Privacy Shield: EU citizens might get right to challenge US access to their data
(2022/02/03)
- Reference: 1643924052
- News link: https://www.theregister.co.uk/2022/02/03/privacy_shield_progress/
- Source link:
Officials from the EU and US are nearing a solution in long-running negotiations over transatlantic data sharing.
Previous legal arrangements for sharing data between the two jurisdictions, the so-called Privacy Shield, were [1]struck down by the EU Court of Justice in what became known as the Schrems II ruling in 2020.
The decision had ramifications for US cloud providers, social media sites, and providers of online tools which are still becoming clear. Although it had been commonly held that standard contractual clauses (SCCs) may offer a way to continue to share data legally, [2]that was also in doubt . Earlier this month, the Austrian data protection authority [3]ruled that those arrangements were insufficient for data sharing .
[4]
But [5]according to political news website Politico , officials both sides of the pond have reached an approach that might involve offering EU citizens the right to submit complaints to an independent judicial body if they believe the US national security agencies have unlawfully handled their personal information. If adopted, it would give EU citizens more privacy rights in the US than Americans currently enjoy.
[6]
The solution follows nearly two years of increasingly fraught negotiations. "The Biden administration considers finalizing an enhanced Privacy Shield the number one priority, and I remain actively engaged in those negotiations," said Gina Raimondo, US Commerce Secretary.
[7]Website fined by German court for leaking visitor's IP address via Google Fonts
[8]Lawmakers propose TLDR Act because no one reads Terms of Service agreements
[9]Austrian watchdog rules German company's use of Google Analytics breached GDPR by sending data to US
[10]German court rules cookie preference service that shared IP addresses with US firm should be halted
Even if the solution survives the negation, Bill Mew, privacy campaigner and CEO of Crisis Team, said there remained the issue of extraterritorial measures that are incompatible with the General Data Protection Regulation (GDPR). He said all US electronic communication service providers (ECSPs) – including telcos, cloud firms, and social media platforms – fall under [11]702 FISA through which the US intelligence agencies can subject them to surveillance.
While firms like Microsoft can provide information about the types of requests they get from the US government, the question of redress remains. Meanwhile, any new treaty for data sharing between the EU and US would need to survive a period of scrutiny by the EU parliament and member states, Mew said.
The news follows [12]yesterday’s announcement that all data collected through the Transparency & Consent Framework (TCF) must now be deleted by the 1,000-plus companies that pay international digital marketing and advertising association IAB Europe to use it. The [13]Belgian data protection authority [PDF] found that the "consent solution" fails to properly request consent, and relies on a lawful basis (legitimate interest) that is not permissible because of the severe risk posed by the online advertising tracking under Article 5(1)a, and Article 6 of GDPR. ®
Get our [14]Tech Resources
[1] https://www.theregister.com/2020/07/16/privacy_shield_struck_down/
[2] https://www.theregister.com/2021/11/01/data_transfers_europe/
[3] https://www.theregister.com/2022/01/13/google_analytics_gdpr/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YfxemYbQPN0Fg40xaIjoxgAAAAE&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://www.politico.eu/newsletter/digital-bridge/privacy-shield-update-3-0-semiconductor-subsidies-eu-us-policy-spat/
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YfxemYbQPN0Fg40xaIjoxgAAAAE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2022/01/31/website_fine_google_fonts_gdpr/
[8] https://www.theregister.com/2022/01/14/tldr_act_terms/
[9] https://www.theregister.com/2022/01/13/google_analytics_gdpr/
[10] https://www.theregister.com/2021/12/08/germany_cookie_service/
[11] https://www.dni.gov/files/icotr/Section702-Basics-Infographic.pdf
[12] https://www.theregister.com/2022/02/02/europe_iab_decision/
[13] https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-21-2022-english.pdf
[14] https://whitepapers.theregister.com/
Previous legal arrangements for sharing data between the two jurisdictions, the so-called Privacy Shield, were [1]struck down by the EU Court of Justice in what became known as the Schrems II ruling in 2020.
The decision had ramifications for US cloud providers, social media sites, and providers of online tools which are still becoming clear. Although it had been commonly held that standard contractual clauses (SCCs) may offer a way to continue to share data legally, [2]that was also in doubt . Earlier this month, the Austrian data protection authority [3]ruled that those arrangements were insufficient for data sharing .
[4]
But [5]according to political news website Politico , officials both sides of the pond have reached an approach that might involve offering EU citizens the right to submit complaints to an independent judicial body if they believe the US national security agencies have unlawfully handled their personal information. If adopted, it would give EU citizens more privacy rights in the US than Americans currently enjoy.
[6]
The solution follows nearly two years of increasingly fraught negotiations. "The Biden administration considers finalizing an enhanced Privacy Shield the number one priority, and I remain actively engaged in those negotiations," said Gina Raimondo, US Commerce Secretary.
[7]Website fined by German court for leaking visitor's IP address via Google Fonts
[8]Lawmakers propose TLDR Act because no one reads Terms of Service agreements
[9]Austrian watchdog rules German company's use of Google Analytics breached GDPR by sending data to US
[10]German court rules cookie preference service that shared IP addresses with US firm should be halted
Even if the solution survives the negation, Bill Mew, privacy campaigner and CEO of Crisis Team, said there remained the issue of extraterritorial measures that are incompatible with the General Data Protection Regulation (GDPR). He said all US electronic communication service providers (ECSPs) – including telcos, cloud firms, and social media platforms – fall under [11]702 FISA through which the US intelligence agencies can subject them to surveillance.
While firms like Microsoft can provide information about the types of requests they get from the US government, the question of redress remains. Meanwhile, any new treaty for data sharing between the EU and US would need to survive a period of scrutiny by the EU parliament and member states, Mew said.
The news follows [12]yesterday’s announcement that all data collected through the Transparency & Consent Framework (TCF) must now be deleted by the 1,000-plus companies that pay international digital marketing and advertising association IAB Europe to use it. The [13]Belgian data protection authority [PDF] found that the "consent solution" fails to properly request consent, and relies on a lawful basis (legitimate interest) that is not permissible because of the severe risk posed by the online advertising tracking under Article 5(1)a, and Article 6 of GDPR. ®
Get our [14]Tech Resources
[1] https://www.theregister.com/2020/07/16/privacy_shield_struck_down/
[2] https://www.theregister.com/2021/11/01/data_transfers_europe/
[3] https://www.theregister.com/2022/01/13/google_analytics_gdpr/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YfxemYbQPN0Fg40xaIjoxgAAAAE&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://www.politico.eu/newsletter/digital-bridge/privacy-shield-update-3-0-semiconductor-subsidies-eu-us-policy-spat/
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YfxemYbQPN0Fg40xaIjoxgAAAAE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2022/01/31/website_fine_google_fonts_gdpr/
[8] https://www.theregister.com/2022/01/14/tldr_act_terms/
[9] https://www.theregister.com/2022/01/13/google_analytics_gdpr/
[10] https://www.theregister.com/2021/12/08/germany_cookie_service/
[11] https://www.dni.gov/files/icotr/Section702-Basics-Infographic.pdf
[12] https://www.theregister.com/2022/02/02/europe_iab_decision/
[13] https://www.gegevensbeschermingsautoriteit.be/publications/beslissing-ten-gronde-nr.-21-2022-english.pdf
[14] https://whitepapers.theregister.com/
Pipe dreams
b0llchit
...offering EU citizens the right to submit complaints to an independent judicial body if they believe the US national security agencies have unlawfully handled their personal information.
Having the data in the US puts you at a disadvantage you cannot recover from. Regardless how you put it. There is no one here on this side of the pond to get a complaint through to the US side. That is a dreamer's scenario. If the data was mishandled, then the only effective redress would be to rewind time and prevent the US from having access to the data in the first place. There is no way any "independent judicial body" can force some like NSA or other three letter agencies to open the doors and let them fix any problems.
I do not want the US to have my data at all . I do not want EU entities to send data anywhere unless I give permission before the data is collected and sent. Then we can talk. Not post-factum patches that neither side can control nor verify.
This is where Europe gets entertaining - and hard to tame
The EU may set the rules at EU level, but due to the way the EU is structured, every country can implement and sanction on its own. This is why you get Austrian, German and now Belgian judgements that - despite being nationally focused - all have an impact reverberating across the whole EU.
Lobbying one point was doable as the "legitimate interest" scam aptly proved, but keeping all these little separate annoying countries under control is logistically almost impossible and the hits just keep on coming.
From my European perspective it's all very amusing.
:)