Tech Giants Evade EU-US Data Transfer Rules Post-Schrems II Ruling
Tech Giants Ignore Questions Over Legality of EU-US Data Transfers
A Deep Dive into the Post-Schrems II Landscape
A survey of responses from over 30 companies to inquiries about their EU-US data transfer practices following the landmark Schrems II ruling reveals a concerning trend: widespread avoidance and a lack of concrete compliance measures. The ruling, which invalidated the EU-US Privacy Shield due to US surveillance overreach, has left many companies in a state of legal uncertainty, with many appearing to "bury their head in the sand."
The Noyb Report: A Critical Analysis
European privacy rights group noyb (None of Your Business) has meticulously documented the responses, or lack thereof, from various tech entities. Their 45-page report details the answers provided by EU entities of 33 companies to questions concerning their legal basis for transferring EU citizens' data to the US after the Schrems II decision. The findings are stark, with many responses described as "astonishing" or entirely absent (AWOL).
Key Findings and Company Responses:
- Widespread Non-Compliance: A significant number of companies failed to provide adequate responses or any response at all, indicating a potential lack of preparedness or a deliberate attempt to sidestep the issue.
- Boilerplate and Evasive Answers: Companies that did respond often resorted to generic, "boilerplate" responses or pointed to existing privacy policies, hoping to deflect scrutiny.
- Specific Company Examples:
- Apple, Netflix, WhatsApp, Airbnb: Named by noyb as companies that failed to respond.
- Facebook: Made repeated claims that the requested information fell outside the scope of the EU's data protection framework and provided evasive answers.
- Slack: Stated it does not "voluntarily" provide government access to data, which noyb points out does not address whether they are compelled to do so under surveillance laws like FISA 702.
- Microsoft: Claimed reliance on Standard Contractual Clauses (SCCs) but, as a company subject to US surveillance laws (explicitly named in Snowden's disclosures), faces scrutiny over how it can legally use SCCs if user data is not adequately protected from mass surveillance.
The Legal Framework and Regulatory Scrutiny:
- Schrems II Ruling: The Court of Justice of the EU (CJEU) clarified that the use of SCCs for data transfers is contingent on a case-by-case assessment of data safety. If data is not adequately protected, data controllers are legally required to suspend transfers.
- Regulatory Duty: EU regulators have a clear duty to act and suspend transfers where data is at risk.
- EDPB Guidance: The European Data Protection Board's guidance emphasizes that legally using SCCs to transfer data to the US requires a guarantee that "U.S. law does not impinge on the adequate level of protection" for the transferred data.
- Noyb's Complaints: Following the ruling, noyb filed 101 complaints against websites still using Google Analytics and/or Facebook Connect integrations, both of which involve companies subject to US surveillance laws.
- Max Schrems' Advocacy: Max Schrems continues to push the Irish Data Protection Commission (DPC) for enforcement action against Facebook's use of SCCs.
The Path Forward and Industry Implications:
- Urgent Need for Reform: The situation highlights the critical need for reform of US surveillance laws to ensure adequate data protection for EU citizens.
- Industry-Wide Impact: The legal uncertainty surrounding EU-US data transfers has profound effects on numerous digital businesses.
- Potential Solutions: Suggestions include federating services (splitting infrastructure) or storing and processing data within Europe.
- Enforcement Pressure: With numerous complaints filed and regulatory bodies under ECJ instruction, there is significant pressure on EU data supervisors to enforce data protection laws.
Conclusion:
The tech industry's response to the post-Schrems II data transfer landscape is largely characterized by avoidance and a lack of clear strategies. Companies must proactively address data protection concerns and comply with legal requirements to avoid regulatory action and maintain user trust. The ongoing legal battles and regulatory scrutiny underscore the importance of robust data privacy measures in the digital age.
Image: A graphic illustrating the flow of data between the EU and US, highlighting potential surveillance points and legal challenges.
Infographic: A flowchart showing the steps companies should take to ensure compliance with data transfer regulations post-Schrems II.
Chart: A bar chart comparing the response rates of different tech companies to noyb's data transfer inquiries.
Diagram: A conceptual diagram illustrating the implications of US surveillance laws on EU-US data transfers and the role of SCCs.
Video: A 30-second video explaining the Schrems II ruling and its impact on international data transfers, featuring animated graphics and a clear voiceover.
Topics Covered:
- Data Transfers
- Europe
- Noyb
- Policy
- Privacy
- Privacy Shield
- SCCs
- Schrems II
Related Articles:
Author: Natasha Lomas, Senior Reporter at TechCrunch.
Social Media Shares:
Most Popular Articles:
- Cognition, maker of the AI coding agent Devin, acquires Windsurf
- Marc Andreessen reportedly told group chat that universities will ‘pay the price’ for DEI
- Windsurf’s CEO goes to Google; OpenAI’s acquisition falls apart
- Grok 4 seems to consult Elon Musk to answer controversial questions
- Elon Musk’s xAI launches Grok 4 alongside a $300 monthly subscription
- YouTube prepares crackdown on ‘mass-produced’ and ‘repetitive’ videos, as concern over AI slop grows
- Perplexity launches Comet, an AI-powered web browser
- ChatGPT: Everything to know about the AI chatbot
- Tech Layoffs 2024 List
Original article available at: https://techcrunch.com/2020/09/28/tech-giants-are-ignoring-questions-over-the-legality-of-their-eu-us-data-transfers/