Comment by jeroenhd | Hacker News Reader

Comment by jeroenhd | Hacker News Reader

Parent Full thread

Privacy Shield is dead, long live privacy shield.

I wonder how many attempts it will take for this deal to be considered legal before the US actually has to do something to hold up their end of the deal. The US government would scream in rage if Germany would ever demand the ability to order Microsoft or Google to hand over information about US citizens in complete secret, yet the EU wil gladly take the word of the US government that it won't happen.

The EU also has plenty of incentive to encourage keeping data within the boundaries of its member states. Making it difficult to use American tech giants as a lazy quick fix for data storage instead of looking at local alternatives only helps limit the amount of money taken from the European economy. With the scandals and state of the current US government I find it hard to believe the EU will be able to draft a new agreement like this with the US without compromising on the rights of their citizens.

> Privacy Shield is dead, long live privacy shield.

Apologies for being pedantic, but "The king is dead, long live the king" is referring to two distinct uses of the word king. It is equivalent of "The old monarch is dead, long live the new monarch".

So for this to work in your case it would need to be:

"Privacy Shield is dead, long live new-replacement-law"

But without a replacement law, the phrase just doesn't work.

My point was that there will probably soon be a new, similarly lacking Privacy Shield with a similarly silly name (Secure Data Exchange Act? Privacy Protection Plus? Data Protector Agreement?).

We don't know the name of the new law yet, but Privacy Shield was quickly implemented because the agreement before it was deemed insufficient, and the same will likely happen again.

That's probably why the first Privacy Shield was capitalized, but the second was not.

The US never will.

Well, I guess the truth is, personal data of EU and US citizens is sent in secret to european agencies all the time. Such institutions are all exempt from GDPR.

EU and member state institutions and agencies are not universally exempt.

There are some specific justifications that are scoped to government use only, in areas such as law enforcement or collection of statistics. But agencies still need to implement the law, document the specific requirements for any type of data they collect, observe time limits on retention, produce transparency reports, and so on.

We can't trust the intelligence agencies in the U.S., China, Russia, Australia, or Britain but of course the EU's agencies are trustworthy. After all, everyone knows there's nothing more effective than a European court and nobody more honest than European bureaucrats.

Reply on news.ycombinator.com