US Supreme Court Just Blew Up EU-US Data Transfers
noyb.eu
noyb.eu
The treaties and deals he has managed to torpedo by forcing courts to uphold privacy laws is insane (and impressive).
I think this is kind of a ticking time bomb with a lot of companies depending on personal devices for 2FA.
Where "access" is specifically defined as full functionality on a device of an individual's choice, and offers safe harbor for example options. Like HTML over HTTP (without javascript) or REST APIs.
This should be built on top of existing accessibility requirements, with the goal of preventing not having a Google / Apple smartphone from being an access barrier.
"Covered services" should be defined two-fold, either by market share above a certain threshold or services that are required for normal life/studying/work (and tied to any public funding).
It should be default illegal for entities to make bargains with Google/Apple (or app developers) that exclusively rely on certified devices, except for extremely limited special circumstances.
I would assume the same here. If they are forced to move to EU just because of compliance, the alternatives would remain poor quality.
As tech worked who has worked in US FAANGs (still in europe)... the difference is immense.
EU companies simply can't compete and will never be able to compete until they change the mindset. And the change must be pervasive, across all aspects (including IC compensation).
>European tech imported the product ambition. It forgot to import the customer obsession that’s supposed to come with it.
The French furniture maker didn't import the customer obsession. I agree that U.S tech in these particular subsets are better at the EU doing it, and that needs to be fixed but you can't really talk about how great U.S tech is when you can also point at thousands of horrifying lack of support stories from them also.
U.S Tech has a good mindset for replacing hardware when it fails, they have a good workflow for that. The idea that they have good support however should be tempered by regular reading of some sort of online tech news aggregator.
There are some things that I'd like to be improved in technical support side, but we are way better in "human reachability", responsiveness and "blame game" point of view than US hyperscalers.
Oof, Exhibit B: Arianespace.
I'm really not sure what consequences that'll have for the rest of the world, but it looks like we're about to find out
piranha: carnivorous fish
Nice callout.
Neither here nor there, but many (most?) fish are carnivorous.
- Pretty sure a large number of politicians are using claude, chatGPT etc.
- Majority of researchers in EU are dependent of all of US SV companies. There are nothing equivalent. EVen if there is mistral or other open source llms - every damn Uni/company is uploading everything to claude or open AI or gemini.
- Majority see these but just move on
- 99% of EU politicians either dont care or show apathy or worse live in a moat
- Ideally EU could have forced iphone, Google to openup. They did not.
- Same with taxation. Ireland fights EU to give tax breaks
- Its f*king broken system
SAP and Spotify come to my mind first. Some ex-EU services include Skype and Booking.com (latter might still be counted as EU service depending on definition).
At most an IP address (definitely v4, v6 depending on your arrangement) identifies a household or office, not an individual, and “it seems someone hacked the wireless, or one of my smart devices, or a rouge plugin turned me into a residential proxy, etc.” muddies the water further, often an IP address identifies nothing more than which mobile data provider or VPN provider the user was connected through.
As a simple for instance: No one warns when all that is collected is the calling hosts' apparent IP address in their web server or other service logs. Only once entries with record of the address are explicitly linked to other PII (i.e. if URLs contain PII like names, addresses, etc, so those are logged alongside the calling address) is it an issue - and even then the recording of that information in the wrong places is the problem (in the HTTP logs example, what is that data about the user even doing existing in URIs?) not the calling IP address.
Now it doesn't mean it will always link to single individual, but unless controller can be sure that there are always at least 2 people behind the IP and the devices on that side do not keep enough information to ever link IP+timestamp+destination service to single individual, the controller essentially must assume that IP address is personal data.
This is different from civil liabilities. National courts determine what is the threshold for that. For example in Finland the court has ruled that if the owner of the car cannot name the person who parked the then the presumption is that they did it and are responsible for parking contract breach (KKO 2026:24). National courts could end up with similar ruling for civil liability for sharing content, i.e. assumption that the IP owner either is the person who shared it or knows who they did it & if they refuse to name the person then presumption is that they did it.
/s
It still increases switching cost. As a worker with a permanent contract I have to weigh new opportunities against losing that. And it has real impacts! Getting a mortgage is harder on a temp contract (doable in NL, basically impossible in Ireland)
Temporary contracts are also a thing here, but if there's no objective reason for the contract to be temporary it will end after max. two years. According to Verdi ~1/13 contracts are temporary - not great, but could be much worse.
It's not better worker output, it's faster movement and pivoting to rapid changing market conditions as a company, if you can get rid of slackers that abuse unions and worker protections to coast and do nothing.
Ban or tax things from the "globalised" world that are just worker/societal/environmental protection arbitrage so they're competing for the EU market on a level playing field, then we'll see who can compete.
The EU is plenty big enough to be self-sufficient if it has to and shouldn't be afraid of risking this if abusive and exploitative companies from other places don't way to pay their way.
It won't do any of this because it has no balls and no vision.
We're doomed and it's our fault.
Seems to me they’re waiting it out. Everything could change in a presidential election and the European economy wins either way. It is an economic bloc after all.
What you describe would be what’s called “cutting off your nose to spite your face”
A lot can change, but not everything. Trump won twice and republican elites are fully behind him. Even if he looses, the same ideologies will continue. It happened twice, it is not a fluke but a permanent property of American politics.
Moreover, constitutional changes supreme court created are structural change. They will be super hard to undone - first they would need to change supreme court composition. The influence of money in American politics will just grow, the structural advantages of conservatives have in voting system will just grow and next conservative president will have even more space for maneuvering. (Non conservative one will likely be stopped by supreme court on some excuse.)
So, basically, outside of change actual constitution which is impossible, it will stay the same at best in the long term.
If it means "wait and change nothing long term, hope it will be better" I dont.
The current arrangement has been torpedoed a long time ago already, with the Patriot Act (2001) (though it took many years to understand the extent of it).
Not really, not immediately, IMO. And if they could, that would be a problem in itself.
It will take some time to undo what has been done and will still be done in the current term. To change things back quickly would take both someone despotic on “the other side” willing to force things through with executive orders, and have the general support needed to weather the negative PR associated with that, and (perhaps more importantly) insufficient kick-back getting those orders quickly reverted or watered down. Even if they elect someone, and a team around them, who is willing and able to work that way, the changes made recently include changes that will make them harder to roll back on. And even if things do get magically fixed in the next term, that would just prove how quickly they could be unfixed again four years later.
No. It's the US who's a bully, as a country. The Trump administration is the worst so far, sure, but the US has always behaved as if they owned the world.
There is only one way to deal with bullies, and it's not to be nice and hope they forget about you. It's to stand your ground, not give an inch, and reciprocate.
I'd argue every single EU business with more than five employees would be impacted by such a decision. Just pulling the plug would be economic suicide.
> it should roll out the red carpet for American entrepreneurs, scientists, and talent who want to try moving here and having a go of things in Europe
Only if it's bidirectional. If Americans can gentrify me out of the EU housing market with their higher purchasing power, then I should also have access to their labor market for those six figure wages to compensate. Tit for tat, as freedom of movement works in the EU. Otherwise it's just monetary colonialism. Imagine if Swedes were allowed to move to Spain but spaniards would not allowed to go work in Sweden.
There are other factors like zoning and other laws, mentality of given population etc but gist is above.
Not up to me. I'm not a politician. And like you said, property owners hate it and they are majority.
But it's just as easy to oppose gentrification from wealthy Americans without equal terms in exchange. It has the same effect on supply/demand.
Otherwise, I'll be forced to vote for the most radical and vindictive politicians out of spite to see the world burn if I see my government prioritizes wealthy foreigners and throws me under the bus.
Every action has an equal and opposite reaction.
Anyway, the number of Europeans starting companies in California suggests something is deeply wrong in Europe.
Incidentally DAFT is nominally bidirectional, but as usual the US makes it more onerous. There’s a similar agreement with NL and Japan, actually.
Can we do it in your back yard?
I like how people assume every country has unlimited free space for housing and all you have to do is just build more.
Ironically my childhood home in California has a Dutch family living in it. Small world.
Emigrants aren’t really known for their patriotism.
The time to start this process is now.
Most companies using hyper scalers are doing weird superstitious things at the behest of overpaid consultants. And the huge margins they take make it easier to adapt to things like higher electricity costs.
they ignored decades worth of friedman inspired economic "theory" and started directly investing in their own industry. most successful chinese tech companies are a joint venture between state owned, municipal and private capital. you can get loans way under market rate if you have a good business plan in a industry the government is treating as a priority.
in america every time someone like obama or biden tried they got shut down by big money interests. any investment is bad because its "picking winners and losers". subsidies are bad because the only way to pay for them is increasing taxes and thats bad for profits. europe should never go down that path.
Unless of course, the point of the EU subsidies is just to be a wealth transfer program from the taxpayers to politically connected corporations.
If it was me that deal would have never came to be. If some EU entity decides to use Microsoft 365 can Microsoft guarantee that it won't give access to one US government agency or another? It really can't. Because if that EU entity wants to act in accordance with EU law, this matters. This is what that deal was for. Basically the EU saying "it is okay" although it never really was okay.
IMO we in the EU need to finally start doing our own stuff that adheres to our own laws and isn't subject to the whims of a mad king. Public Money, Public Code.
It's well overdue to take seriously and put all our efforts behind the many (various but little known) local-first initiatives.
See for instance: https://elfaconsortium.eu/ It's a race against time.
This is a very bad-faith question. If you want people to take you seriously, at least give them the respect of trying to argue with a strong, good-faith interpretation of what they're saying.
EU is working on mandating scans of all your private encrypted messages right now. EU data protection is marketing for the gullible.
The way this is going is definitely worrying, but what you're saying is disingenous at best.
Furthermore, even if this passes somehow, that doesn't change the fact that the US remains an unreliable partner. Now we have two governments scouring through your data instead of one.
What are you talking about? It is the EU Commission's wish together with EPP to scan everything including E2EE, photos, videos. The original proposal even had a section about analyzing voice calls.
Also these decisions related where the data is stored and which service is used are under control of each commercial org buying them. The risks are assessed at the end of the day and in case of any issues the providers change. Why would a publicly funded org store citizen data in the US is a question regardless of privacy laws though.
This seems like a very good principle to adhere to in general. Anything that is funded by the public needs to serve the public interest, in my opinion.
Putting public money into e.g. proprietary software and proprietary services that are then operated and gated by a few selected companies, for profit, with their only goal being the rent seeking via long term government contracts, is in my opinion far from being in the public's best interest.
It is not reporting on an opinion of a representative or proxy of the European Commission.
These decisions are known as Schrems I and Schrems II after the founder of this advocacy group.
The newest version of that data transfer framework is called the Trans-Atlantic Data Privacy Framework. The European Commission deemed it sufficient, in no small part because they considered it (and more specifically the Data Protection Review Court, an extrajudicial executive branch tribunal) sufficiently independent of the president.
However, in January 2025, Trump fired the Democrat members of the review court, leaving it unable to reach quorum to make decisions, which highlighted it wasn't all that independent. Now it's clearly not independent.
I don't see how a Schrems III is not in the works.
In other words, (a) no, the "US Supreme Court" didn't "Just Bl[ow] Up EU-US Data Transfers" – there's nothing in the decision even remotely addressing the transfers (nor the EU!) – but (b) the situation might progress in that direction (or it might not.)
The linked article does not present their legal analysis and call for action as established fact.
I don't know what your point is. There is no need for the US Supreme Court, in its decision to endow the President with "unitary executive" power, to elaborate all of the things they blew up to get there.
It's not like West Virginia v. EPA elaborated all the emissions regulations which were blown up by the "major questions doctrine."
I meant that it's ok for you and me to disagree.
> I don't know what your point is
My point is this: Shrems III may or may not be filed, if and when it's filed the relevant court may or may not decide to review it, if they decide to proceed they may reach many different conclusions, one of the possible outcomes being a blow-up in the EU-US data transfers. Then we will we be able, with the benefit of the hindsight, conclude that the SCOTUS decision in question indeed blew up the transfers.
But we're not there yet. At this point in time "US Supreme Court Just Blew Up EU-US Data Transfers" is a prediction about the future. It is however written in past perfect tense as if it's already happened. But what's happened is the SCOTUS decision only. Whether it will, or will not, blow up the data transfers — still remains to be seen.
I'm not saying that this will not happen; all I'm saying is that "blowing up of the data transfers" will happen when an actual court will decide that it's the consequence, not when some advocacy group will decide that it's the consequence.
When The Atlantic has an article with subtitle "How X blew up its own platform with a new location feature", linked at https://news.ycombinator.com/item?id=46042350 , that's again a prediction about the future written in past perfect tense.
Same for "OpenAI is highly overvalued and DeepSeek just blew up their business model, says NYU's Gary Marcus", from https://news.ycombinator.com/item?id=42856656
When The Verge writes "A judge just blew up Apple’s control of the App Store", linked at https://news.ycombinator.com/item?id=43851672, that's yet another prediction about the future written in the past perfect tense -- and it's specifically a prediction about the consequences of a court decision!
Another court one, also from The Verge, "A court just blew up internet law because it thinks YouTube isn’t a website", https://news.ycombinator.com/item?id=31368999
Nor, clearly, does making the "blew up" claim necessarily mean those stated claims are inevitable.
You are of course free to object that such claims are inappropriate unless proven in a court of law or by the fullness of time, but I find that sort of highly non-standard interpretation both contrary to easily found existing practice, and tiresome quibbling.
a) According to EU treaty law, the oversight on EU-US Data Transfers must be independent
b) In the current EU-US deal, the European Commission relies on the independent FTC 259 times
c) the US Supreme Court decided in Trump v. Slaughter that the US Federal Trade Commission (“FTC”) may not be independent anymore
It is completely immaterial that the Supreme Grift ruling was not about the data transfers itself -- this is just some fallout from an activist court creatively reinterpreting established legal structures.
> (b) the situation might progress in that direction (or it might not.
Given that the closing paragraph contains the sentence "given that the US still exercises massive pressure on the EU to keep personal data flowing, noyb will also file a lawsuit in the coming weeks, aiming to allow the CJEU to annul the current deal" I think it's pretty clear that it will.
I did.
> “FTC” may not be independent anymore
It may, or it may not; we don't know. We don't know what EU Courts hold as a criterion for "independence," and we don't know what they will decide regarding that "independence" in light of the new fact that POTUS can fire its chief. People simply aren't good in reading the judges' minds, as evidenced by their going to courts -- if both sides could read minds, there wouldn't be any purpose in going to courts, after all. And don't underestimate the creativity of the courts -- they can align with one side, or the other, or produce an opinion completely different from both sides'.
I understand that the advocacy group in question considers this new fact as evidence that FTC is not independent anymore, but that doesn't matter; we need the courts' opinion, not my opinion or your opinion or the advocacy group's opinion. As stated, what we have in the article are predictions about future; I'm not saying these predictions are wrong and I'm not saying these predictions are right, I'm saying these are simply predictions and not facts.
A big loser team.
I don't know why the EU wants to trust the USA so bad, it's clearly unwise. It makes sense, because banning EU companies from using AWS/GCP/etc. would bankrupt the EU into a recession, but the way they're going about these things is very annoying.
That said, if the USA would actually keep its promises and adopt legislation that solves the reasons why the EU cannot give out a decent competency decision, the problem would go away entirely.
The Biden administration set up a precarious body within the government to resolve the issue rather than go through the normal lawmaking process, probably because it wouldn't go through.
We are too afraid of change and having to take responsibilities. Delegating to the US worked for decades, and it’s very hard to accept that we’ve done a mistake and need to take some risks ourselves. I feel it’s the same issue we have at European countries level.
But also, the EU is still a patchwork of entities that do not have a common vision of what the future should be. Hopefully losing our largest ally will push towards a closer, more federalist union. There is still so much work to do to unify the single market. I’m watching closely what is going on with the 28th regime[0] for that purpose
For many, that's a feature, not a bug. The EU follows a democratic system consisting of many different countries with different types of government and different ideologies. It's not a unified federal government, as much as some people would like it to be.
The whole 28th regime concept seems extremely flawed to me. I understand the desire from a business perspective, but as a citizen I do not want a company to opt out of national legal protections and obligations by operating under some fantasy government. Unless this concept will be subject to the strongest, best-enforced regulations and tax rates equivalent to the highest tax rates within the Union, I do not want this project to happen, and I predict I'm far from the only one.
There is no opt-out, if the proposal is accepted the country members would define a new legal form. You would still have national oversight, legal obligation and protection. But you would get access to a new company form that is recognized in and common to all member countries.
But yes, if you do not want more unification then it's likely not something you want to see. I personally believe that we are currently handicapping ourselves with the current, unfinished single market. I want to see an actual EU federation, where we develop a share vision, take risks together, and simplify the flow of capital and people between country members.
The other concept I'm following with interest is uniting European stock exchanges
It's unclear whether Europe can continue to exist with its current social guarantees without American security guarantees. It isn't a matter of subsidy. Just scale. Building a parallel security establishment will leave America and Europe poorer. But Europe's cost will be its welfare state.
Nah. They are simply giving more power to Trump, power that he did not used to have and should not have. That is it. Supreme court is are advancing their own ideological goals and rewriting parts of constitution they don't like.
The reason this house of cards was necessary in the first place is that the American government does not want to grant foreign citizens the rights necessary to ensure the privacy guarantees the EU requires.
American courts deciding that institutional independence is bad now is awful for American citizens, but it's not supposed to be very relevant to the EU like this.
Because not trusting them is very expensive. But unfortunately, it's necessary.
If it’s a yes, it needs datacenters and get a lot more energy.
If no, it needs to transfer data to US for training/inferencing on it.
It can outsource its data centers abroad too like it did with its manufacturing industry.
besides compare all the money that went into one vs the other.