Bonum Certa Men Certa

EPO and Microsoft Collude to Break the Law -- Part VII: Lipstick on a Pig…

Previous parts:



Safe Harbour pig
The Privacy Shield was derided by its critics as "lipstick on a pig"



Summary: The Schrems II judgment has significant implications for "cloud computing" services

As we saw in the last part, following the invalidation of the Safe Harbour by the CJEU in its "Schrems I" judgment a revised framework for regulating transatlantic exchanges of personal data was pulled out of the hat in the form of the Privacy Shield.



From its very inception the robustness of this arrangement was questioned and it was derided by its critics as "lipstick on a pig".

The hurried manner in which the Privacy Shield was cobbled together meant that it always smacked of being a flaky and legally unsound last minute political compromise between the EU and the Obama Administration.

In the eyes of its critics it was nothing more than a comfort blanket to calm post-NSA revelations nerves among non-US cloud services buyers, rather than a legally sound framework to protect data from intrusive examination by American intelligence services.

"The hurried manner in which the Privacy Shield was cobbled together meant that it always smacked of being a flaky and legally unsound last minute political compromise between the EU and the Obama Administration."The first signs that the revised arrangement might not last very long came in January 2017 during the early days of the Trump Administration when the incoming POTUS signed off on a new Executive Order on "Enhancing Public Safety in the Interior of the U.S."

Among other elements, this Executive Order directed US government agencies to “ensure that their privacy policies exclude persons who are not United States citizens or lawful permanent residents from the protections of the Privacy Act regarding personally identifiable information".

This prompted certain commentators, such as MEP Jan-Philipp Albrecht, to express concerns about the tenability of the Privacy Shield and to call for its suspension pending clarification of the legal implications of Trump's Executive Order.

The European Commission was quick to dismiss these concerns.

Others who remained sceptical about the tenability of the Privacy Shield arrangement confidently - and accurately - predicted that its days were numbered.

"The Schrems II judgment has significant implications for "cloud computing" services."The final nail in the coffin came in 16 July 2020 when the CJEU delivered its judgment in the case of Facebook Ireland Ltd. v. Maximillian Schrems – known as "Schrems II" – which not only invalidated the Privacy Shield agreement but also put other data transfer mechanisms into significant doubt.

The CJEU found that due to the possibility of access to personal data of EU citizens by US authorities, the Privacy Shield infringed EU data protection regulations because it did not provide adequate GDPR‑compliant protection of personal data.

Privacy Shield
The Schrems II judgment has significant implications for "cloud computing" services



The Schrems II judgment has significant implications for "cloud computing" services.

Private companies and public sector bodies have increasingly started to make use of cloud services in recent years and this trend is likely to continue in future. The majority of cloud services are provided by vendors located in the US. The servers for the purchased services are partly located in the US, partly in Europe.

And this is where it gets interesting.

Even if a server is located in the EU, US authorities may access the stored data. This access is possible because of the FISA (Foreign Intelligence Surveillance Act) 702 and the EO (Executive Order) 12.333 which apply to all Electronic Communication Service Providers headquartered in the US.

"The majority of cloud services are provided by vendors located in the US. The servers for the purchased services are partly located in the US, partly in Europe."Merely relocating the data to an EU-based region in these clouds is not sufficient, because the problem is not geographical in nature.

The decisive issue here is that US-owned cloud vendors are subject to US jurisdiction and US legislation can be used to them to hand out customer data to the US government, even if the servers storing that data happen to be located on foreign soil.

USA spying on EU
Even if a server is located in the EU, US authorities may access the stored data via FISA (Foreign Intelligence Surveillance Act) 702 and the EO (Executive Order) 12.333 which apply to all Electronic Communication Service Providers headquartered in the US.



In essence, the Schrems II judgment means that US-based cloud providers such as Google, Amazon Web Services (AWS), and Microsoft Azure cannot be used to store data about European citizens in a GDPR-compliant manner.

In December 2020 it was reported that the Swedish data protection authority had imposed the first GDPR-based fine for lack of adequate protection of sensitive data stored in a US‑based cloud platform after the Schrems II decision.

"In December 2020 it was reported that the Swedish data protection authority had imposed the first GDPR-based fine for lack of adequate protection of sensitive data stored in a US‑based cloud platform after the Schrems II decision."In that case the UmeÃ¥ University in Sweden was fined SEK 550,000 (approx. € 54,000) because it was found to have processed special categories of personal data concerning sexual life and health using storage in a cloud service of a US-based provider, without sufficiently protecting the relevant data.

The Swedish data protection authority referred to the Schrems II judgment and took the stance that per se a data transfer to the US triggers a high risk for personal data because data subjects are limited in protecting and enforcing their privacy rights.

In the next part we take a further look at the fallout from Schrems II in Europe and how the judgment has given new impetus to the discussion about European "data sovereignty".

Recent Techrights' Posts

Google Spreading Misinformation and Lies
Google is in the propaganda business
New Video Report About Microsoft Cancelling Multi-Billion Dollar Projects
direct link to the video
Microsoft is Already Laying Off Lots of Contractors
cost-cutting at Microsoft takes a new "edge"
Coming Soon: Microsoft Fake Results, Mass Layoffs, and Silence About All the People Microsoft Pressured to "Quit" (So That They Don't Get Counted as Layoffs)
there will be more mass layoffs
 
Just Sending More and More Threats Does Not Change the Fact We Got Abused for Many Years and Women Got Strangled
Wanting a "gag order" - or sometimes injunctions - by sending many threats
Links 29/04/2025: Water Scarcity, LLM Slop Backfiring Again in Legal Documents
Links for the day
statCounter: GNU/Linux Adoption Surging in Switzerland, Windows at All-time Low
What happened?
Gemini Links 28/04/2025: Free Speech and Perfectionism in Design
Links for the day
What Fake News Looks Like (IBM)
IBM told a lie. The media then just blindly repeated this lie.
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Monday, April 28, 2025
IRC logs for Monday, April 28, 2025
China is Already Culling GAFAM (Not Just Microsoft Windows)
OS monoculture or "OS hegemony" may be coming to an end
The "Telephone Operating System in the Vatican" is 95 Years Old, Vatican Moved to GNU/Linux
Maybe Microsoft is down to zero already
If Tesla Shares (and Alleged Value) Fell 55% (From $489 to $222) in a Few Months Maybe It's Not Worth Anything At All (It's Just Gambling)
Tesla swasticars have turned from a "status symbol" into a "public embarrassment" and cause for casual humiliation
Chromebooks' Adoption in Sweden No Longer Depends on Schools
School breaks are when classrooms are shut
No, IBM is Not Investing $150 Billion in the US and It Doesn't Even Have That Kind of Money
Here we go again... media as a vehicle of lobbying and misinformation
Leak: The EPO's General Consultative Committee (GCC) Does Not Consult Staff on Crucial Matters and Bypasses the Administrative Council (AC) to Do Illegal Things
violations against the EPO's very staff
New Leaks Coming Soon, We Maintain 100% Record of Successful Resistance to Censorship
We won't be told what we can and cannot say (especially when it's true)
Central African Republic (CAR): Vista 11 is Only ~0.2% Market Share
99.8% to go!
BSD and GNU/Linux Replaced Microsoft in Secure Servers, All Microsoft Has Left is LLM Slop for Fear, Uncertainty, and Doubt (FUD)
the FUD machine never rests
Gemini Links 28/04/2025: A Simple Task Tracking and Auto-Prioritization Tool and Other Programs
Links for the day
Links 28/04/2025: Canada's Election, Pakistan-India Conflict
Links for the day
Speed of GNU/Linux
The media seldom speaks of the dangers of "proprietary software"
Glue Inside Your Pizza (or Why People Will Get Fed Up With Slop)
People are given "answers" from non-intelligence word dumpsters
Proprietary Windows Versus "Linux" News (Trying to Keep People on Windows, Never Exploring GNU/Linux)
Good editors know better how to recognise threats and not give them lip service
Ensuring That Every Computer User Anywhere in the World Can Take Control of All His or Her Computers
We must fight the people who attack general-purpose computing, in particular those who push this agenda very aggressively inside Linux
Links 28/04/2025: Cyberattacks Happening, Chatbots Disappointing, and "Free Speech Under Fire"
Links for the day
Phone Adoption Very Low in Vatican, Windows Usage Fell Nonetheless
Even in places where people still use desktops/laptops most of the time (and have access to these) Windows is gradually losing ground
GNU/Linux 9% in Cuba, Vista 11 Waning, Android Dominant
Microsoft has pretty much lost Cuba
Gemini Links 28/04/2025: Autism and Structural Navigation
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Sunday, April 27, 2025
IRC logs for Sunday, April 27, 2025
What Happened to the Open Source Initiative (OSI) Elections: The Purge, the Cover-up, and the Witch-hunts
OSI has gone "full Microsoft"
In 24 Countries Observed by statCounter Vista 11 is Still Less Than a Quarter of Windows Users Despite All Other Versions Being 'Expired'
They ought to move to GNU/Linux
Links 27/04/2025: Pope Goodbyes, "Politics of Fear", Slop Redux and More Google Shutdowns (Google Debt Had Grown This Year)
Links for the day
Links 27/04/2025: Serenity Dialectics, Hockey Jersey Ethics, and More
Links for the day
Links 27/04/2025: Death of Nest Thermostats, Death of Metaverse
Links for the day
Links 27/04/2025: Projects Workflow and Discovering Technology
Links for the day
Over at Tux Machines...
GNU/Linux news for the past day
IRC Proceedings: Saturday, April 26, 2025
IRC logs for Saturday, April 26, 2025