Bijan Madhani Profile picture
Jul 16, 2020 22 tweets 4 min read Read on X
Should I do a Twitter thread on the European Court of Justice's #PrivacyShield ruling in #SchremsII? Seems like a good thing to do and honestly who doesn’t love story time? Here we go! (Caveat: just speaking for myself here)

So basically, it's 2015 all over again! 1/n
2/ I feel 5 years younger just typing this. Today’s invalidation of Privacy Shield by the ECJ is basically what happened to the EU-U.S. Safe Harbor arrangement that preceded the Privacy Shield.
3/ This is a story about whether data controllers can move EU personal data to a non-EU country.
4/ Under GDPR (and the Data Protection Directive that preceded it) data controllers (can only transfer an EU data subject's personal data to a country where it will be "adequately" protected.
5/ An adequacy determination by the European Commission is a holistic question covering the state of consumer privacy law, surveillance law, and rights of redress against companies and the government.
6/ The EC has to find that the country in question's environment affords a level of data protection "essentially equivalent" (but not identical) to what the data receives in the EU.
7/ The U.S. has never been deemed adequate, thanks to a dearth of consumer privacy laws + our surveillance regime post-9/11, which does not offer too much in the way of restraint or rights of redress.
8/ The EC has never really had to do a self-critical examination of EU member country surveillance regimes (they get an automatic pass for this particular purpose), but we'll soon get a test for the post-Brexit UK (cc: @astepanovich)
9/ So as a stopgap, the EU and U.S. have negotiated agreements that allow companies to commit to the FTC that they will protect data in a way that is adequate according to the EC, at a much higher standard than what is otherwise required in the U.S.
10/ In 2015, the first agreement (in effect since 2000), the Safe Harbor, was struck down by the ECJ following a case brought by Max Schrems.
11/ Schrems argued—and the largely ECJ agreed—that the U.S. surveillance regime as exposed by Snowden meant that the protections of the Safe Harbor were insufficient to protect EU person data from unreasonable and unredressable access by U.S. public authorities.
12/ (there were and are a lot of misconceptions about how U.S. surveillance authorities operate, but we'll call the Schrems I decision "mostly not wrong")
13/ Fortunately, in 2015, just as today, Binding Corporate Rules (BCRs) and Standard Contractual Clauses (SCCs) continued to operate as alternative measures through which cos could commit their U.S. operations + vendors to an adequate level of protection, as approved by the EC.
14/ Privacy Shield was a successor agreement negotiated in 2016 to beef up the level of data protection offered by companies who commit to it.
15/ In the lead up to its adoption, the U.S.: 1) created an Ombudsperson in the State Department to oversee surveillance practices as applied to non-U.S. persons, and
16/ ... 2) passed the Judicial Redress Act to afford EU persons some new redress rights under the Privacy Act with respect to data held by the U.S. government (subject to a bunch of exceptions).
17/ The U.S. otherwise did basically nothing to reform its surveillance laws, aside from pass the USA FREEDOM Act (which significantly restricted a domestic metadata collection program and introduced amici to the Foreign Intelligence Surveillance Court).
18/ Fast forward to today, and it looks like the ECJ basically said all of that wasn't enough to make data protection conditions in the U.S. under Privacy Shield adequate. Thanks again, Max Schrems! More or less the same problems exist today as in 2015.
19/ Really, it seems the only answer the ECJ will accept is a wholesale reform of U.S. surveillance laws (FISA, EO 12333, etc.) as applied to EU persons.
20/ While the EU and U.S. sort out what to do, companies should be able to move personal data from the EU to the U.S. under SCCs and BCRs.
21/ There are some open questions on whether SCCs can operate within a country not deemed adequate by the EU (but then what’s the point of SCCs?), so expect more there.
22/ Anyway, this is long thread saying that surveillance regimes are a big pain in the ass for some corporate data transfers and processing across borders. Expect more guidance on this from EU DPAs and the Commission. FIN.

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with Bijan Madhani

Bijan Madhani Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @bijanm

Apr 20, 2021
This morning, @Facebook published an op-ed calling for federal data portability legislation in the U.S. (byline: Yours Truly). morningconsult.com/opinions/we-ne… 1/?
2/ Upshot: we really like portability, because it can enhance people’s choice & control online. If you share data with one service, you should be able to move it to another. But there ought to be a federal law.
3/ Why do we care so much about portability regulation? Isn’t portability already the law in enough places (Europe, California, Brazil—everywhere a DC-based policy person might want to travel) for a federal law to be moot?

The answer is no, for a couple of reasons.
Read 13 tweets
Sep 22, 2020
Today's the big day! @FTC is hosting their workshop on portability. I'll be live tweeting my thoughts and appropriately warm takes during most of the day, so stick around!
We (@Facebook) submitted our comments to @FTC on #dataportability last month. I'll be weaving our thoughts from those comments into my takes on today's session
Andrew Smith, Director of the Bureau of Consumer Protection kicks off highlighting privacy / personal autonomy impacts of portability and the potential competition benefits, noting it allows for collaboration across @FTC's consumer protection and competition sides #DataToGoFTC
Read 66 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us!

:(