Hacker News Reader

Comment by AlanYx | Hacker News Reader

Can anyone explain how this relates to the EU-US Data Privacy Framework (also sometimes called the Trans-Atlantic Data Privacy Framework)?

I thought that that framework was supposed to allow this (as a replacement for the EU–US Privacy Shield framework)? Presumably this wouldn't have been a problem under Privacy Shield (i.e., pre-2020), or am I getting that wrong?

View on HN

This article[1] by the Dutch DPA has some details about it: The Privacy Shield was invalidated in 2020, leaving only the Standard Contractual Clauses as a valid transfer tool. Uber stopped using Standard Contractual Clauses in August of 2021, before adopting the new Privacy Framework in 2023. For a period of two years they were transmitting extremely sensitive information without a valid way to do so.

[1]: https://www.autoriteitpersoonsgegevens.nl/en/current/dutch-d...

Thanks. That gives a lot more information. With respect to the new framework, the article you linked to just says "Since the end of last year, Uber uses the successor to the Privacy Shield." Do you know if the Dutch DPA endorsed the new framework, or did they leave it ambiguous/unresolved as to whether post-2023 transfers are GDPR compliant?

I don't think endorsing the new framework is something the DPA does. The EC declared the new framework adequate[1], Uber got certified for it[2], so there is now a valid method in place for Uber to transmit data.

[1]: https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae6... [2]: https://www.dataprivacyframework.gov/list (no deeplinks for some reason)

You are getting this wrong.

Basically the framework, like the Shield before, is the Commission trying to show "look, we fixed it".

Sadly, for the previous two times, the ECJ pointed out after the fact that no framework can fix the lack of data privacy law in the US, and that as such, the Shield, just like its predecessor, was not allowing what it claimed to do.

The Framework has not been tested in the ECJ so far, but the US has not significantly altered its laws so...

Thanks. So basically the new framework hasn't accomplished anything that can be relied upon when architecting a system to reduce the risk of GDPR compliance issues?

Depends who you talk to.

Reply on news.ycombinator.com