Top EU court overturns US data transfer agreement in Facebook case

https://www.dw.com/en/eu-us-data-transfer-facebook/a-54194377

by tpush • 6 years ago

354 218 6 years ago

hugoroy2• 6 years ago

The judgment is here: https://noyb.eu/files/CJEU/judgment.pdf

Start at page 28 if you want to skip the recap of EU law, or start at page 35 if you want to skip the details of US law and surveillance programs as recap by the Irish court who referred the ruling.

amelius• 6 years ago

MrSchrems, an Austrian national residing in Austria, ...

It's a bit sad that people have to fight this war on personal title.

the_duke2• 6 years ago

Schrems has a history of doing this. [1]

It's mainly odd to me that there aren't more privacy / consumer protection groups doing the same things he does.

[1] https://en.wikipedia.org/wiki/Max_Schrems

icebraining2• 6 years ago

He created an NGO for this purpose, after having successfully sued Facebook: https://noyb.eu/en

But the national data protection commissions of each country also do plenty of work. I think they're still swamped, though.

_gfrc2• 6 years ago

In addition there is a short PR statement available for media use:

https://curia.europa.eu/jcms/upload/docs/application/pdf/202...

hugoroy2• 6 years ago

This is the press release, edited by the services of the court - this is not written by the judges.

pwdisswordfish2• 6 years ago

Start at page 61 if you just want the ruling.

Perhaps this Wikipedia page will be updated soon:

https://en.wikipedia.org/wiki/EU%E2%80%93US_Privacy_Shield

Krasnol• 6 years ago

This was long overdue.

Let's hope they won't come up with a new name just as they did last time when Safe Harbour was abolished.

This thing was an insult to EU privacy laws.

killerpopiller• 6 years ago

after "Safe-Harbor"and it's successor "EU-US Privacy-Shield" I suggest..

the "Trust-PACT"

P - privacy A - acknowledged C - confidentiality T - treaty

It's not only an insult of EU data protection laws and the EU basic rights charta.

Not only are the big US cloud providers evading taxes and stiffling competition in the EU, they are also instrumental to US hegemonial ambitions. All your data (and taxes) belongs to us. That's whats going on.

I wonder how long the standard contractual clauses will hold, I don't see how they are doing better.

di4na• 6 years ago

This judgement also validated SCC. Basically they are ok because they are underpinned by "the receiver country need to have proper privacy protections".

So the SCC is legit. You just can't use it with the US.

geewee5• 6 years ago

This is bad news for everyone in the EU who has data in the US and uses the Privacy Shield act as the protection guarantee. We do that currently for some data processors, and I'm a little intrigued about what we'll do with all of our US-based data now.

arpinum3• 6 years ago

The ruling notes that standard contractual clauses are still available. Most providers offer a Data Processing Agreement that can be signed and amended to the standard contract for businesses in the EU. It then gets muddy though as a DPA needs to be considered against possible legal demands of the US Gov and whether the processor will be forced to comply, assuming the data is stored unencrypted and it is possible to comply.

geewee5• 6 years ago

Yes hopefully it'll just be some extra paperwork.

ThePhysicist4• 6 years ago

You cannot rely on these clauses if they can't be effectively enforced, so I'm doubtful whether they will allow you transferring personal data to the US.

terom3• 6 years ago

Quoting from the press release, the data exporter must take into account both the contractual clauses AND the surveillance laws of the target country. It is not sufficient to rely on a contract with a US data processor where the US surveillance laws do not make it possible for the recipient to comply with that contract.

In those circumstances, the Court specifies that the assessment of that level of protection must take into consideration both the contractual clauses agreed between the data exporter established in the EU and the recipient of the transfer established in the third country concerned and, as regards any access by the public authorities of that third country to the data transferred, the relevant aspects of the legal system of that third country.
[...] that decision imposes an obligation on a data exporter and the recipient of the data to verify, prior to any transfer, whether that level of protection is respected in the third country concerned and that the decision requires the recipient to inform the data exporter of any inability to comply with the standard data protection clauses, the latter then being, in turn, obliged to suspend the transfer of data and/or to terminate the contract with the former.

ThePhysicist4• 6 years ago

I can understand it's bad for companies relying on US services, but honestly this decision is not very surprising and has been looming over EU companies for several years now, so there has been ample time to prepare for it.

On the positive side this might give startups based in the EU a small edge over US competitors (I know, protectionism is evil, free market rules, Europe tech startups are not competitive...).

US companies can still do business in the EU btw, they will just need to structure their services so that data from EU citizens stays within the EU. For the larger players this shouldn't be an issue really, I think, smaller startups with limited resources might forgo the expansion into the EU though.

geewee5• 6 years ago

Worth noting is that the standard contractual clauses don't necessarily specify that the data has to remain within the EU - it just mandates that the company has to provide adequate protections.

AmericanChopper2• 6 years ago

On the positive side this might give startups based in the EU a small edge over US competitors (I know, protectionism is evil, free market rules, Europe tech startups are not competitive...)

Most of these regulations are just anti-US protectionism in disguise. Regardless of the underlying merits of any such regulation, they’re used as trade barriers to give EU companies an edge over US ones, without doing anything as controversial as tariffs. I mean is there any material difference for a German citizen if their surveilled French intelligence over US intelligence? Sure, they have the EU courts to rely on, but if you’re caught up in a foreign (or even domestic) surveillance dragnet the outcome is going to be exactly the same, and there’s nothing you can do about it. All these agencies share huge amounts of data anyway, so the difference becomes quite academic.

US companies can still do business in the EU btw, they will just need to structure their services so that data from EU citizens stays within the EU

I’d suggest people look at all of the privacy enforcement action in the EU, and ask themselves whether they think the actual outcome is protecting the privacy interest of EU citizens, or just the economic interests of member states.

dx0342• 6 years ago

It might be good news for EU consumers. There's no technical reason for most vendors why customer data of EU customers has to be stored in US data centers.

geewee5• 6 years ago

As a consumer I'm all for it - but as a vendor it does make things a little more difficult

tdrp2• 6 years ago

I mean you can store EU users' data on an EU server but if any US users are allowed to communicate/look at EU users then obviously the data is going to travel across the ocean. Maybe I'm reading too much into what constitutes as "personal-data" but last I checked they had broadened that a lot. What happens if I view a EU user's linkedin profile from the US - isn't that all personal data? I hope there's at least an informed consent opt-out for this.

If not, it's not super clear to me what the work-around is other than completely isolating the continents.

woodhull• 6 years ago

We're already running separate US/EU points of presence on AWS.

The trouble is that as a small business we can't afford to have two separate operations teams for the US instance vs. the EU instance. We're all based in North America too and it is not practical for us to hire a whole separate devops team for Europe.

Our US based engineers could in theory be compelled to hand over the data stored at rest in the EU. They could also in theory see PII like names or email addresses in the course of administering the application on their laptops in the US which counts as data export, so would still need Privacy Shield or now SCC to allow engineers to do their everyday work keeping the product up and working.

M2Ys4U4• 6 years ago

This is bad news for everyone in the EU who has data in the US and uses the Privacy Shield act as the protection guarantee.

This ruling was in no way surprising, though. Anyone doing due diligence should have easily seen that Privacy Shield was going to be struck down by the CJEU eventually.

mlang23• 6 years ago

Finally! There is hope for EU, they apparently found some of their balls. Hope they keep 'em.

adamcharnock3• 6 years ago

Hum. I’m in the process of starting up a Wireless ISP in Europe. I was looking at using a large piece of management software provided by a Canadian company, hosted in the US. This is starting to feel like a bit of a bad idea.

I was already unimpressed with their “no one has ever asked us about GDPR” response.

I can totally see an ISP getting heavier regulation in this regard too, given it is providing infrastructure.

Maybe I’ll code it all up myself while I wait for the dedicated fibre to come through.

dx0342• 6 years ago

Any reason why it has to be hosted in the US? Hosting is so standardized, it's hard to argue why it can't be moved to the EU.

adamcharnock3• 6 years ago

It is a SaaS product and I guess that was just what made sense to them at the time.

They say they have a lot of EU customers, but something doesn't add up. Either they don't have a lot of EU customers, or their EU customers are ignoring GDPR, hosting locations, and (in my case) regulations on invoicing software.

Maybe those customers are just saying, "ah, it'll be fine, let's not worry about it." Which probably isn't a bad approach for small companies.

I suppose my choice comes down to: Do I want something off the shelf, slick, a bit expensive, and may or may not screw me in known ways. Or do I want something custom, slow to build, a bit clunkly, can adapt to my needs at the cost of my time, and won't screw me in known ways.

Of course, both may screw me in unknown ways :-)

Anyway, thanks for listening. This is mostly me just thinking this though.

Cthulhu_4• 6 years ago

I'm sure that if you ask nicely you can get a hosted version of said management software; software is not bound to a country of residence.

belorn2• 6 years ago

If you are coding it up yourself I would just host it on any old hardware laying around.

The upgrade path I would use is to grab what ever old gaming pc that the founder already owns. Once everything is up and working, money is coming in, you have customers, then start considering upgrading to an actually dedicated server with redundant power supply and ups. Once that is starting to get old or the company management software has outgrown such setup you have enough data to know what kind of demands you want to apply to a cloud company in terms of reliability, scaling, support and legal.

arpinum3• 6 years ago

I work in a sector with a requirement to keep data out of the US. It is VERY hard to find providers who can promise not to do this. Even when servers exist in the EU, many provider's contracts have clauses that allow transfer to the US, as they have staff there who may access the data.

I can see company legal departments taking this ruling to prohibit transfers, even with a DPA in place, and causing havoc around the EU.

mytailorisrich• 6 years ago

The EU depends too much on the US in this area.

Hopefully this will force more independence and provide a boost to the European providers.

sam_lowry_• 6 years ago

Which area? Hetzner, Leaseweb, OVH and dozens of smaller hosting providers can fill the needs. The only thing US hosting providers have is marketing and easy money.

dgellow3• 6 years ago

I worked on fintech projects in Europe, with German banks as our main clients. Their requirements went as far as refusing any service that would have their support teams (or part of it) located in the US. It was quite challenging to fulfill their demands, and increased the development and maintenance cost by A LOT, but definitely possible.

And once you have a working system and solutions in place that becomes a quite good sale argument.

And yes, the EU is really lacking providers that can follow those requirements. At some point Microsoft had a German cloud completely distinct from their other offering and managed by Telekom, but they stopped a few years ago (and it wasn't really in a production ready state IMHO...).

nix238• 6 years ago

I worked on fintech projects in Europe

I don't see the problem, buy HP Enterprise Hardware (Support is based in Czech Republic), install Suse for example (but not RedHat), ask a Data-center of your wish, place your Hardware there make your own 'cloud'...profit?

oblio• 6 years ago

And if they want to keep data completely out of US Gov hands, as some clients do, it's almost impossible due to the Patriot and Cloud acts.

esperent2• 6 years ago

Sounds like a golden opportunity for someone to set up an EU company that is EU law compliant and start marketing themselves to banks and bodies that need this.

krageon• 6 years ago

It's easy to do, just don't do business with the US at all. Any company that touches it is tainted and should therefore not be trusted. I work in a sector with a similar requirement and it really hasn't been difficult to comply with this requirement, given that you keep this in mind.

Silhouette3• 6 years ago

It's easy to do, just don't do business with the US at all.

Less easy if you need to, for example, accept payment by credit card. Even if some of the businesses along the way are based wherever you are, the major card networks are all headquartered in the US.

It would be great if the international community could get its act together on an alternative and render the deeply flawed card payments industry obsolete, but the fact is that right now cards are the only game in town for a lot of situations.

adventured2• 6 years ago

It's easy to do, just don't do business with the US at all.

That's amusing of course because the EU economy is desperately dependent on the US economy. Meanwhile the US economy is far less dependent on the EU economy.

So the plan then must be to do zero business with the US and Chinese economies, the world's two largest. You also can't do business with Canada, Australia or Britain, so there went another $5.7 trillion in economy you can no longer trade with.

The EU would be sent back to third-world living standards within a decade or two. You just lost access to 50% of the world economy. Easy to do, yeah sure.

throwaway9d0291• 6 years ago

Providers of what? SaaS or servers? As far as I know, none of the budget server providers like OVH, Hetzner and Online.net/Scaleway have a US presence.

acejam• 6 years ago

OVH has two datacenters in the US now: https://us.ovhcloud.com/

rst• 6 years ago

FWIW, this may also mean avoiding US companies altogether -- the CLOUD act (hey, I don't come up with these names...) requires them to surrender data to US authorities on subpoena, even if it's hosted on facilities they own outside US territorial boundaries. https://en.wikipedia.org/wiki/CLOUD_Act

michaelbuckbee• 6 years ago

How do you consider transient data or CDNs like Cloudfront/Cloudflare?

mtgx• 6 years ago

WSJ: Surprise ruling is a victory for privacy activists

This wasn't a surprise at all. It was very predictable from the beginning for one simple reason: the US doesn't have strong privacy laws and the US government's surveillance apparatus doesn't account for whatever privacy laws exist either. All the gag orders (up to half of all total order requests according to Microsoft 2 years ago), all the tapping of internet cables and "partnerships" with the carriers, all the "fusion centers" with all agencies getting people's data, and so on.

Oh, and best of all, the Privacy Shield said that it was up to the US DOJ to ensure US companies followed EU law. What a joke.

The EU Charter of Fundamental rights prohibits data from being stored in countries that don't provide equivalent privacy protections as in the EU. If you follow this logic, it's obvious Privacy Shield was bound to fail.

An article from 2018: https://www.hrw.org/news/2017/07/26/us-surveillance-makes-pr...

tdrp2• 6 years ago

Is there some kind of "we are in the EU and understand our data will be stored in the US and can be surveilled" consent box?

What about platforms that connect people from all over the world? Yeah you can store EU users' data on an EU server but what if a US user checks out a EU user's profile. Or are we supposed to completely disconnect each continent?

Dobbs2• 6 years ago

You work to the most restrictive set of rules. EU users data is stored in places that comply with the rules in question, that could be the US, if the US complies with EU rules.

If US user wants to interact with EU content, then they need to comply with relevant EU rules. They might not have to give the same level of enthusiastic consent, but the data of their interaction should still stored in EU compliant manner.

adventured2• 6 years ago

That's not quite correct. It depends entirely on what jurisdiction/s you fall under, where you do business.

If you're a US entity you can freely store EU data on US servers entirely without EU permission or consent, and do anything with it that you want to (within US law), so long as you don't operate within the EU. For exactly the same reason that you can safely ignore GDPR if you don't operate in the EU.

If I build a service that runs its servers only in the US, in nearly all cases I don't need to concern myself with EU laws. I'll be operating by US laws. I can allow EU users to sign up and use my service and store their data in the US. There's nothing the EU can do about that.

The EU will have to enable a draconian Chinese firewall to stop this. They have no power or influence to dictate to the world such rules, so the only thing they can potentially do is put their own people in a safety box and lock them off from the rest of the world.

simion3146• 6 years ago

US could solve this by granting all humans same rights and not have the ability to read private data of all non-US citizens with no restrictions.

kergonath4• 6 years ago

That would be obviously the right thing to do in quite a lot of cases. Immigration and elections are about the only cases where being a citizen should matter. And conscription, if we keep digging.

oaiey2• 6 years ago

I think the expectation is that data of a European citizen remains in the European union except otherwise needed and consented.

In sense of the GDPR, a European User Account does not need to synced to the US but only the communicated exchange between a European and a US user.

There are a lot of reasonable usage and solutions. They just cost money, time and are annoying architecturally.

fmajid2• 6 years ago

No, the data can be held anywhere that has enforceable protections equivalent to the EU’s. Japan was explicitly ruled to be. The UK will almost certainly be found not to be because it’s intelligence services are even more out of control than the US’.

Vespasian2• 6 years ago

As far as I know that is not allowed as it would just be used to override any data protection laws.

In the end if part of the world refuses to implement even the most basic working privacy protection laws what choice does the EU have.

I'm certain companies and governments alike would be thrilled to put in place the next iteration of this agreement, however the US refuses to move even an inch.

icebraining2• 6 years ago

Under the GDPR, consent boxes cannot be mandatory. The service must work even if you don't consent.

corty6• 6 years ago

Consent might not be necessary or might not be possible, depending on the situation. You need a legal basis for processing of data, one possible (but the worst possible) is consent. A popular better one is "fulfilment of a contract". All that is largely (but not completely) independent from how and where the data processing is done. You usually do not need consent to have data processed by a third party or abroad, if you have a legal basis for processing said data. You just need to keep your customer informed.

Exceptions to all this apply for special kinds of data (minors, medical, biometric,...) and invasive processing (AI decisions, scoring). In those cases you might need special consent or you might not be able to export the data at all, even with consent.

secfirstmd• 6 years ago

Worth also remembering that at the moment the UK is still negotiating with the EU and hasn't got a data protection adequacy agreement in place. At the same time it is domestically pushing for increased surveillance laws and powers for GCHQ etc. That issue in many ways is going to be just, if not more, tricky.

_the_inflator• 6 years ago

At the political level this is going to fuel the conflict between USA and EU. Gas pipeline, data privacy - times have changed forever it seems between USA and EU.

bad_user• 6 years ago

I don't see a conflict. European countries have had consumer protection laws that are different from those in the US and US companies have had to comply. This situation is no different.

The EU wants privacy & security guarantees that US companies can't deliver and special deals with the US government can't really fix that. But I'm sure US companies will adapt eventually.

And this goes in both directions of course. For example European banks have to be really careful in dealing with US citizens due to laws like FATCA.

allendoerfer• 6 years ago

For example European banks have to be really careful in dealing with US citizens due to laws like FATCA.

Their fix is of course to require you to check the "I am not a US citizen" box.

onetimemanytime• 6 years ago

allies but different interests, very different. Example: Why We Must Spy on Our Allies https://nationalinterest.org/commentary/why-we-must-spy-our-...

082349872349872• 6 years ago

    Oceans rise Empires fall
    We have seen each other through it all
    And when push comes to shove
    I will stalk all your communication
    To remind you of my love

jeroenhd2• 6 years ago

Privacy Shield is dead, long live privacy shield.

I wonder how many attempts it will take for this deal to be considered legal before the US actually has to do something to hold up their end of the deal. The US government would scream in rage if Germany would ever demand the ability to order Microsoft or Google to hand over information about US citizens in complete secret, yet the EU wil gladly take the word of the US government that it won't happen.

The EU also has plenty of incentive to encourage keeping data within the boundaries of its member states. Making it difficult to use American tech giants as a lazy quick fix for data storage instead of looking at local alternatives only helps limit the amount of money taken from the European economy. With the scandals and state of the current US government I find it hard to believe the EU will be able to draft a new agreement like this with the US without compromising on the rights of their citizens.

KingOfCoders4• 6 years ago

The US never will.

Dobbs2• 6 years ago

Privacy Shield is dead, long live privacy shield.

Apologies for being pedantic, but "The king is dead, long live the king" is referring to two distinct uses of the word king. It is equivalent of "The old monarch is dead, long live the new monarch".

So for this to work in your case it would need to be:

"Privacy Shield is dead, long live new-replacement-law"

But without a replacement law, the phrase just doesn't work.

ceejayoz• 6 years ago

That's probably why the first Privacy Shield was capitalized, but the second was not.

jeroenhd2• 6 years ago

My point was that there will probably soon be a new, similarly lacking Privacy Shield with a similarly silly name (Secure Data Exchange Act? Privacy Protection Plus? Data Protector Agreement?).

We don't know the name of the new law yet, but Privacy Shield was quickly implemented because the agreement before it was deemed insufficient, and the same will likely happen again.

hasch• 6 years ago

Well, I guess the truth is, personal data of EU and US citizens is sent in secret to european agencies all the time. Such institutions are all exempt from GDPR.

IAmEveryone2• 6 years ago

EU and member state institutions and agencies are not universally exempt.

There are some specific justifications that are scoped to government use only, in areas such as law enforcement or collection of statistics. But agencies still need to implement the law, document the specific requirements for any type of data they collect, observe time limits on retention, produce transparency reports, and so on.

fmajid2• 6 years ago

I don’t know why the article claims the decision was “surprising”. I work for a US company that is subject to GDPR and we’ve been expecting this for over 2 years, the only unknown was when the ruling would happen, not if.

the_duke2• 6 years ago

Already on the front page, with more comments: https://news.ycombinator.com/item?id=23856988

Both submissions are very shallow articles though.

idkwhoiam• 6 years ago

Imagine every country comes up with a similar law restricting personal data transfers. This will render Internet useless.

danarmak2• 6 years ago

An Internet with no personal data is a far cry from useless.

perpetualpatzer• 6 years ago

But surely, you'd concede it's far less useful. No international email, social media. No access to foreign websites: IP addresses are personal data [0].

Possibly, service delivery is feasible if you set up a warehouse in both locations to freight forward, but any vendor without the means to operate in each country.

While I expect my EU pals will say "but of course we will never apply the law that way," if this was the intent of the legislation, the legislation looks an awful lot like a nationalist tariff.

[0]https://www.alstonprivacy.com/ecj-declares-ip-addresses-pers...

int_19h• 6 years ago

Why would it? This just means that people would be in control of when and where their personal data is transferred. If you choose to, say, make your profile public to the world, I don't see how that would be affected.

Vespasian2• 6 years ago

In fact if others come up with similar laws (even vaguely), the EU laws, as they are now, would allow the the transfer.

For example Switzerland, Japan, South Korea etc

nix238• 6 years ago

This will render Internet useless

No it will render the internet back to what it once was, and not a personal data market platform for the big company's.

Remember it about Personal Data.

belorn2• 6 years ago

We can already see some of the result from the trade conflict between China and US. Centralized services, ie search, video hosting, social networks, cloud services and so on will likely be copied for each nation and exist as national or regional versions.

The other part the Internet, ie the decentralized part will likely continue to be unaffected. The big threat to that part is national firewalls and when infrastructure become centralized such as current trends in DNS resolving.

Cthulhu_4• 6 years ago

How so? Thanks to technology nowadays, it's easy to set up a local copy of your stack in a random datacenter, and to do your statistical analysis and optimization there as well. There is no reason to ship all that data off to the US other than cost optimization and data hoarding.

simion3146• 6 years ago

The law allows data transfers but with some conditions. So if US or China don't want to respect privacy then the data can't be transferred there but if Canada would accept this agreemnts then you could transfer data there. The barriers are raised by the countries that do not respect privacy laws You don't want EU to read your private emails but US should be able to read them, so you agree that you won't read the emails but you don't respect this agreement, what else can be done?

Barrin92• 6 years ago

As a EU citizen I'm glad about the decision, I don't have any confidence any more that data stored in the US is secure and that the US can be depended upon.

Also important to point out how much of this goes back to Max Schrems activism over the years and noyb (https://noyb.eu/en). This is a huge win achieved with relatively few resources. Staying engaged is worth it.

Frost1x• 6 years ago

As a US citizen, I'm personally glad to see other nations push back against data privacy exploitation by US businesses on the general public. It's evident our own (US) government will do very little to curb those business's overreach.

I hope to see more disincentives put forth against these practices in markets our businesses haven't completely supplanted government oversight. Hopefully, that will result in shifts of practices in the US markets as well, though it's certainly not guaranteed.

nojvek• 6 years ago

China is looked down for its draconian surveillance. However US is just another side of the same coin.

Our big Tech FAANG loves gobbling up everything they can get their hands upon in the name of training AIs that shove more personalized creepy ads.

jjcon7• 6 years ago

Since many major EU countries share their classified intelligence and surveillance systems with the US (and the reverse) this seems more like political speech than reality. The real reason is to preserve what’s left of tech in the EU but that doesn’t exactly sound as good.

Almost all major countries have surveillance programs. They are perhaps necessary to preserve national security. The hope of democratic countries is to have enough checks and balances on those powers to keep them limited to national security interests and to prevent abuse.

karmakaze• 6 years ago

I was thinking the same thing. It seems that we have passed 'peak globalization' and we're seeking a sweet spot that balances concerns. This could be a good thing.

M2Ys4U4• 6 years ago

This is one area where you have to separate the EU from its constituent member states.

The EU's treaties explicitly reserve national security for the member states themselves (except for where there is unanimity or opt-in in specific areas).

As such, in most cases, the Commission and Parliament can't legislate to bring MS' own intelligence services under control.

To change the situation the treaties would have to be changed (which is a can of worms in itself) and all 27 members would have to agree to the changes (one or two would require a referendum).

norenh• 6 years ago

There is a difference between sharing information (where you control what is shared) and letting the other party have all the information and look at it by their own. The fact that EU shares intelligence with US is less of a problem as long as EU citizens have a somewhat confidence in their government and security services. It is a big difference from letting US process all private information about the EU citizens and by that enable US to rummage around as they wish without having to obey laws or regulations in EU.

eitland• 6 years ago

Hmmmmm. If Apple can get away with providing a less secure version for China they could probably get away with creating a more secure version for Europe..?

poorman• 6 years ago

They are really making it impossible to start a small SaaS product. People already don’t want to pay $4/mo. for even some of the most popular SaaS products. I’m afraid all this is going to do is cause these small SaaS businesses to run twice as much infrastructure, and then transfer the costs onto the consumers by substantially increasing their prices.

FranzFerdiNaN• 6 years ago

Yes, privacy has a cost.

Cthulhu_4• 6 years ago

As it should be; I want to pay with money, not my data. And I want my spending to stay in my local economy, not to the bottomless pit that is the US.

Sebb7673• 6 years ago

We're happily running a small SaaS with 4 servers using a small provider near Frankfurt for less than 50 Euro/Month. In fact, this provider is massively cheaper than AWS for bare metal and we had no service problems so far. It's maybe not five nines, but the limit is really not the service provider ATM.

jurschreuder• 6 years ago

I'm missing the point of why the USA would not just stop this weird spying on everybody. From China I'd expect nothing more but the USA? They're supposed to be a decent country.

Then we would not need all these super unpractical counter measures.

Cthulhu_4• 6 years ago

They're supposed to be a decent country.

But they are not; they're dropping fast on the world scheme when it comes to human rights and common decency. In many ways it's as bad as China is when it comes to that.

It's interesting that they managed to keep the ICE concentration camps out of the media. Will the >100K of covid-19 related deaths (that have been officially reported) someday be considered genocide / eugenics?

e773yeydyyd• 6 years ago

This is certainly a romantic take on the matter but for once the liberal arts students are actually ahead of the curve since for many of them this reading is a part of their standard curriculum (followed by an exercise where some defend the practice and some condemn it): https://www.wsj.com/articles/SB95326824311657269

veeti• 6 years ago

Did people already forget all about the 2013 leaks? Do you actually think that the EU is not complicit in the same surveillance practiced by the US?

For example, Der Spiegel revealed how the German Foreign Intelligence Service transfers "massive amounts of intercepted data to the NSA", while Swedish Television revealed the National Defence Radio Establishment (FRA) provided the NSA with data from its cable collection, under a secret treaty signed in 1954 for bilateral cooperation on surveillance...

How is my data any more secure on a German server than an American server? Some asshole is snooping on it anyway, and the NSA gets access by extension.

Sporktacular• 6 years ago

Perhaps it isn't, but if that's the case the ruling is about giving you legal redress to fix it.

leeter2• 6 years ago

People forget that the reason this happens is that most countries have laws against spying domestically. They usually don't have laws prohibiting them from taking data from other spy agencies spying on their own country. So the cheap and easy workaround is you let your friends spy on you for you. It's usually pretty critical for counterintelligence anyway. As the first place an enemy tries to get into is the counterintelligence department.

refurb• 6 years ago

I was looking for a comment like this.

Yes, GDPR provides greater protection for privacy than US laws and hats off to the EU courts for trying to maintain that protection.

That said, the US and EU are so closely intertwined when it comes to intelligence that I doubt this provides much protection from Western state level actors.

ptman• 6 years ago

The US intelligence community has had access to privileged information so long that the organizational structure reflects this. Taking that away would be a massive change, which is why they fight it with all they've got.

jjcon7• 6 years ago

Almost all countries have surveillance programs - from the EU to the US to China. They are arguable necessary to maintain national security.

The difference is not that a country surveils but if they have processes in place to protect that information from abuse and keep it to use only for national security interests.

kergonath4• 6 years ago

I tend to agree. Just a nit, though: the EU is not a country and does not have intelligence agencies. Member states are and do.

Xelbair• 6 years ago

They're supposed to be a decent country.

what? since when?

USA was, and still is corrupt. There are plenty of news of USA covering up war crimes, spying on everyone, PATRIOT act itself, drone assasination etc.

and prime example from the past: https://en.wikipedia.org/wiki/1954_Guatemalan_coup_d%27%C3%A...

Plus quite honestly if any country behaved like USA in Europe(Allegiance to the flag in schools, "patriotism" etc) they would be under EXTREME scrutiny from their neighbors.

It is still a lesser evil on the world stage to be honest.

34679• 6 years ago

Nobody in the US government is going to scream in rage over the violation of your privacy. The last person who came close is hiding in Russia.

StavrosK• 6 years ago

Nobody in the US government is going to scream in rage over the violation of your privacy.

by the US government. Plenty of people are screaming in rage about China, for example.

simion3146• 6 years ago

That is not even close related with privacy or human rights and more about geo-politics.

dang• 6 years ago

(We detached this subthread from https://news.ycombinator.com/item?id=23857574)

terom3• 6 years ago

The idea would be to align the commercial interests of US cloud service providers with the privacy interests of EU customers.

From the EU citizens perspective, the ideal outcome would be for US cloud service providers to pressure US authorities to limit their surveillance of EU citizens and provide some kind of privacy guarantees. Here's to wishful thinking...

DaiPlusPlus• 6 years ago

Google, of all companies, was a major supporter of California's CCPA (Cali's GDPR-like legislation) last year.

Cynically I suppose it was to ensure they'd at least have a say in what the CCPA covered... and to hurt their rivals (Facebook, etc).

TomMarius2• 6 years ago

GDPR was supported by the biggest EU corporations as well - not much could help them more :-)

donalhunt• 6 years ago

Big companies just like legislation that is clear, won't be challenged and doesn't change (too) much. Allows them to commit resources without the goalposts changing.

KingOfCoders4• 6 years ago

This means noone in the EU can sell on Amazon or eBay. Noone can use services like WebFlow and other hosting solutions. We'll see what future court decisions say about AWS hosted inside the EU.

KingOfCoders4• 6 years ago

Everyone who sells on Amazon and eBay has a data protection policy which mentions Privacy Shield to legally work with Amazon. The court says only DPAs work where you make sure that the other party protects data on a GDPR level, which Amazon doesn't do and can't do.

KingOfCoders4• 6 years ago

Noone in the EU now can sell on Amazon or eBay.

rydre• 6 years ago

Good job Euros! Now you need to level up tech sector, get rid of the shackles of Google, Apple, Facebook. Your startups deserve better then the current, anti competitive and worse environment! Your companies could do much better, now is the time and make it happen.

leadingthenet• 6 years ago

It’s never going to happen. We’re a completely decadent society, and we’re essentially out of the IT race at this point.

zurfer• 6 years ago

Well it's not even the right point to discuss. A lot of great software is developed in Europe (not necessarily by companies with European headquarters). But why should software companies be tied to a specific region. Great software can come from the US, Australia, Asia, Europe, ... Because in the end it comes from people and the entrance barrier gets lower and lower.

What you point to is probably more a question of finance and ownership.

pjc50• 6 years ago

People keep saying this while ignoring the local huge boring IT companies and local subsidiaries of US IT companies.

Does it really matter where the nameplate that indicates where the HQ is? Or does it matter where the profits are taken for tax purposes (Apple appears to be an Irish company, by that measure)? Or where the CEO and board members are domiciled? Where the actual staff sit when they work?

m0xte• 6 years ago

Err some of us actually like Apple as at least they actually pretend to give a shit. Google and Facebook not so much.

lukejduncan2• 6 years ago

Dumb question: can someone explain to me the implications on startups and side projects? Does data mean, any data? If I’m reading that correctly it’s illegal to allow EU users to use any website with a DB that isn’t hosted in the EU. That can’t be correct, can it?

x0x0• 6 years ago

EU residents enjoy a right to data protection.

US residents do not.

EU allows export of their residents' personal data to the US under different sets of rules or methods, one of which is (was?) Privacy Shield. Another is Contractual Clauses. The crucial fact for Privacy Shield is it was supposed to provide "equivalent" protections (ie protection for EU data hosted in the US equivalent to that data being entirely in the EU). It did not.

My take is that Privacy Shield was a sop to the fact that the US never had anything like equivalent privacy laws, but we are (were?) too big a trading partner to apply the law to. This realpolitik appears now to be in question.

So yes, one of the ways to legally allow a US-based company to process EU resident data has now been removed.

M2Ys4U4• 6 years ago

It's personal data. Which is defined in the GDPR as:

any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person

lukejduncan2• 6 years ago

I’m sure the true answer is ambiguous, but “personal data” by that definition seems to imply almost any form of account creation. For sure, that seems to imply you can’t use email addresses as identifiers. Maybe it implies that so long as the data isn’t de facto joinable with side data (phone numbers, email addresses) it may be ok.

IAmEveryone2• 6 years ago

It's never illegal for the user to create an account. It can be for the company.

As a heuristic: a website such as HN that is available in the EU but doesn't specifically target EU "customers", and that isn't itself or via some subsidiary registered within in the EU is perfectly fine.

I believe the same is also true if you allow EU customers to buy in your online store as long as it's implemented as just a "country" form field and, again, you are not registered in the EU/have no distribution warehouse there, and so on.

I've seen the New York Times being cited as a sort of goalpost of what's still ok: even though they have journalists in Europe, they have no sales presence, and are clearly aimed at the US market.

No idea about Amazon, though.

jjcon7• 6 years ago

to adequately protect Europeans' data from US surveillance and security laws and was therefore invalid

Certainly this is more about protection from corporations with the added benefit of preserving what’s left of tech in the EU.

Considering the US and most major EU countries share intelligence information with each other and all have surveillance programs I don’t know that it would be very effective at doing that no matter where the data is.

brownbat2• 6 years ago

Will this have implications for Chinese and Russian services as well? Will the EU go fully local?

M2Ys4U4• 6 years ago

Not really, because the European Commission has not issued an adequacy decision in relation to China and Russia as far as I'm aware.

Russia is an interesting case, though.

They are bound by the European Convention on Human Rights (although enforcement is... let's say tricky), and they are also signatories to Convention 108 (the Council of Europe "Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data") and they have signed (but not ratified) the protocol to update the convention (223, combined known as Convention 108+).

This - in theory - puts them at an advantage over countries like the US which lack any real privacy legislation.

However 1) Theory and practice aren't the same; and 2) I think it would be an impossibly hard sell for the Commission to issue an adequacy decision for Russia purely for political reasons, let alone practical ones.

brownbat2• 6 years ago

Oh interesting:

https://ec.europa.eu/info/law/law-topic/data-protection/inte...

So Russia/China are already in the "further safeguards needed" camp, along with... almost all of the world?

I studied a bit of EU law in law school, but haven't kept up as much as I should. This is a helpful start to dig back in, thanks!

boshomi• 6 years ago

Max Schrems[1]: “The Court clarified for a second time now that there is a clash between EU privacy law and US surveillance law. As the EU will not change its fundamental rights to please the NSA, the only way to overcome this clash is for the US to introduce solid privacy rights for all people – including foreigners. Surveillance reform thereby becomes crucial for the business interests of Silicon Valley."

"This judgment is not the cause of a limit to data transfers, but the consequence of US surveillance laws. You can’t blame the Court for saying the unavoidable - when shit hits the fan, you can’t blame the fan."

[1] https://noyb.eu/en/cjeu

Aachen• 6 years ago

This has been going back and forth for a long time now. Perhaps I'm being naive, but given light delay, companies already host data about and data accessed by citizens from <insert continent> on said continent, so why don't companies just store EU data in the EU and be done with it? Wouldn't that solve the whole issue, years in court, ambiguous rules, companies/agencies that require local storage, etc.?

plandis• 6 years ago

This just seems protectionist to me.

I imagine anything the US is doing is being done by spy/sigint agencies within the EU

Top EU court overturns US data transfer agreement in Facebook case

Related Stories