For years, the US has defiantly refused to reform its surveillance powers, or implement a Federal-level privacy law which respects privacy as a human right and safeguards the data of non-Americans. The CJEU has just ruled that enough is enough.
Today's ruling could have had implications for the Brexit transition, had SCCs been invalidated. That part remains. The ruling is, however, a warning shot to the UK's process of securing an adequacy decision. We are a Five Eyes ally with domestic surveillance issues of our own.
The UK, as I've said for years, was barely an adequate country in terms of domestic surveillance while *within* the EU. To secure adequacy, the UK's privacy practices will need to be better outside the EU than they were in it. Where does this go next? Trade deals.
After all, the UK is trying to align itself closer to the US system - no Federal privacy law, a highly politicised debate on intermediary liability, and open threats to encryption - than to the EU system. What the UK compromises now also compromises the integrity of the web.
For now, if you send EU data to the UK, I would strongly advise securing standard contractual clauses ahead of the Brexit transition deadline. You can no longer assume the UK will be granted data protection adequacy. Not after today.
This is important, because the Minister for Digital recently set out securing adequacy as a pillar of the UK's upcoming digital strategy. This change of tone came after Boris bombastically declared in February that the UK would go their own way on data. gov.uk/government/spe…
If that digital strategy isn't going to fall over before it begins, government must work with the tech sector, cluster groups, civil society, & tech policy bodies (hi!) to iron these issues out, understanding the implications for both the economy and human rights if they don't.
If you want a deep dive into the legal aspects of these issues, the @UCL_EI recently published this very good paper. But as you know by now, when it comes to Brexit, what happens is not about law. It's about politics. Let's get to work.
ucl.ac.uk/european-insti…
ucl.ac.uk/european-insti…
@UCL_EI Last thing in this thread: I run a side blog where I track developments on all aspects of tech policy throughout the Brexit transition. (We all need a hobby.) I've turned this tweet thread into a blog post there, because own your content etc. afterbrexit.tech
You really must compare the Irish Data Protection Commissioner's response to today's ruling (link)...
dataprotection.ie/en/news-media/…
dataprotection.ie/en/news-media/…
...with the response from its UK counterpart. This is it. 
