undefined | Better HN

0 pointspyrale1y ago0 comments

> The EC has issued an "adequacy decision" regarding the new EU–US Data Privacy Framework

To bad the EC isn't the body that can judge whether that deal is legal, and has been caught repeatedly lying about past deals [1].

> So maybe the DPAs will defer to the EC's interpretation of adequacy under the GDPR for this new Framework?

As before, cases will go to the actual authority on the matter: the CJUE. I personally don't have high hopes for this deal to last.

[1]: https://noyb.eu/en/european-commission-gives-eu-us-data-tran...

0 comments

AlanYx1y ago

I tend to agree with you about what will happen, but it illustrates the depth of legal uncertainty that exists in architecting software systems in Europe that process personal information. Corporations can't necessarily trust the EC's own published interpretations of their own laws, nor the certification processes the EC has created, so the only risk-minimizing route is a maximally pessimistic approach about what is permissible.

pyraleOP1y ago

> but it illustrates the depth of legal uncertainty that exists in architecting software systems in Europe that process personal information.

Oh I agree with that. EC's behaviour in that case is appalling.

> Corporations can't necessarily trust the EC's own interpretations of their own laws

There is a way to be safe with regards to EU law, and it's to engineer systems where European data stays in Europe. Of course, the issue is that corporations would then be liable under US' FISA 702.

That's the big issue: the United States made a law that basically states that no US company should follow EU law, and the US admin manages to beat EC officials into submission every few years with another flawed agreement to keep the ball rolling.

AlanYx1y ago

It's not that easy really. Several European countries have FISA s.702 functional equivalents that enable intelligence to get orders for interception of personal information on servers and entities within their legal jurisdiction. (e.g., The French Law on Intelligence and the German BND Act)

It's easy to say that the US should just scrap s.702, but unless it's reciprocal with Europe scrapping their interception powers as well, that's a pretty unrealistic ask.

2 more replies

j / k navigate · click thread line to collapse

0 pointspyrale1y ago0 comments

> The EC has issued an "adequacy decision" regarding the new EU–US Data Privacy Framework

To bad the EC isn't the body that can judge whether that deal is legal, and has been caught repeatedly lying about past deals [1].

> So maybe the DPAs will defer to the EC's interpretation of adequacy under the GDPR for this new Framework?

As before, cases will go to the actual authority on the matter: the CJUE. I personally don't have high hopes for this deal to last.

[1]: https://noyb.eu/en/european-commission-gives-eu-us-data-tran...

0 comments

AlanYx1y ago

pyraleOP1y ago

> but it illustrates the depth of legal uncertainty that exists in architecting software systems in Europe that process personal information.

Oh I agree with that. EC's behaviour in that case is appalling.

> Corporations can't necessarily trust the EC's own interpretations of their own laws

There is a way to be safe with regards to EU law, and it's to engineer systems where European data stays in Europe. Of course, the issue is that corporations would then be liable under US' FISA 702.

AlanYx1y ago

It's easy to say that the US should just scrap s.702, but unless it's reciprocal with Europe scrapping their interception powers as well, that's a pretty unrealistic ask.

2 more replies

j / k navigate · click thread line to collapse