> Parallel to this we need a federal national data privacy law that protects us but also cracks down on the huge industry of data brokers selling Americans’ data to anyone that has cash.
And also dismantle the law where the US can request any data on any person, even abroad, if the company is US-based
I believe the underlying narrative of TikTok was with government control the algorithms would be purposefully tuned to promote disorder elsewhere which is a level of control the U.S. government does not have over U.S. companies and they were jealous (although with the level of information control during Desert Storm I am not 100% certain on that). However, I think this law was very premature and should have required evidence of tuning or actual war. While soldiers may have apps they should not the spies should know better.
The China side where they have banned encryption apps also seems to be war preparation. A digital iron curtain while depressing for the population behind it is not something that can be torn down from the outside. A per app legal war seems an unfeasible use of congressional time when many Chinese smart device control apps require location to function and are on many phones. This also appears to be an opening shot by congress for putting up a U.S. national firewall if TikTok just leaves all US offices and continues business through web based offerings.
Also, unlike the Bytedance and the Chinese Government, US companies do not run intelligence operations. They are in it solely for the money, otherwise the NSA wouldn't have had to snoop on Google in 2013(?).
and this point
> And also dismantle the law where the US can request any data on any person, even abroad, if the company is US-based
I find questionable. It is too blanketed. There are international criminals afoot after all. Red Letters do have their purpose as do international treaties for law enforcement to cooperate across borders in a bespoke manner in accordance with their and international laws.
There's a difference between "Hey, France, we would like this info on a known criminal" and "U.S.-based companies have to turn over all data on any person regardless of that data location or the nationality of the person in question".
That's basically the basis for both Schrems I and Schrems II.
Edit: See also CLOUD Act https://en.wikipedia.org/wiki/CLOUD_Act
--- start quote ---
The CLOUD Act primarily amends the Stored Communications Act (SCA) of 1986 to allow federal law enforcement to compel U.S.-based technology companies via warrant or subpoena to provide requested data stored on servers regardless of whether the data are stored in the U.S. or on foreign soil
--- end quote ---
This is crucial. Legal due process. Also
> ..... U.S.-based technology companies ....
Other jurisdictions have something similar, every company must adhere to the laws of the jurisdiction they want to operate in. You don't like it as a company, not a problem just don't incorporate in the US and live with the repercussion.
There is nothing that suggests that it is out of the ordinary or malicious.
Where it becomes interesting is access without a warrant, or with a muzzle attached, at large scale. That is the clandestine stuff. The purview of intelligence agencies.
That has been addressed by the EU with legislation; privacy shield was not really the hit, but guess what: MS complied. https://www.reuters.com/technology/microsoft-roll-out-data-b... so spooks from the US will now have a harder time accessing user data at scale without a warrant.
That is entirely US-based and ignores any laws or regulations of other countries.
> Other jurisdictions have something similar, every company must adhere to the laws of the jurisdiction they want to operate in.
The key: operate. The US claims data from those companies even if the data and the operations happen in foreign countries.
> That has been addressed by the EU with legislation
EU legislation does not negate US laws. CLOUD Act is still there. And that is a huge issue for any country dealing with US companies.
Is this a joke?
This is already in process in case of EU: https://noyb.eu/en/update-cnil-decides-eu-us-data-transfer-g...
Absolutely.