European Parliament's data adequacy objection: Doubts cast on UK's commitment to privacy protection Almost two weeks ago, the European Parliament took the step of objecting to the European Commission's decision to grant the UK data adequacy. Far from being a reactionary move against a former member state, the Parliament's resolution highlights flaws in the UK's data protection regime, which will have serious consequences for …
There are no consequences for the government(s) and institutions when they violate our privacy. The laws are just words om paper. Every time we hear about violations of the privacy laws by the government(s) or its institutions we only rarely see a pawn sacrifice. But there are no real consequences for the government(s) and its institutions. That is the real problem. They are immune and can simply continue one or the other way.
Actually, they learned something: That illegal path of action was revealed by a wistle. Lets use a different method next time so we do not get caught this way again. This cat and mouse play will continue forever unless and until real consequences will be put in place.
There may generally be no 'consequences' so far as individuals paying a price or individual victims receiving compensation.
OTOH, there is clearly potential for a hefty price to be paid at an international level in terms of commercial and governmental 'trustworthiness'. If a nation finds itself being shut out of certain levels of access and/or favoured status because of its lax to abysmal treatment of data (personal or otherwise) they must make the choice to either suck up the consequences to their business effectiveness and political status, or make efforts to clean up their act.
Obviously, responses will vary, and this also depends on sufficient nations of any economic and political substance actually standing up for the rights they say they believe in.
Twas always thus.
We've taken control of our border (and data) now, and given the EU control over its border and data, but now the Tories complain that other countries have control over their borders. A potential consequence would be for the new UK data regulations to force more UK businesses to move.
Exactly not this; "Far from being a reactionary move against a former member state".
Expect a continuing stream of reactionary statements and decisions from various EU bodies against UK interests, because they can and any member state leaving the EU can't be seen to better off outside of the club, else what might happen then...
Did you read the article or just get to the first paragraph before Brexit Tourrettes kicked in? This is consistent with treatment of other 3rd countries and how UE internal data policy is being assessed.
Approach it from the other direction then, do you think that the current British law embodies best practice on data privacy which other countries should emulate? The EU Home Affairs Sub-Committee of the English House of Lords doesn't and had concerns on the subject back in 2017. Would you be happy with your data being processed in a country with data privacy laws equivalent to Britains?
I read and understood the entire article thank you very much, Anonymous Coward. I'm glad you have brushed up on you distance mind reading skills and determined my Brexit position. Life must be so easy for you with such skills.
If you took the time to understand what I was saying rather than reacting to your own bias, I was indicating that there might be more going on than first meets the eye. You with your super skills surly didn't miss that did you?
The EU Committee is as I said before and EU entity which might have more than one agenda. The same is true of the house of lords although they do tend to be collectively more sensible. I also agree that it is something that we should all be at least aware of, especially those who don't normally bother about such things.
To answer your question, I don't have much choice in the matter, I never have had. The genie is out of the bottle. My data is everywhere. Has always been. Being happy or not about it doesn't make any difference. What I can do is be aware of it and take whatever actions I need to mitigate any negative effects.
p.s. I'm not suggesting that we shouldn't have laws that enshrine our collective opinions on good practice around data storage and processing. That would be a good thing. Just that I'm not counting on entities to really care two hoots about our laws if their data center is in outer freeze to death or other pressing considerations are deemed more important.
"My data is everywhere. Has always been."
Your future data could be better protected. Which might just save you from having your identity stolen followed by the contents of your bank account. Or some other unwanted or embarrassing outcomes.
You data has only recently been "everywhere", it wasn't before the internet was invented.
Society is still playing catch-up as to what the implications of mass information gathering are. It is already usable to swing elections, and perhaps even destroy countries without needing any conventional war.
Joolz's data might be everywhere, but mine is not. I choose what data I put where (like I choose to use my name on this site, but not on others, and no one short of the courts or the security services is likely to be able to link them together).
Politicians should beware that people like me will campaign (and vote) against them if they start allowing my data to transfer to countries like Japan and the US (let alone the bloody TPP).
@Graham Cobb "I choose what data I put where"
I commend your stance, but are you absolutely sure that your bank, your doctor's outsourced online prescription ordering system, your employer's email, personnel records and payroll systems, any online job application site you might ever have to use, any online shopping website you might happen to use, and goodness knows what else, haven't already made unfortunate choices about where they have decided to store your data for you? I suspect that the vast majority of them (if they even know or vaguely care about such matters) will have seen the worthless self-certified Safe Harbor Privacy Shield Max, what do we call the new green curtain this month? "guarantees" and thought no further about it.
I'm with GP.
Things like this: " GDPR does not grant the same rights to those subject to an immigration procedure" are just thinly disguised attempts to cast immigration policy as data protection policy. Bugger all to do with the actual subject, just trying to extend the treaties UK is signed up to, to cover all the rest as well.
Keep in mind that the same day EU ratified GDPR, they also ratified a PNR law.... where they collect all manner of airplane passenger details, route, connections, payment details, IP address, email addresses, everything, on passengers flying in planes and hand them over to other states, "because these EU passengers might be terrorists", so you'll forgive me for thinking the EU is more show than substance on data protection.
EU intentionally collects massive amounts of data on its people and shares that with other states on flimsy reasoning.
It wouldn't surprise me if EU signed a PNR data exchange with Belarus so Belarus could capture "terrorist" on board overflying Ryanair planes much easier than having to track them. That honeypot of data they compiled was already grabbed by Russia via a one sided Russian law. They pre-emptively stripped privacy rights, and other states grabbed that data, and EU is powerless because of its own divisiveness.
So oooo EU bitches about UK data protection and how it doesn't allow for {massive linkage to everything else the EU has done to its own people}. Well so what, that's politics. Go f**k themselves.
"do you think that the current British law embodies best practice on data privacy which other countries should emulate"
And you? If UK is stripped of its status, then it won't be getting EU data and EU won't be getting UK data. You're pretending to be about "data protection" right? So that's a good thing right? No spewing private UK data to the EU is *good* right?
Right?
You wouldn't for example, want all UK Ryanair data sent to Belarus via Hungary for example?
> And you? If UK is stripped of its status, then it won't be getting EU data and EU won't be getting UK data. You're pretending to be about "data protection" right? So that's a good thing right? No spewing private UK data to the EU is *good* right?
You seem to have ignored quite an important bit here in your hope to make a point.
Weakened protections in the UK likely also mean that our (i.e. those of us in the UK) data is being spewed somewhere else. It might not be going to the EU - with their *good* protections - anymore, but if it's instead going to the US (where their approach to data protection is to laugh, say fuck off and carry on) or somewhere else, then it's not really an improvement is it?
The other thing you're ignoring, in the typical euro-sceptic manner, is the impact that the loss of adequacy may have on UK businesses (and by extension those employed by them). If there's no adequacy, then a whole load of data-processing businesses end up far less viable.
The problem with you lot, is it's always about scoring one over the EU, rather than taking anything approaching an objective view on cost/benefit.
EDIT: Just to add
> GDPR does not grant the same rights to those subject to an immigration procedure" are just thinly disguised attempts to cast immigration policy as data protection policy
If you'd bothered to read the linked article, you'd know this view is umitigated bollocks.
The exemption is something they tried to squeeze into the DPA twice before GDPR was even a thing, and failed, precisely because it was so roundly condemned - Our own politicians wouldn't accept it when first mooted, it's hardly a EU specific thing to be opposed to the idea of denying immigrants something viewed as a fundamental right.
[...]it's hardly a EU specific thing to be opposed to the idea of denying immigrants something viewed as a fundamental right.
Indeed, one of the founding principles of the EU is human rights, because it was formulated in the shadow of the second world war (when Churchill himself advocated for a "United States of Europe"). The whole idea is to prevent the atrocities that happened then, which was, in very general terms, about some people being denied the rights that others enjoy, because they are "untermenschen". The far-right government, and right-wing press, in this country, seem to like to portray asylum seekers in very much the same way the far-right government in post-Weimar Republic Germany* viewed "undesirables". They didn't start by rounding people up and executing them in concentration camps, they started by rounding up disabled people and sterilising them, before moving onto "euthanising" them, and then widening their gaze to others they decided were subhuman. We would do well to recognise the pattern here, as soon as one group of humans is decreed to be less human than you or I, you have already set a precedent.
No person is illegal, only a person's actions - once you start talking about "illegal immigrants" you are talking about "illegal humans". Once you derogate the rights of one group on these grounds, you leave a mile-wide path for a right-wing government to start designating others as "illegal". With the "you-know-who"s in the 1930s and '40s, it started with disabled people, then homosexuals, Jews, the Roma and Sinti, Slavic peoples, and so on. Read that Martin Niemöller quote again if you must. I'm not convinced we don't have people in power here and now that wouldn't share some of the same attitudes, and they make themselves known by attacking human rights.
*You all know who I'm talking about, right? No need to invoke Godwin's Law here.
Well, as a simple counter to that particular claim, here is that Churchill quote in full, for the "I can't use google" mob.
There is a remedy which ... would in a few years make all Europe ... free and ... happy. It is to re-create the European family, or as much of it as we can, and to provide it with a structure under which it can dwell in peace, in safety and in freedom. We must build a kind of United States of Europe.”
Note how Churchill, very explicitly, and repeatedly, uses the word we. "We must build...", not "someone else must build". Churchill was an utter arsehole in a number of ways, but he was right on that one. It is quite clear, if you look back at many of the things he said on the matter, that he was very much for what is now known as the EU, and he was also very much for the inclusion of the UK at its heart. I know you like to paint the EU as some sort of devilish enemy, and I'm guessing that you are also a fan of WC, but you are engaging in male bovine excrement projection once again if you think his opinions on this matter coincide with yours.
Churchill's United States of Europe is often trotted out in defence of the EU and it's tiresome and disingenuous. The EU does not resemble the United States, if it did I suspect the UK would still be in it. Key differences you'll notice are that the US isn't run by a commission and that the federal government isn't trying to standardise every state law centrally.
@Loyal Commenter
"Note how Churchill, very explicitly, and repeatedly, uses the word we."
Yes he does use the word we. It seems he was of the belief that we needed to support the development of them forming a United States of Europe, to which we are not part of. From his own writings-
‘We are bound to further every honest and practical step to which the nations of Europe may make to reduce barriers which divide them and to nourish their common interests and their common welfare.
‘We rejoice at every diminution of the internal tariffs and the martial armaments of Europe. We see nothing but good and hope in a richer, freer, more contented European commonality.
‘But we have our own dream and our own task. We are with Europe, but not of it. We are linked, but not comprised. We are interested and associated, but not absorbed.’
So yes he wanted the UK to help them build a structure that stopped them buggering up Europe regularly. But recognised the UK was different enough to not fit in with that idea.
"but you are engaging in male bovine excrement projection once again if you think his opinions on this matter coincide with yours."
Sorry to smack the idiot so publicly but you are the one who mentioned Churchill as you were trying to claim his opinions coincide with yours.
so I googled and found a speech by WC September 19, 1946. University of Zurich that contained the phrase
We must build a kind of United States of Europe.
I found https://winstonchurchill.org/resources/speeches/1946-1963-elder-statesman/united-states-of-europe/
If at first all the States of Europe are not willing or able to join a union we must nevertheless proceed to assemble and combine those who will and who can. The salvation of the common people of every race and every land from war and servitude must be established on solid foundations, and must be created by the readiness of all men and women to die rather than to submit to tyranny.
In this urgent work France and Germany must take the lead together.
Great Britain, the British Commonwealth of Nations, mighty America — and, I trust, Soviet Russia, for then indeed all would be well —
must be the friends and sponsors of the new Europe and must champion its right to live.
Therefore I say to you “Let Europe arise!”
reading the speeches in their entirety does indeed provide a different narrative to when selective quotes are cherry picked & quoted with omissions and the sources not provided.
He's clearly stating he regards the UK, US & USSR as friends and enablers of the EU not members of it.
>Weakened protections in the UK likely also mean that our (i.e. those of us in the UK) data is being spewed somewhere else. It might not be going to the EU
The issue isn't the export of UK data - as the UK is now outside of the EU, it can go anywhere in the world that the UK government thinks has adequate protections... So the only question here is: do you trust the UK government, which it would seem the answer is probably no, yet sufficient numbers voted for them to be sovereign and thus a "law unto themselves"...
The issue here is however about data leaving the EU and potentially being processed by UK businesses and the protections the UK government would actually enforce to prevent that data being misused or being re-exported... I suggest this isn't "the other thing", but the main thing. If the UK can't process EU data who else in the world is going to trust their data to UK processors?
@Julz - Thanks for providing an example nicely illustrating the point I was going to make:
Whilst it might be "Far from being a reactionary move against a former member state", we can expect vested interests in the UK - including the current Conservative government, to present it as something totally different.
I assume in your worldview, it was the EU that forced the UK government to ignore GDPR (which it signed into law) and initiate the NHS GP patient data grab...
Bye the way, I agree we can expect a continued stream of highly biased reporting in the UK press highlighting niche opinions held by various individuals, because it suits the message they want their readers to believe ie. keep them plyable.
Except, nothing has changed, except the UK is no longer in the EU.
It has always tried to side-step its obligations under GDPR, and regularly got its knuckles wrapped and sent to the naughty step in the process. Now, it is outside and will actually have to fulfill those obligations, if it wants to continue.
And, as the article says, it isn't alone, the US has been in this boat for the best part of a decade, with successive treaties sorted out and then blatantly ignored by the US, until the treaty gets annulled by the EU courts and they have to start all over again.
@Julz
I am not sure this is particularly an anti-UK thing, its more to do with the EU wanting to be a big fish while not having the relevance to enforce its will in the big pond (or even its own members).
Also not an EU only problem but the lack of funding to enforce ever expanding rules is a government problem everywhere even with infinite money.
The EU has had plenty hissy-fits against the UK for brexit (which has kept us entertained) but this is just the EU bureaucracy demanding people dance to their tune and bewildered at people inside and out ignoring them.
I love the way, that, in your mind, a deeply divided island nation of circa 70 million people off the coast of a continental bloc with a population of circa 450 million, and facing down a continental superpower on the opposite side of the Atlantic with a population of circa 330 million is somehow the "big fish".
You do know the British Empire is no longer a thing, right? Queen Victoria is long dead, and India decided they didn't want to be owned by a foreign power some while ago?
We would do well to remember that the modern world is divided between progressive modern democracies and international pariahs. We should tread carefully lest we become the latter, especially with our current government which is the most insular and idiotic in living memory.
@Loyal Commenter
"I love the way, that, in your mind"
I get the feeling you might have read what you wanted to read instead of what is written. The point of the EU was to be a 'big fish' in the world like the US, China, etc but there isnt much success with that. Bowing to Russia, Turkey holds them ransom and the US is still the de-facto western power.
And back to GDPR which they struggle to enforce in their own borders never mind trying to convince the outside world to bow to it.
"We would do well to remember that the modern world"
Is still much bigger than the EU.
@Roland6
"Which is an order of magnitude bigger than the UK..."
So what?
"And the trouble is that there are many who think that 'etc' includes the UK..."
Some people might think that and in some respects we punch above our weight, but there are also people who overestimate the EU's clout in the world.
Facts and figures on the EU’s position in global markets
The EU is the largest economy in the world. Although growth is projected to be slow, the EU remains the largest economy in the world with a GDP per head of €25 000 for its 500 million consumers.
The EU is the world's largest trading block. The EU is the world’s largest trader of manufactured goods and services.
The EU ranks first in both inbound and outbound international investments
The EU is the top trading partner for 80 countries. By comparison the US is the top trading partner for a little over 20 countries.
The EU is the most open to developing countries. Fuels excluded, the EU imports more from developing countries than the USA, Canada, Japan and China put together.
The EU benefits from being one of the most open economies in the world and remains committed to free trade.
The average applied tariff for goods imported into the EU is very low. More than 70% of imports enter the EU at zero or reduced tariffs.
The EU’s services markets are highly open and we have arguably the most open investment regime in the world.
The EU has not reacted to the crisis by closing markets. However some the EU’s trading partners have not been so restrained as the EU has highlighted in the Trade and Investment Barriers Report.
In fact the EU has retained its capacity to conclude and implement trade agreements. The recent Free Trade Agreements with South Korea and with Singapore are examples of this and the EU has an ambitious agenda of trade agreements in the pipeline.
@AC
"So it is on-topic in this thread"
Again I dont know why you are posting AC (assuming the same one) as it was a fairly reasonable comment.
"It was, of course, a reply to your previous post about "overestimating the EU's clout"."
What you posted doesnt really say much about the EU's clout in the world. The EU is trying to impose GDPR (right or wrong) on the world but to do so requires being taken seriously, and that seriously, by the world. A tough push for the EU.
Also China and the US (under Trump) started work on their own initiatives-
https://www.euractiv.com/section/data-protection/news/global-data-transfer-uncertainty-undermines-eu-digital-ambitions/
You're confused, unsurprisingly.
When you say "The EU is trying to impose GDPR on the world" you mean that corporations with servers outside the EU dealing with data belonging to citizens inside the EU must follow the EU's privacy rules. The EU had the power to do this due to its "clout", its place in global trade.
From your own link: Japan, Brazil, and South Korea's privacy laws are based very much on GDPR and the US and China are drafting their own privacy laws, and they're also basing them on GDPR.
The EU came up with a world first and led the way on privacy for its citizens and achieved what others couldn't do until then. Smaller countries copied it and the other two big blocs are also in the process of copying it.
But on Planet Codejunky this is somehow a point against the EU.
@AC
"When you say "The EU is trying to impose GDPR on the world" you mean that corporations with servers outside the EU dealing with data belonging to citizens inside the EU must follow the EU's privacy rules."
That would be imposing its rules on the world.
"The EU had the power to do this due to its "clout", its place in global trade."
And that is where we will see if the EU has such clout as it struggles to be taken seriously.
"The EU came up with a world first"
That would explain the line "based on GDPR" from your previous paragraph.
"Japan, Brazil, and South Korea's privacy laws are based very much on GDPR"
Some countries have gone along with it.
"US and China are drafting their own privacy laws"
China "followed up with a draft Personal Information Protection Law (PIPL), a privacy framework broadly inspired by GDPR" (from source). How broad? Apparently its very China oriented in excluding government etc.
And the US has yet to meet the GDPR adequacy rules over how many iterations of privacy shield? Which of course comes back to if they are pushing their own initiatives will they bow to GDPR, which is where I am not convinced.
"Smaller countries copied it and the other two big blocs are also in the process of copying it."
Except it seems they are not copying it.
"But on Planet Codejunky this is somehow a point against the EU."
Are you just Dr.N trolling but as AC now or some other troll who doesnt want to put their name to tripe?
Some countries have gone along with it.
You really have no understanding and it's your own source. They have made their own privacy law, inspired by the EU directive, to protect their own citizens. Meaning foreign countries (including EU ones) will have to protect Japanese, Brazilian, and South Korean citizens' data inside these countries.
How broad? Apparently its very China oriented in excluding government etc.
From your own source:
Experts note that PIPL, if adopted in its current form, would see China ensure greater data protection than in the US, as well as limit the power of Chinese public authorities.
Which of course comes back to if they are pushing their own initiatives will they bow to GDPR, which is where I am not convinced.
The two laws will apply in different regions, one protecting US citizens' data and on protecting EU citizens' data. Nobody's bowing to anyone.
Except it seems they are not copying it.
You'd better take it up with your source then.
The EU has had issues with the data protection regime in the UK for a long time, but while we were a member we had protection from sanction over it.
The WP29 committee for the old Data Protection Directive (that DPA98 was based on) have had concerns for 20 or so years about the UK regime and its implementation.
There were 3 grounds that they had an issue with, well before the GDPR was even formulated, and after its enactment, the UK's implementation is far from flawless.
The Commission is - or is allegedly - composed of decision makers with subject matter experts as advisors. The Parliament is a bunch of self-elected, self-serving politicians with an axe to grind and a vested interest in "persuading" organisations - especially financial service institutions - to leave the UK and set up business in EU nations (normally but not always France and Germany).
The Commission says what the UK have is adequate (not perfect). The politicians disagree.
Quelle surprise.
Oh well.
The Commission is where all the sk. unelected bureaucrat sit while those not unelected are, called politicians, because they are elected.
The Commission has no power except for the power they are given by the "elected", in the Council of the European Union and the EU Parliament.
There is a rather a kind and easy video by Radoslaw Sikorski in the University of Greenwich on topics like that.
https://www.youtube.com/watch?v=pI54yarKz_o&t=561s
PS. If everybody constantly agreed that would be a "Quelle surprise", indeed.
"The Parliament is a bunch of self-elected ..."
I don't get that. The European Parliament is directly elected by European citizens.
The fact that you get that wrong makes it a bit difficult to take the rest of your argument seriously. Or is this simply a typo and did you mean to say something different?
Sorry to break it to you but the MEPs are selected by the parties (in most EU countries). The public vote for the party they want, and then the proportion of votes is used to determine how many candidates from the parties list gets elected.
So the MEPs are self selected by the parties, but democratically elected through proportional representation, and tough luck to you if you don't think one particular candidate deserves/really doesn't deserve the job.
Or put another way the MEPs are only indirectly elected by the public.
The Commission is - or is allegedly - composed of decision makers with subject matter experts as advisors. The Parliament is a bunch of self-elected, self-serving politicians with an axe to grind and a vested interest in "persuading" organisations - especially financial service institutions - to leave the UK and set up business in EU nations (normally but not always France and Germany).
That’s backwards. EU citizens elect MEP’s who sit in the EU Parliament. The EU presidents/pm’s etc form the EU council and appoint a leader of the commission who is currently UVDL, aka Ursula. She then basically runs the commission who wields the true power in Europe rubber stamped by the Parliament.
Imagine if the US citizens voted for their state governor and then the governors vote for a president, with senators left to squabble and rubber stamp stuff, that’s kind of like how the EU works.
EU citizens can not oust the president of European commission.
"EU citizens can not oust the president of European commission."
That is a dumb comment, the president is elected for a limited time of five years.
"The president and their Commission may be removed from office by a vote of censure from Parliament. Parliament has never done this to date, however the imminence of such a vote in 1999, due to allegations of financial mismanagement, led to the Santer Commission resigning on its own accord, before the Parliamentary vote".
https://en.wikipedia.org/wiki/European_Commission
.......GDPR is (still) a joke. Supported by misinformation and lies from those who one might expect to know better.
1. Next month's NHS data slurp is "safe" because the data is "anonymised".
Link: https://www.theguardian.com/technology/2019/jul/23/anonymised-data-never-be-anonymous-enough-study-finds
2. "Your data is safe in our hands"
Link: https://www.bbc.co.uk/news/technology-56590249
Link: https://www.bloomberg.com/features/2018-palantir-peter-thiel/
Link: https://www.ft.com/content/6954971e-5d3a-11e9-939a-341f5ada9d40
So........I'm still wondering what "adequacy" actually means: Palantir and Acxiom building "big data" aggregates -- Equifax being so insecure that bad actors were stealing an unknown amount of data for an unknown period -- Philip Hammond providing £1.9 billion extra funding to GCHQ.......and on and on.
In 1999 Scott McNealy seems to have got it perfectly correct:
Link: https://www.wired.com/1999/01/sun-on-privacy-get-over-it/
"Far from being a reactionary move against a former member state, the Parliament's resolution highlights flaws in the UK's data protection regime, which will have serious consequences for citizens' rights and could lead to legal uncertainty for businesses in future."
"It was far from being the only EU state called out for these practices, however. Three years after the application of the GDPR, EU Member States’ implementation of the Regulation was recently described as “nothing but hot air”, as Data Protection Authorities (DPAs) across the EU were found to be suffering from insufficient financial resources and staffing leading to substantial discrepancies in enforcement."
is the GDPR infallibly perfect?
Yes there will be things done different in the EU just as they are done different in Asia or USA or South America, Australia, Africa.
Is it ok for the EU to let countries like Luxembourg or Ireland get away with charging less corp taxes so multinationals get to make more profits from sales in other nations?
We've left, we now need to get on with it.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
