Today, the European Data Protection Board issued new recommendations for companies transferring data out of the E.U., in light of #SchremsII. The recs make clearer than ever that E.U.-U.S. transfers are in trouble, given the breadth of U.S. surveillance: edpb.europa.eu/sites/edpb/fil…
The EDPB specifically calls out Section 702 of FISA, which is in conflict with E.U. law. The report states that companies can transfer data under Standard Contractual Clauses only if they ensure that U.S. government access to the data under 702 is "impossible or ineffective." 
That's an extraordinarily high standard. Most companies can't meet it, even if they encrypt data at rest.
The only path forward for E.U.-U.S. data transfers is comprehensive U.S. surveillance reform, as @PatrickCToomey, Kate Ruane, and I explain in @just_security today: justsecurity.org/73321/the-futu…. In the meantime, U.S. companies will continue to bear the costs.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
