice of the European Union (CJEU) said oversight was needed to ensure that EU data receives appropriate privacy and other fundamental rights protections when it is exported to other countries. The joint letter explains why effective US oversight and redress mechanisms are absent:

The Privacy and Civil Liberties Oversight Board, while fulfilling a valuable public reporting role, is limited in its oversight function and was not designed to provide redress concerning US surveillance practices. Thus, the PCLOB has never provided remedies for rights violations or functioned as a sufficient mechanism to protect personal data. In recent months, the situation has worsened: the PCLOB currently lacks a quorum, which strips its ability to issue public reports and recommendations, make basic staffing decisions, assist the Ombudsman created by the Privacy Shield framework, and conduct other routine business as part of its oversight responsibilities. The current administration and Senate have yet to act to fill the vacancies on the PCLOB.

Some might dismiss the letter as troublemakers stirring things up over nothing. But the Privacy Shield framework is crucial if data flows across the Atlantic are to continue as at present. Without it, or some replacement, US companies will find it much harder to move personal data out of the EU. If they do so without adequate legal safeguards, oversight and redress mechanisms in the US, they are likely to be fined by data protection officials across Europe, who are always happy to make high-profile examples of erring companies in order to encourage everyone else to comply with EU law.

Protecting the privacy of Europeans and filling vacant seats on the Privacy and Civil Liberties Oversight Board are probably not priorities for the Trump administration as it settles in and grapples with multiple issues. But the European Commission has to take demands to revisit and possibly suspend Privacy Shield seriously. If the EU decides to drop the framework, as it has just threatened to do if there is a "significant change" in the US approach to EU privacy, then the consequences for US companies are likely to be so serious that even an over-stretched Trump administration will need to start paying attention.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: civil liberties, privacy shield, surveillance

Already Under Attack In Top EU Court, Privacy Shield Framework For Transatlantic Data Flows Further Undermined By Trump

from the you're-not-really-helping-things,-Donald dept

A year ago, Techdirt wrote about the melodramatically-named "Privacy Shield." Under EU data protection laws, the transfer of EU citizens' personal data is only legal if the destination country meets certain basic conditions for data protection. Signing up to Privacy Shield is designed to allow US companies to meet that requirement. The earlier framework, called "Safe Harbor," was thrown out by the EU's highest court, the Court of Justice of the European Union (CJEU), largely because of NSA spying on data flows. Privacy Shield was hurriedly cobbled together because, without it, the vast flows of data across the Atlantic that occur all the time would be much harder to square with EU laws.

However, since the NSA has not stopped spying on data flows, some in the EU feel that Privacy Shield offers as little protection for personal data as Safe Harbor. This led the Irish civil liberties group Digital Rights Ireland (DRI) last October to ask the EU's General Court -- one of the more obscure courts of the CJEU -- to annul the Privacy Shield framework, arguing that it too lacks adequate privacy protections. Although there are still some procedural matters to be settled first, largely to do with whether DRI has standing to bring this legal action, the case is considered a serious enough challenge to the Privacy Shield framework that the US government is getting involved directly:

The US government has applied to be an intervening party in a challenge by Irish privacy campaign group Digital Rights Ireland against the Privacy Shield transatlantic data transfer pact.

As the article from the Irish Times explains, the US is not alone: also keen to see the framework upheld are the British, Dutch, and French governments, as well as Microsoft and the Business Software Alliance, all of whom have applied separately to join the action. DRI's basic argument is the following:

In questioning Privacy Shield's adequacy, it says its provisions are not actually fixed in US law. The privacy group will also argue that the agreement neither adequately addresses the court's specific objections to Safe Harbour, nor protects citizens' rights provided for under the EU Charter of Fundamental Rights and by the general principles of EU law.

The DRI's case may have just received a boost from an unusual quarter. As Techdirt reported, the President of the United States has signed an executive order that strips those who are not US citizens of certain rights under the Privacy Act. A spokeswoman for the European Commission told TechCrunch that Privacy Shield "does not rely on the protections under the US Privacy Act." But Jan Philipp Albrecht, a Member of the European Parliament, and the leading expert on data protection regulation there, is not so sure that the framework will escape unscathed. He wrote in a tweet that:

If this is true [about the stripping of privacy protections] @EU_Commission has to immediately suspend #PrivacyShield & sanction the US for breaking EU-US umbrella agreement.

The "EU-US umbrella agreement" refers to another recently-agreed deal that puts in place a comprehensive high-level data protection framework for EU-US law enforcement cooperation. The long thread that follows Albrecht's tweet explores to what extent the Privacy Shield framework is likely to be impacted by the new executive order. There's no clear consensus yet on that. But one thing is for sure: the general thrust of Trump's order probably indicates a broader shift in policy that makes it more likely that the CJEU will strike down Privacy Shield just as it struck down Safe Harbor.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: donald trump, eu, privacy, privacy act, privacy shield, safe harbors, us

Yahoo Email Scanning May Sink EU Privacy Shield Agreement

from the nsa-fucking-things-up-again dept

After the US/EU "safe harbor" on data protection was tossed out thanks to NSA spying being incompatible with EU rights, everyone had tried to patch things up with the so-called "Privacy Shield." As we noted at the time, as long as the NSA's mass surveillance remained in place, the Privacy Shield agreement would fail as well. This wasn't that difficult to predict.

And there are already some challenges to the Privacy Shield underway, including by Max Schrems, who brought the original challenge that invalidated the old safe harbor. But things may have accelerated a bit this week with the story of Yahoo scanning all emails. This news has woken up a bunch of EU politicians and data protection officials, leading to some serious questions about whether it violates the Privacy Shield agreement.

Johannes Kleis, a spokesman with BEUC, an umbrella group for European consumer organisations, called on other EU data protection authorities to investigate Yahoo.

Fabio de Masi, a German member of the European parliament with the leftist Die Linke party called on the EU high representative for external affairs Federica Mogherini to seek clarification from US authorities about the treatment of EU data.

And elsewhere as well:

"It goes far beyond what is acceptable," said Johannes Caspar, Commissioner for Data Protection and Freedom of Information in Hamburg, Germany.

Over in the European Parliament, Dutch MEP Sophie in 't Veld has asked the EU Commission to investigate: While some keep arguing that the whole idea of a safe harbor or privacy shield is a problem, that's not really true. Enabling more easy data flows between countries on a borderless internet is really important for keeping the internet really global. This is a serious issue. The problem is the NSA's surveillance activities undermining all of this, and continually (rightfully) freaking out people in other countries about what happens to data that flows into the US. The answer is not to dump agreements that enable the free flow of data, but to stop mass surveillance activities.

Once again, it appears that overly aggressive mass surveillance by the US intelligence community is creating massive headaches for American internet companies.

Filed Under: data flows, data protection, eu, mass surveillance, nsa, privacy shield, us
Companies: yahoo

EU And US Come To 'Agreement' On Safe Harbor, But If It Doesn't Stop Mass Surveillance, It Won't Fly

from the separate-out-the-issues dept

Back in October, we noted that it was a really big deal that the European Court of Justice had said that the EU/US Safe Harbor framework violated data protection rules, because it had become clear that the NSA was scooping up lots of the data. The issue, if you're not aware of it, is that under the safe harbor framework, US internet companies could have European customers and users, with their information and data stored on US servers. Without the safe harbor framework, there are at least some cases where many companies would be forced to set up separate data centers in Europe, and make sure European information is kept there.

Many privacy activists are actually supportive of keeping the data in Europe altogether, but I still think that would be a disaster for lots of internet companies and services -- especially smaller ones. The big guys -- Google, Facebook, Microsoft, Yahoo, Twitter, etc. -- can afford to have separate European data centers. A small company -- like Techdirt -- cannot. Requiring separate data centers and careful separation of the data would ensure less competition and fewer startups to take on the big guys. That's a problem. Beyond that, having those separate data centers could actually lead to even less privacy in the long run, because having many jurisdictions in which data is kept means that, inevitably, some of those jurisdictions will fall into states that have even worse surveillance and fewer data protections -- and also leaves open the opportunity for different data center setups, which may lead to more vulnerabilities. Remember, when the NSA broke into Google and Yahoo's datacenters, they were the ones outside the US, which may have had weaker security. And, despite many Europeans not wishing to believe this, many European countries have many fewer restrictions on the kind of surveillance their intelligence agencies are able to do on local data and citizens.

The real issue here is mass surveillance overall. The only real way to fix this issue is to stop mass surveillance and go back to saying that intelligence agencies and law enforcement need to go back to doing targeted surveillance using warrants and true oversight. But, instead, the EU and the US keep trying to paper over this by coming up with a new agreement. That agreement was supposed to have been concluded by a fake "deadline" set for yesterday, but after missing that and claiming that progress had been made on a new agreement, a new deal was finally announced a few hours ago, with the ridiculous name "The EU-US Privacy Shield."

Here's the key part of the announcement:

• Strong obligations on companies handling Europeans' personal data and robust enforcement: U.S. companies wishing to import personal data from Europe will need to commit to robust obligations on how personal data is processed and individual rights are guaranteed. The Department of Commerce will monitor that companies publish their commitments, which makes them enforceable under U.S. law by the US. Federal Trade Commission. In addition, any company handling human resources data from Europe has to commit to comply with decisions by European DPAs.
  

• Clear safeguards and transparency obligations on U.S. government access: For the first time, the US has given the EU written assurances that the access of public authorities for law enforcement and national security will be subject to clear limitations, safeguards and oversight mechanisms. These exceptions must be used only to the extent necessary and proportionate. The U.S. has ruled out indiscriminate mass surveillance on the personal data transferred to the US under the new arrangement. To regularly monitor the functioning of the arrangement there will be an annual joint review, which will also include the issue of national security access. The European Commission and the U.S. Department of Commerce will conduct the review and invite national intelligence experts from the U.S. and European Data Protection Authorities to it.
  

• Effective protection of EU citizens' rights with several redress possibilities: Any citizen who considers that their data has been misused under the new arrangement will have several redress possibilities. Companies have deadlines to reply to complaints. European DPAs can refer complaints to the Department of Commerce and the Federal Trade Commission. In addition, Alternative Dispute resolution will be free of charge. For complaints on possible access by national intelligence authorities, a new Ombudsperson will be created.

The key thing here? The claim that the US "has ruled out indiscriminate mass surveillance on the personal data transferred to the US." I'm curious about how much bullshit the NSA will be able to sneak under "indiscriminate." I'm also curious as to what kind of real oversight there will be. The EU Commission and the Department of Commerce will be able to review, but we all know how good the NSA is at hiding what it's actually doing from oversight bodies. Finally, the "ombudsperson" only matters if they have actual power, and that seems incredibly unlikely.

And as Max Schrems, who brought the original case that took down the safe harbors, is saying (over and over again), as it stands right now, it looks like this new deal will lose again in the EU courts.

And that brings us back to the underlying point. The effort to kill off the safe harbor agreement wasn't really about the safe harbor agreement at all, but to force the hand of the US government (and hopefully European governments as well) to recognize that they need to stop doing mass surveillance. The claim above about no indiscriminate mass surveillance pays lip service to that idea, but there needs to be some real and concrete change to make that happen. And that's going to take more than an "exchange of letters" between the EU and the US, as the basis of this deal. It's going to need actual surveillance reform, not just the "surveillance reform lite" we saw with the USA FREEDOM Act.

Again, I think having the ability to transfer data from the EU to the US is hugely important -- which not everyone agrees with. Fragmenting the internet by requiring that data stays in certain countries seems as silly to me as geoblocking content. But the underlying issue here is not about where the data is stored -- it's about mass surveillance. Focusing the agreement on how to allow data transfers without actually tackling how to stop mass surveillance is inevitably a fake solution.

Filed Under: data protection, data transfers, eu, mass surveillance, privacy, privacy shield, safe harbor, us