mi pare non sia preciso, ma chiedo ai giusristi... On 13/07/23 11:33, Damiano Verzulli wrote:
Riprendo questo thread, perché temo la cosa sia "sottovalutata".
Di fatto --se capisco bene-- il nuovo "framework" approvato tre giorni fa:
https://ec.europa.eu/commission/presscorner/detail/en/IP_23_3721
rende _PERFETTAMENTE_ utilizzabili _TUTTI_ i servizi "cloud" erogati dai GAFAM, senza problema alcuno.
il fatto che la commissione faccia un accordo non vuole dire che sia legale. (lo ha fatto in passato e due volte la corte europea di giustizia ha detto "quello che hai fatto e' illegale".) adesso lo fa una terza volta, ma non vuol dire che sia legale un accordo illegale non rende legale il comportamento di chi si basa su di esso quindi, da quanto capisco io, no, non sono "perfettamente utilizzabili". estremizzo: se la commissione facesse un accordo che dicesse "si puo' fare benzina senza pagarla", non vuol dire che puoi andare al distributore, farti il piano e andartene... e' illecito, checche' ne dica la commissione almeno questo e' quello che credo di capire, ma i giuristi saranno piu' precisi... ciao!, s.
Quindi --ripeto; se capisco bene-- ora le PP.AA. possono "tornare a" / "continuare a" utilizzare i vari Google Analytics, Google Classroom, Microsoft Teams e/o tutti gli altri N-mila servizi cloud offerti dai GAFAM... senza alcun problema "giuridico".
In molti evidenziano che tale decisione avra' vita breve, e dara' adito ad una Shrems III (ossia ad una "bocciatura" da parte della Corte di Giustizia Europea) ma... nel frattempo, la "legalita'" mi pare sia tornata a prevalere (con un adeguamento della norma, piuttosto che con un cambiamento negli utilizzi).
Mi chiedo quali conseguenze produrra', tale "decisione", negli approcci dei vari manager pubblici (dai Dirigenti degli Istituti Comprensivi o delle Scuole Superiori... o anche degli Atenei) che, negli ultimi mesi/anno hanno dovuto "gestire" le richieste degli amici di Monitora-PA...
Cosa fare, ora? Lo chiedo ai Nexiani di questa lista...
Saluti, DV
Il 11/07/23 11:03, Alberto Cammozzo via nexa ha scritto:
Conformità ottenuta tramite ingegneria semantica del termine 'proportionate'.
<https://noyb.eu/en/european-commission-gives-eu-us-data-transfers-third-roun...>
Third attempt of the European Commission to get a stable agreement on EU-US data transfers will be likely back at the Court of Justice (CJEU) in a matter of months. The allegedly "new" Trans-Atlantic Data Privacy Framework is largely a copy of the failed "Privacy Shield". Despite the European Commission's public relations efforts, there is little change in US law or the approach taken by the EU. The fundamental problem with FISA 702 was not addressed by the US, as the US still takes the view that only US persons are worthy of constitutional rights.
Comparison of the change in US law since 2014:
* o "Old" PPD-28 (2014) <https://obamawhitehouse.archives.gov/the-press-office/2014/01/17/presidentia...> o "New" EO 14086, replacing PPD-28 (2022) <https://www.govinfo.gov/content/pkg/FR-2022-10-14/pdf/2022-22531.pdf> * Comparison with previous public relation efforts: o "Rebuilding Trust in EU-US Data Flows" and the "Umbrella" from 2013 <https://eur-lex.europa.eu/resource.html?uri=cellar:4d874331-784a-11e3-b889-0...> o Press Statement on the "Privacy Shield" from 2016 <https://ec.europa.eu/commission/presscorner/detail/en/IP_16_2461> o Media FAQs on the "Privacy Shield" from 2016 <https://ec.europa.eu/commission/presscorner/detail/en/MEMO_16_2462> o Single Page "Agreement in Principle" between Biden and von der Leyen from 2022 <https://ec.europa.eu/commission/presscorner/api/files/attachment/872132/Tran...> * European Commission Draft Adequacy Decision (December 2022) <https://noyb.eu/en/European Commission Draft Adequacy Decision (December 2022)>
*Background.* In 2013 Edward Snowden disclosed that the US government used "big tech" companies and programs like "PRISM <https://en.wikipedia.org/wiki/PRISM>" or "Upstream <https://en.wikipedia.org/wiki/Upstream_collection>" under FISA 702 <https://en.wikipedia.org/wiki/Foreign_Intelligence_Surveillance_Act_of_1978_...> and EO 12.333 <https://en.wikipedia.org/wiki/Executive_Order_12333> to spy on the rest of the world without the need for probable cause or judicial approval. This was not limited to crime or terrorism, but also included espionage on "partners" of the US. Since a 1995 EU law, personal data may generally not be sent outside of the EU unless there is a "essentially equivalent" protection in the destination country. The US industry heavily relied on a European Commission Decision called "Safe Harbor" that declared the US "essentially equivalent" in 2000. The CJEU has annulled the Commission Decision in C-362/14 ("Schrems I") <https://curia.europa.eu/juris/liste.jsf?nat=or&mat=or&pcs=Oor&jur=C%2CT%2CF&...> in 2015, given the vase US surveillance laws. In 2016 the European Commission has passed largely the same Decision on EU-US Data Transfers again, under the new name "Privacy Shield", which was invalidated by the CJEU in C-311/18 ("Schrems II") <https://curia.europa.eu/juris/liste.jsf?nat=or&mat=or&pcs=Oor&jur=C%2CT%2CF&...> in 2020 largely on the same grounds.
*Ursula's and Joe's "Magic" Tricks. *After the annulment of the "Privacy Shield" the negotiations between the EU and the US saw little progress. The US insisted that EU data would stay subject to US mass surveillance and "non-US" persons will /not /have the same protections as US persons. After little movement for more than 1.5 years, the US has reportedly used the war in Ukraine to put pressure on the EU on sharing personal data <https://www.politico.eu/article/us-eyes-breakthrough-on-data-dispute-with-eu...>. Soon thereafter, Joe Biden and Ursula von der Leyen met on 25 March 2022. The same day, the two have suddenly "solved" what the lawyers were unable to solve and presented an "agreement in principle <https://ec.europa.eu/commission/presscorner/api/files/attachment/872132/Tran...>", a one pager which in essence contained two "tricks" that should calm the public:
* /First/, the CJEU found that*FISA 702 bulk surveillance being not "proportionate"* within the meaning of Article 52 of the EU's Charter of Fundamental Rights (CFR). The "new" US Executive Order 14086 <https://www.govinfo.gov/content/pkg/FR-2022-10-14/pdf/2022-22531.pdf> (which is largely equivalent to PPD-28 from 2014 <https://obamawhitehouse.archives.gov/the-press-office/2014/01/17/presidentia...>) would now include the word "proportionate". The "trick" here: *the US will attribute another meaning to the word "proportionate" than the CJEU*. EO 14086 declares FISA 702 bulk surveillance to be "proportionate" under an undisclosed "US understanding" of the word and contrary to the two findings by the CJEU. This way the EU and the US were able to claim that they agreed on the same word ("proportionate") - even when there is no agreement on the meaning of the word. * /Secondly/, the CJEU found that *redress via the Privacy Shield "Ombudsperson"* was not even remotely complying with Article 47 CFR**- even when the Ombudsperson was hailed by the Commission public relations in 2016 as an "/independent/" form of "/redress in the area of national security/" <https://ec.europa.eu/commission/presscorner/detail/en/MEMO_16_2462>. The "trick" on redress: the Ombudsperson mechanism was*renamed and split to a Civil Liberties Protection Officer (CLPO) and a so-called "Court"* (which is not a court, but a partly independent executive body). While there are some minor improvements over the Ombudsperson, the individual will not have any direct interaction with the new bodies (they will have to send a complaint to an EU data protection authority and not be heard by the US) and they will give the exact same response as the previous "Ombudsperson". Under EO 14086 the CLPO and the Court must in any case respond by saying: "/Without confirming or denying that the complainant was subject to United States signals intelligence activities, the review either did not identify any covered violations or the Data Protection Review Court issued a determination requiring appropriate remediation/" (see here <https://www.federalregister.gov/d/2022-22531/p-107>). The "judgment" of this "Court" is therefore known even before a case is brought. There are many additional problem with the mechanism, that will largely ensure that complaints will not even be admitted. It seems unthinkable that the Court of Justice would accept this as "judicial redress" under Article 47 CFR. * /Finally/, the*US has refused to reform FISA 702* to give non-US persons reasonable privacy protections. There is agreement on both sides of the Atlantic that FISA 702 and EO 12.333 violate fundamental rights under the 4th Amendment in the US and Articles 7, 8 and 47 CFR in the EU - but the US continues to insist that non-US persons do not have constitutional rights in the US - hence a violation of their right to privacy is not covered by the 4th Amendment. * *FISA 702 will have to be prolonged by the end of 2023*, given that there is a "sunset clause" in US law. This would have been the perfect opportunity to improve US law, but given the new deal with the EU, there will be little reason for the US to reform FISA 702.
Overall the new "Trans-Atlantic Data Privacy Framework" is a copy of Privacy Shield (from 2016), which in turn was a copy of "Safe Harbor" (from 2000). Given that this approach has failed twice before, there was no legal basis for the change of course - only logic of having a deal was political.
Max Schrems, chair of /noyb/: "/They say the definition of insanity is doing the same thing over and over again and expecting a different result. Just like 'Privacy Shield' the latest deal is not based on material changes, but by political interests. Once again the current Commission seems to think that the mess will be the next Commission's problem. FISA 702 needs to be prolonged by the US this year, but with the announcement of the new deal the EU has lost any power to get a reform of FISA 702."/
*Fool me Thrice? *Already in the wake of the Snowden disclosures in 2013, the European Commission announced that it will "rebuild" trust <https://eur-lex.europa.eu/resource.html?uri=cellar:4d874331-784a-11e3-b889-0...> and "/make Safe Harbor safer/" and come up with an "/umbrella agreement/".**In 2016 journalists were told that <https://ec.europa.eu/commission/presscorner/detail/en/MEMO_16_2462> the "Privacy Shield" would mean that /"for the first time, the US has given the EU written assurance",/ that there would be /"clear limitations, safeguards and oversight mechanisms" /and even/"no indiscriminate mass surveillance". /None of these claims and systems has prove stable when put before the CJEU. In the current version of the Commission's public relations efforts, the same (ever-repeating) claims are entertained.
Max Schrems: "/We now had 'Harbors', 'Umbrellas', 'Shields' and 'Frameworks' - but no substantial change in US surveillance law. The press statements of today are almost a literal copy of the once from the past 23 years. Just announcing that something is 'new', 'robust' or 'effective' does not cut it before the Court of Justice. We would need changes in US surveillance law to make this work - and we simply don't have it./"
*CJEU challenge ready to be filed. *Anyone who's personal data will be transferred under the new deal can bring a challenge with Data Protection Authorities or Courts. /noyb /has prepared various procedural options to bring the new deal back before the CJEU. We expect the new system to be implemented by the first companies within the next months, which will open the path towards a challenge by a person who's data is transferred under the new instrument. It is not unlikely that a challenge would reach the CJEU by the end of 2023 or beginning of 2024. The CJEU would then even have the option to suspend the "Framework" for the time of the procedure. A final decision by the CJEU would be likely by 2024 or 2025. No matter if such a challenge will be successful, this will bring clarity to the "Trans-Atlantic Data Privacy Framework" within about two years.
Max Schrems:/"We have various options for a challenge already in the drawer, although we are sick and tired of this legal ping-pong. We currently expect this to be back at the Court of Justice by the beginning of next year. The Court of Justice could then even suspend the new deal while it is reviewing the substance of it. For the sake of legal certainty and the rule of law we will then get an answer if the Commission's tiny improvements were enough or not./ /For the past 23 years all EU-US deals were declared invalid retroactively, making all past data transfers by business illegal - we seem to just add another two years of this ping-pong now./"
*EU Commission shows little care for rule of law and citizens' privacy. *This third attempt to pass largely the same unlawful decision also raises questions as to the larger role of the European Commission being the guardian of the EU treaties. Instead of upholding the 'rule of law' the Commission simply passes an invalid decision over and over again, despite clear rulings by the CJEU. Despite large outrage after the Snowden disclosures in the EU and repeated calls by the European Parliament to take action, the Commission seems to give the diplomatic relations with the US and business pressure on both side of the Atlantic the priority over the rights of Europeans and the requirements of EU law.
Max Schrems: "/The Commission is meant to be the 'guardian of the treaties' and the defender or the 'rule of law'. It loves that role when it comes to Member States violating EU law. Now the Commission itself simply ignores the Court of Justice for the third time./"
_______________________________________________ nexa mailing list nexa@server-nexa.polito.it https://server-nexa.polito.it/cgi-bin/mailman/listinfo/nexa
-- Damiano Verzulli e-mail:damiano@verzulli.it --- possible?ok:while(!possible){open_mindedness++} --- "...I realized that free software would not generate the kind of income that was needed. Maybe in USA or Europe, you may be able to get a well paying job as a free software developer, but not here [in Africa]..." -- Guido Sohne - 1973-2008 http://ole.kenic.or.ke/pipermail/skunkworks/2008-April/005989.html
_______________________________________________ nexa mailing list nexa@server-nexa.polito.it https://server-nexa.polito.it/cgi-bin/mailman/listinfo/nexa