US-Europe Privacy Shield not worth the paper it's printed on – civil liberties groups

The critical transatlantic data agreement, named Privacy Shield, is worthless, gives intelligence agencies complete free rein, and should be discarded, according to Human Rights Watch and the American Civil Liberties Union. In a letter to European Union leaders responsible for overseeing the agreement, the two organizations …

[Anonymous Coward]

Sad, but predictable...

It was pretty obvious from the get-go that these oversight agencies were a fig leaf, without consistent budgeting, access to classified programs and with few powerful champions in Congress and the White House.

The bigger question is to what extent various EU governments like it this way. This way, they get to protest European virtue while secretly asking the U.S. intelligence community for help surveilling this or that real or imagined threat.

[streaky]

Uhm

Been saying this for months, still no movement (or even utterances) from the EU on this. EU charter is in tatters at this point. Faster we can get out the EU and force the government here to fix this forthwith the better.

[Anonymous Coward]

Re: Uhm

"Faster we can get out the EU and force the government here to fix this forthwith the better."

All the indicators are that this government will revoke the privacy constraints imposed on it by higher European courts. It will give the USA anything they want - even without being over a barrel on trade agreements with them.

[streaky]

Re: Uhm

There's no evidence that's the case and the joys of an actual democracy rather than a pretend one: we can get ourselves a new government if they don't fix it.

[Nick Kew]

Re: Uhm

The elected EU parliament is the only institution whose track record says they might be on our side re: protection of the citizen. Maybe just possibly with the UK gone, the balance of power at EU level might shift a little from the unelected civil servants towards the elected parliament.

The Westminster parliament has been firmly in the vanguard of Big Brother legislation under both (or indeed all three) parties, and it's clear Sir Humphrey is entirely with them on this.

[Warm Braw]

Re: Uhm

There's no evidence that's the case

RIPA

We can get ourselves a new government

Good luck with that.

[Doctor Syntax]

Re: Uhm

"There's no evidence that's the case and the joys of an actual democracy rather than a pretend one"

Really? You can't have been paying attention.

We've had a series of Acts of Parliament attempting to legitimise HMG's spying on us, all ending with the words "Investigative Powers Act": Regulation of Investigatory Powers Act 2000, Data Retention and Investigatory Powers Act 2014 and most recently Investigatory Powers Act 2016. The reason for these is that the govt activity in this respect keeps getting struck down by courts and the govt then insists on a new Act to legitimise their activities.

The most reliable courts in this respect are the European ones; basically a UK court will ultimately hold Parliament sovereign whilst an EU court will enforce EU legislation and the European Declaration of Human Rights. The only Parliamentary check in recent years has been the Lib Dems in the coalition who held back the govt during that period.

Maybe there's a chance that we could get a Lib Dem govt in a few years time when the backlash against what Brexit eventually does to the economy hits both the current major parties but that's a fairly long shot.

[CowardlyLion]

Re: Uhm

> we can get ourselves a new government if they don't fix it.

You'd like to think so. Others are not so sure.

Britain’s one-party state

Labour’s implosion leaves Britain without a functioning opposition. That is more dangerous than many realise

http://www.economist.com/news/leaders/21707209-labours-implosion-leaves-britain-without-functioning-opposition-more-dangerous

[Anonymous Coward]

Re: Uhm

"... we can get ourselves a new government if they don't fix it."

Careful now or you'll find yourself on the watch-list as a terrorist hell bent on over-throwing your "democratically" elected lords and masters.

[Len]

Re: Uhm

I wouldn't count on it. The UK Government is not on your side on this matter.

[Queeg]

EU response.

*Fingers in Ears*

.

La..La..La..La..La..La..La..

.

Have they stopped asking questions about Privacy Shield yet?

.

No!

.

SHIT!

.

*Replace fingers*

.

La..La..La..La..La..La..La..

[P. Lee]

Re: EU response.

Why don't they go with tax-type laws?

Is the local company a "controlled foreign corporation"? Fine the local corporation and assign joint responsibility to the parent company. Do they fail to turn up to court? Carry on without them. If found guilty, do what the US does and go after their income streams - block payments and hold intermediaries liable.

Sure you can do business, but you have to comply with our laws.

[Tom Paine]

Re: EU response.

Consider the scale of the problem. If Privacy Shield is ofificially not up to snuff for protecting EU citizens' personal data, here are some of the organisations that would be operating illegally:

* Facebook, Twitter, Snapchat, Whatsapp, and every other US-based social media site

* All US-based web-based suppliers of goods and services that collect any personal data. (Hint: when you order something, and you supply your name and address for delivery -- that's PII.) So, yes, AFAICT Amazon would be operating illegally.

* All vendors of IRL products, Got an Apple computer? You have an account on whatever the Apple big-brother-in-the-cloud system is called. Boom, that's illegal. Got a Ford car bought from new? You'll be on their customer database for marketing purposes as well as things like product recalls.

And so on and so forth.

Purely digital products and services are probably still a small fraction of the total value of US - EU trade; but I bet there's a digital element to most of them, even if it's only product registration or storing software license information or a support contracts.

In the real world, though, as when Safe Harbor [sic] was struck down, no-one will take a blind bit of notice -- until some enterprising lawyers realise there's a lot of money in class actions. And when GDPR comes in, fines are up to 4% of the parent organisation's turnover. So in the case of Ford, Says here their revenue in 2015 was $140Bn globally, so in principle they could be on the hook for up to $5.6Bn in fines.

It's going to be interesting to see whether the pragmatic "you can't shut down trade with the US" approach beats the "but the law!" argument, or vice verse.

[Destroy All Monsters]

Nothing to do with Obama, no sir.

> why they believe President Trump's recent executive order on immigration undermines the agreement

Not ex-Presidente Obama's order to "go ahead, sharing is caring" to the TLAs.

Can one really "undermine" an "agreement" that is based on fakery?

[Len]

All temporary anyway

Privacy Shield is all temporary anyway. It looks like Privacy Shield is still in violation of the Charter of Fundamental Rights of the European Union so we can expect the ECJ to tear Privacy Shield apart soon.

[Anonymous Coward]

Re: All temporary anyway

which, under the current government's plans, won't matter one bit, given they seem to have taken a "leave the EU" vote as a green light for shredding any European rules they don't like, regardless of the will of parliament or the public in each case.

Also given that we have a former Home Secretary, who - like most of her recent predecessors in that office, in both main parties - has previously tried to shred what few legal protections we have, does anyone really think for one moment that this government or the opposition is on the side of civil liberties, human rights and the protection of the ordinary citizen from an over-reaching and or over-bearing state?

[Tom Paine]

Re: All temporary anyway

they seem to have taken a "leave the EU" vote as a green light for shredding any European rules they don't like, regardless of the will of parliament or the public in each case.

Eh? As far as I know, the official plan is still for the so-called "great reform bill" will carry over all current rules, laws and regulations that derive from the EU, en masse, into UK law. They may well then set about downgrading or removing specific individual regs they don't like on a case-by-case basis, and in some cases those proposals will be fiercely resisted. At any rate, there are so many that it's not remotely practical to rewrite them in the time available. I read somewhere recently that they'd have to process 40 sets of regulations or laws per day, every working day for the next two years, to have proposals for any changes to EU regs.

[mics39]

Right to sue

My chance of successfully suing US company or government agency in USA meaning having to hire hordes of substandard US lawyers and being adjudicated by hillbilly US judges is from the beginning impossible. Bookies might give me better odds to sue Kim Jong-un in Pyongyang. So the idea of Privacy Shield from European side is no more effective as Sunderland defence.

[Anonymous Coward]

All the points in the article are valid; the Judicial Redress Act is awful. But I still don't understand something. The FTC's argument is that the JRA doesn't affect Privacy Shield, because the JRA weakens the US Privacy Act, and Privacy Shield is not based on the US Privacy Act.

What exactly is the counter-argument there? Because if Privacy Shield does not depend on the US Privacy Act, then Europeans shouldn't have to care too much whether the US Privacy Act gets dumped in the crapper (now, everyone else, that's another matter).

Also, one or more of these organizations really need to go to the ECHR with this.

[Version 1.0]

US position

The USA has no problem with the Privacy Shield agreement and will be happy to sign it. It's not like the NSA ever bothered with other countries laws anyway - they can always write a brief star chamber note to say that the agreement must be signed but ignored.

[Wolfclaw]

Once we BREXIT, EU privacy laws will be quietly killed and GCHQ/NSA and other friendly spooks will have unlimited free access to UK comms and I bet any EU comms that can be sniffed on !

[EnviableOne]

Ah But GDPR

Privacy shield is just a 95/46/EC directive equivalency decision

the safeguards in it barley held up for that, they dont even go anywhere near equivalency for GDPR, so come May next year its dead anyway

[DrM]

Citizens

Ah, more privacy complaints from the kingdom where i would be jailed for not revealing my PIN.

Yes, the US foreign policy is about to change. Our citizens will begin to be a higher priority then people in other nations. Oh no, how non-world-citizen and non-PC!

But that is the plan now, to make rights and well-being and safety a higher priority for citizens then those who are not. If some issue like immigration or privacy is a trade-off, then we will decide and act in favor of our citizens.

It's just that simple. Don't like it? Stay home. Visit Iran or China, see how they treat you.