EU And Japan Agree To Free Data Flows, Just As Tottering Privacy Shield Framework Threatens Transatlantic Transfers

from the cooperation-not-confrontation dept

The EU's strong data protection laws affect not only how personal data is handled within the European Union, but also where it can flow to. Under the GDPR, just as was the case with the preceding EU data protection directive, the personal data of EU citizens can only be sent to countries whose privacy laws meet the standard of "essential equivalence". That is, there may be differences in detail, but the overall effect has to be similar to the GDPR, something established as part of what is called an "adequacy decision". Just such an adequacy ruling by the European Commission has been agreed in favor of Japan:

This mutual adequacy arrangement will create the world's largest area of safe transfers of data based on a high level of protection for personal data. Europeans will benefit from strong protection of their personal data in line with EU privacy standards when their data is transferred to Japan. This arrangement will also complement the EU-Japan Economic Partnership Agreement, European companies will benefit from uninhibited flow of data with this key commercial partner, as well as from privileged access to the 127 million Japanese consumers. With this agreement, the EU and Japan affirm that, in the digital era, promoting high privacy standards and facilitating international trade go hand in hand. Under the GDPR, an adequacy decision is the most straightforward way to ensure secure and stable data flows.

Before the European Commission formally adopts the latest adequacy decision, Japan has agreed to tighten up certain aspects of its data protection laws by implementing the following:

A set of rules providing individuals in the EU whose personal data are transferred to Japan, with additional safeguards that will bridge several differences between the two data protection systems. These additional safeguards will strengthen, for example, the protection of sensitive data, the conditions under which EU data can be further transferred from Japan to another third country, the exercise of individual rights to access and rectification. These rules will be binding on Japanese companies importing data from the EU and enforceable by the Japanese independent data protection authority (PPC) and courts.

A complaint-handling mechanism to investigate and resolve complaints from Europeans regarding access to their data by Japanese public authorities. This new mechanism will be administered and supervised by the Japanese independent data protection authority.

It is precisely these areas that are proving so problematic for the data flow agreement between the EU and the US, known as the Privacy Shield framework. As Techdirt has reported, the European Commission is under increasing pressure to suspend Privacy Shield unless the US implements it fully -- something it has failed to do so far, despite repeated EU requests. Granting adequacy to Japan is an effective way to flag up that other major economies don't have any problems with the GDPR, and that the EU can turn its attention elsewhere if the US refuses to comply with the terms of the Privacy Shield agreement.

The new data deal with Japan still has several hurdles to overcome before it goes into effect. For example, the European Data Protection Board, the EU body in charge of applying the GDPR, must give its view on the adequacy ruling, as must the civil liberties committee of the European Parliament -- the one that has just called for Privacy Shield to be halted. Nonetheless, the European Commission will be keen to adopt the adequacy decision, not least to show that countries are still willing to reduce trade barriers, rather than to impose them, as the US is currently doing.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: data flows, eu, japan, privacy, privacy shield, surveillance, us

Yahoo Email Scanning May Sink EU Privacy Shield Agreement

from the nsa-fucking-things-up-again dept

After the US/EU "safe harbor" on data protection was tossed out thanks to NSA spying being incompatible with EU rights, everyone had tried to patch things up with the so-called "Privacy Shield." As we noted at the time, as long as the NSA's mass surveillance remained in place, the Privacy Shield agreement would fail as well. This wasn't that difficult to predict.

And there are already some challenges to the Privacy Shield underway, including by Max Schrems, who brought the original challenge that invalidated the old safe harbor. But things may have accelerated a bit this week with the story of Yahoo scanning all emails. This news has woken up a bunch of EU politicians and data protection officials, leading to some serious questions about whether it violates the Privacy Shield agreement.

Johannes Kleis, a spokesman with BEUC, an umbrella group for European consumer organisations, called on other EU data protection authorities to investigate Yahoo.

Fabio de Masi, a German member of the European parliament with the leftist Die Linke party called on the EU high representative for external affairs Federica Mogherini to seek clarification from US authorities about the treatment of EU data.

And elsewhere as well:

"It goes far beyond what is acceptable," said Johannes Caspar, Commissioner for Data Protection and Freedom of Information in Hamburg, Germany.

Over in the European Parliament, Dutch MEP Sophie in 't Veld has asked the EU Commission to investigate: While some keep arguing that the whole idea of a safe harbor or privacy shield is a problem, that's not really true. Enabling more easy data flows between countries on a borderless internet is really important for keeping the internet really global. This is a serious issue. The problem is the NSA's surveillance activities undermining all of this, and continually (rightfully) freaking out people in other countries about what happens to data that flows into the US. The answer is not to dump agreements that enable the free flow of data, but to stop mass surveillance activities.

Once again, it appears that overly aggressive mass surveillance by the US intelligence community is creating massive headaches for American internet companies.

Filed Under: data flows, data protection, eu, mass surveillance, nsa, privacy shield, us
Companies: yahoo

Think Tank Who Proposed SOPA Now Argues That US Should Encourage Countries To Censor The Pirate Bay

from the censorship dept

On Tuesday, the House Judiciary Committee held a hearing on what sounds like a boring topic: "International Data Flows: Promoting Digital Trade in the 21st Century." However, as we've discussed, this seemingly boring topic can have a profound impact on how the internet functions, and whether it remains a global platform for free expression -- or becomes a fragmented system used for widespread censorship, surveillance and control. In other words this is important.

The hearing was mostly pretty bland (as Congressional hearings tend to be), but at one point, Robert Atkinson, the President of the Information Technology and Innovation Foundation (ITIF) argued that the US should be encouraging global censorship if it's for sites like The Pirate Bay. You can watch the portion of the video below (it should start at the right moment, but if not, jump to 1 hour, 27 minutes and 40 seconds): It starts with Rep. Jerry Nadler reading a question someone else clearly prepared for him, directed at Atkinson about how to handle situations in which different countries have different laws regarding free speech and content, and what that should mean for "data flows" across borders. In short, this is a question about "what should we do with countries who want to censor the internet -- and should we allow that sort of thing." Atkinson's answer is a bit rambling, but he basically starts off by saying that we'll never agree with some other countries on free speech and such... but then says no matter what, one thing we should all agree on is that it's good to censor sites like the Pirate Bay and the US should encourage such blatant censorship worldwide:

I think it's an untenable project that we would end up with "global harmony" on every single rule with regard to the internet. We're not going to be able to do that. And we're certainly not going to be able to do that with free speech. There are certain countries, particularly more traditional, religious countries that find pornography objectionable. We don't with our... or at least we have free speech, we may find it objectionable, but we allow it. We're not going to agree on that. And for certain things like that, countries are going to do that and I think we just have to be okay with that.

Another example is in Germany, you're not allowed to download a copy of Mein Kampf. In the US, we can. Again, we're not going to change the German view. I don't know if they're right or wrong. It doesn't make any difference.

Where we can and should, though, take action, is there are some things that are clearly illegal under the WTO framework for intellectual property, for example piracy and intellectual property theft can be prosecuted. So when countries engage in steps, for example, to block certain websites that are clear piracy sites -- like, for example, a web or a domain called "the pirate bay" that should be quite... you know we should be encouraging that. That's quite different than blocking, say, Facebook or something like that, or blocking some site just because you don't want competition.

Where to start? Well, how about I let Atkinson debunk Atkinson. In the question immediately preceding this one about blocking websites, Nadler had asked Atkinson about backdooring encryption. And there, Atkinson gave a much better answer, noting that it was a terrible idea (he's right!), but then notes:

If they try to mandate that, they're setting a dangerous precedent, for example, by letting the Chinese government do the exact same thing.

Uh. Yeah. And having the US government "encourage" censoring websites also sets a dangerous precedent by letting the Chinese government (and lots of other governments) point to the US as doing the same thing they do. But, as Atkinson and other copyright system supporters will undoubtedly scream, "that's different -- this is about copyright, not censorship." Yeah, well, you're not paying attention if you don't recognize how copyright is used for political censorship as well. Remember how Russia was using copyright law to intimidate its critics? What you might not remember is that when China first set up its massive online censorship system, known as the Great Firewall of China, one of its key justifications to the outside world was that it would be used to stop piracy online. And, of course, during the big SOPA/PIPA fight, the Chinese were laughing at those of us in America who whined about their Great Firewall, while we were debating a proposal to set up an identical system.

Of course, it's no surprise that Atkinson is making this argument. The organization he runs, ITIF, is frequently credited with first proposing the ideas behind SOPA in a white paper that came out right before the SOPA push. And ITIF famously argued in favor of SOPA by pointing to authoritarian countries who censor the internet as proof that SOPA wasn't that harmful. Yes, Atkinson's own firm suggested that the US should emulate China, Saudi Arabia, Iran, Syria and a number of other countries in censoring the internet. But, you know, "just for copyright."

And this doesn't even get to the issue of Atkinson's assured statement that certain sites are "clear piracy sites." Except, as we've noted over and over again, almost every great innovation around content delivery was decried as a "tool for piracy" originally. Radio, TV, cable TV, the photocopier, the VCR, the DVR, the mp3 player and YouTube and similar sites were all attacked as piracy tools originally. And yet every one of them actually opened up new and important arenas for content creation, distribution and monetization. What looks like a piracy tool in the early days often becomes a massive and legitimate business opportunity soon after (again: it was just four years after the MPAA's Jack Valenti declared VCR's the "Boston Strangler" to the film industry that home video revenues surpassed box office revenues).

Either way, what Atkinson was saying here is both shocking and dangerous. He's outright advocating a censorship regime based on his belief of what is and is not appropriate -- and suggesting that the US should "encourage" other countries to censor the web without legal due process, without consideration for innovation, because he has decided which sites are bad. At the end he says that blocking The Pirate Bay is not like blocking Facebook. Yet, there are many people who argue that Facebook is, similarly, a giant piracy site. Whose definition is right in that context? And the same question can be asked about YouTube. Viacom sued YouTube claiming that it was just as bad as the Pirate Bay. Would Atkinson support countries blocking all access to YouTube "under the WTO"?

There is a rather astounding level of cognitive dissonance that some people, such as Atkinson have, around issues related to copyright and censorship. They assume, incorrectly, that copyright is some magical fairy tale world where it's never used for censorship, and thus it's fine to block "bad sites" where people like Atkinson get to decide what is and what is not bad. But all he's doing is encouraging internet censorship, and giving massive amounts of cover to authoritarian regimes who want to censor the internet for all sorts of reasons. They can easily take Atkinson's claims that we must encourage censorship over copyright and either abuse copyright for that purpose, or even just twist it slightly to note "well, blocking infringement is important to the US, and we feel the same way about political unrest."

Atkinson's ITIF lost its battle for SOPA nearly four years ago. It shouldn't try to reintroduce the idea of a global platform for internet censorship today.

Filed Under: censorship, congress, copyright, data flows, digita trade, free flow of information, free speech, judiciary committee, jurisdiction, robert atkinson, safe harbor, sopa
Companies: itif