It's really not that simple either. Many businesses, particularly very small ones, depend on external services to be viable in the first place. It's right that those businesses should pay attention to data protection and privacy issues -- I'm a strong believer in such things personally -- but there also has to be some reasonable framework for what can and can't be done by default, without requiring explicit consent for every last detail.
The trouble with opt-ins for everything is that it instantly scales beyond the point of being practical. Just as hardly anyone actually reads the 9,753 page terms and conditions document before checking the box or pays any attention to the "we use cookies" notices, so hardly anyone will pay attention to formulaic "we might export your data outside the EU and foreign governments might spy on you" warnings. Creating a system that no basically reasonable and ethical business can actually comply with in practice will just result in no-one taking the rules seriously and consequently no-one actually enforcing them, again much like the cookie notices and so on.
Ironically, a good solution in this case is easy to see: the US government could make it absolutely clear that interception of or interference with personal data held by US companies can only be done following proper, legal processes, and then the EU governments would need to update the rules about Safe Harbor provisions to allow a reasonable exception for government access to personal data following due process. Throw in mandatory encryption at a level where the shortest path to getting data needed for legitimate government purposes is to just get the appropriate warrant or equivalent and formally request that the business in question hand over the relevant data, and probably most people are happy.
No-one serious about the privacy debate seems to be suggesting that businesses should never have to turn over personal data they have access to in order to comply with something like a proper court order to provide evidence for a case being heard by that court. It's the dubious access to the data outside of proper legal processes and oversight that causes the conflict here, and at least parts of the EU government system take that sort of thing a lot more seriously than most of the US government right now.
That's a feature, not a bug. It means you don't get to use personal information for marketing purposes unless the customer really wants to to and says so. It's the customer's information, not the retailers.
US businesses might think of it as the customer having a property right, like copyright, in their own personal info.
I consider not being able to run an otherwise reasonable business at all a bug.
It means you don't get to use personal information for marketing purposes unless the customer really wants to to and says so.
It also means, for example, that you can't charge them using a US-based payment service, provide whatever product or service they are requesting if it involves interacting with a US supplier and providing their personal details for delivery or authorising access, or use US-based administrative services to help run your business more efficiently, without your customers' explicit consent, even if this is only to provide exactly what they've just asked you to provide.
This is question begging. If your business model depends on openly breaking the law, it's not a reasonable business model.
If the end of slavery causes your cotton business to become unprofitable, it's not an attack on the cotton industry, it's still an attack on slavery.
Alternative possibility: The law is broken.
What if your business model is otherwise perfectly reasonable and acceptable to all of your customers, and it doesn't rely on breaking the law at all, until the very governments who are entrusted with producing reasonable, consistent laws to support their populations are the ones who screw it up? Should we just close down all European companies doing business with US online services right now, today?
As far as I can see, that is technically what this ruling will lead to. Somehow, I don't think most people in either Europe or the US would consider the resulting collapse of both regions' economies to be desirable, and I doubt that was the desired outcome when the European lawmakers established the basic data protection principles at the heart of this. Those same lawmakers, after all, are the ones who saw fit to provide a Safe Harbor mechanism to facilitate reasonable international trade in the first place.
If the end of slavery causes your cotton business to become unprofitable, it's not an attack on the cotton industry, it's still an attack on slavery.
And what about providing exactly the service your customers were asking for, but using say a US-based payment service that is openly disclosed in your privacy policy? Maybe that is now illegal on a technicality, because you didn't get active consent for using that US service to charge their card. What if your Europe-based bank didn't have explicit permission from your customer to communicate with a US-based card scheme to authorise your customer's card, for that matter?
Will it really help to confront customers with yet more mandatory legalese at the online checkout that just describes what everyone expects to be happening anyway? Who is really going to benefit from that? I'm all for reasonable protection of personal data and proper safeguards for privacy, but when you go so far that you stop people transferring personal data in ways that are necessary to provide the exact product or service that a customer is deliberately requesting and would be reasonably expected by that customer, you've lost the plot and your system needs fixing.
Here are the basic rights of a "data subject":
Everyone shall have the right under national law to request from any controller information as to whether the controller is processing his or her data.
• Data subjects shall have the right under national law to:
• access their own data from any controller who processes such data;
• have their data rectified (or blocked, as appropriate) by the controller processing their data, if the data are inaccurate;
• have their data deleted or blocked, as appropriate, by the controller if the controller is processing their data illegally.
• Additionally, data subjects shall have the right to object to controllers about:
• automated decisions (made using personal data processed solely by automatic means);
• the processing of their data if it leads to disproportionate results;
• the use of their data for direct marketing purposes.
What this means is that data collected by a company about an individual belongs to the individual, not the company. The individual can look at it, correct it, and take it back.
This isn't a problem if you're not a scumbag. If you're selling your customer list for marketing purposes, or using data you collect about users for marketing purposes, you have a problem.
The EU requires explicit consent for such things. A contract of adhesion EULA is not enough. Exceptions to data privacy must be opt-in, not opt-out.
Passing data about persons on to another party can cause serious liability. You have to know where the data went, exactly who has it, and be able to delete it even if it's now in the hands of another party.
This is EU-wide, and registration with one national data controller (a Government agency which checks for privacy violations) in the EU is usually sufficient. Here's a set of guidelines from the European trade association for online marketing.[2]
The biggest practical implication here is that any data you collect and share about individuals must remain within your reach, because you're responsible for correcting it, blocking it, or deleting it. Mailing lists must now contain info as to where the info was originally collected.
It's not really that bad. Europe has operated under these rules for decades. Deal with it.
[1] http://www.echr.coe.int/Documents/Handbook_data_protection_E... [2] http://www.fedma.org/fileadmin/documents/SelfReg_Codex/FEDMA...