The framework for transfering data is called 'Privacy Shield'. It was ruled to be not effective by the EU recently, so a new framework for data transfer is to be agreed on.

Wiki - https://en.wikipedia.org/wiki/EU-US_Privacy_Shield

News- https://duckduckgo.com/?t=ffab&q=privacy+shield+&iar=news&ia...

Privacy shield was one framework (now invalid, as parent notes) among a few. FB is dependent on standard contractual clauses which are generally valid (per schrems ii) but potentially invalid if the recipient is subject to FISA 702 warrants. Schrems ii put the burden of making that validity determination on member states' data protection authorities.

The Irish DPC didn't want to make this decision (for reasons), kicking the can to the CJEU, which eventually resolved Schrems II and remanded the decision on FB's SCC's back to the DPC.

Yes, it will be interesting to follow the SCC's (Standard Contractual Clauses). But, even though they were upheld, it is still up to the data exporter to guerantee before every transfer, that the SCC will provide an "essentially equivalent" protection to that offerend in the EU with GDPR for instance. It will also be dependant on all circumstances of the SCC whether the protections offered by it is enough, for instance if the receiving end could be compelled by the government, for instance, to hand over the data.

It is hard to imagine a SCC that could provide "essentially equivalent" protection if the other end is an American company, given the authority the US government can exert over it.

I mostly agree- its very hard to imagine any SCC for a communication service/social network surviving this kind of complaint. Not so sure about other kinds of things.

Facebook's infrastructure is one global transparently replicated database. Siloing data by legal jurisdiction is a huge engineering change. Fortunately they have a head start - there was a big project to enable this for when they still had hopes of operating in China. It's kind of sad to think that this is now going to be used for Europe.

I find it hard to believe that the inherent risks of this engineering choice (one globally transparently replicated database) weren't discussed.

States coming to a variety of conclusions and making a variety of decisions about how to treat a private US company holding an unimaginably large amount of social data and metadata... was an eminently knowable and completely obvious set of risks going in, so I have little sympathy for Facebook "failing" to plan a mitigation for those risks. It's hard to see it as anything but a deliberate choice.

Unfortunately, given their past history I suspect the hope was that the company would be able to have its cake and eat it too, by playing on legislators' and citizens' lack of technological literacy and adhering to a "better to ask forgiveness than permission" policy. Throwing up engineering hurdles to compliance just benefits Facebook in this case, because they're banking on states' inability to simply ban Facebook. Facebook can force them to the table, with the deck stacked against them.

"Won't your citizens be angry if you make Facebook inaccessible to them?"

"Everyone uses it! That could be seen as censorship!"

"Let's work together to find a solution that benefits everyone."

It's the same story as with Uber and AirBnB.

Uber was forced into compliance and AirBnB just lost a court case against them in Germany if I recall correctly that forces them to reveal some landlords to the local authorities.

One thing EU can do is to fine FB, you don't need to censor FB, but until FB does not cooperate just charge 10% of revenue. (and increase 1% every year)

Problem solved

GDPR allows fines up to 4% of global(?) revenue (not profit). That’s a pretty significant chunk of change for companies the size of Facebook and Alphabet.

I don't see how it's sad for anyone but Facebook.

Some of us still believe in a borderless internet

They're not insisting on keeping European user data in Europe, though. They've simply concluded that US surveillance laws provide too few protections to non-US citizens living in Europe for their data to be transferable to the US, and that neither Privacy Shield not Standard Contractual Clauses can overcome that.

The EU still allows transfering data to other third countries if suitable protections can be effectively put in place, whether through some governmentally agreed program like what Privacy Shield tried to do or through Standard Contractual Clauses. They simply view the laws in the US as too hostile to most of their residents' data privacy rights. ("Most" instead of "all" because US citizens have more protections under US law even when living in Europe.)

So, while sure it is a kind of border, it's a "privacy-protected vs privacy-dangerous" border rather than a blanket "us vs them" border. Or, phrased another way, it's not a border as a goal, but rather preventing the nature of the internet from overriding their separate privacy goal. I am fine with that attitude.

The concept is still worryingly dangerous given the precedent of "Can't move data outside our jurisdiction" could easily be applied to limit security and ensure snooping instead of preventing it. Given the usual habits and hypocrisies trusting them as far as you can throw them remains wise.

Sure, but even now they're not saying "Can't move data outside our jurisdiction". They're just saying "if you move data outside our jurisdiction, you must put in place suitable safeguards to protect our residents' privacy - and this requirement is currently impossible to meet in the US". There are enough third countries worldwide where the laws would allow, for instance, the Standard Contractual Clauses plus suitable due diligence in practice by the parties concerned to make legal transfers outside of the EU.

In this case, borderless tracking and surveillance.

I mean yes, but also the idea that a company in country X can operate a website usable by people in country Y without having to stand up/rent space in a data center there.

Which would be perfectly fine if only the US had adequate privacy regulation.

IMO it would also be perfectly fine if Facebook wasn't running any EU servers, was solely a US company, all use by EU users intrinsically sent data to the US, and were protected (or not) by US law. That would actually be the "borderless Internet". But that is not how they've set things up.

GDPR applies worldwide to EU citizen data regardless of where the servers are located.

They are free to reduce tracking user data globally, they don't have to apply it only to the EU.

I still believe in the ideal but also recognize that the dream is most likely over for now, and I think rightly so. Superficially the situation looks like what cattle ranching went through in the American West with free grazing [0]. The internet is no longer a handful of small ranchers that can come to low cost solutions with the people they might impact. Even if there were no Facebook type ranchers, there'd be enough small time guys to warrant fences and collective action.

[0] https://en.wikipedia.org/wiki/Open_range

One can have a borderless internet without having borderless companies.

Let's take Facebook. We could have Facebook.US, Facebook.EU, Facebook.UK, Facebook.CN, etc.

In a borderless internet, you'd still be allowed to use the one that you wanted, but each would be subject to the laws of its "country". (I realize that the EU isn't a country.)

So what laws is the interaction between users in different countries governed by?

You see data protection as a border?

Data for people in $country must stay in $country is essentially a border. It’s not about the actual protections but the fact that the EU considers data that would be legal to collect and store in the EU illegal to store in the US.

Well if data wasn't being mishandled, poorly managed and devalued without any legal repercussion we wouldn't have reached this point.

Plus it's not in $country is in $region, if all countries made an effort to adopt GDPR data could be stored anywhere.

EU is looking for their citizens data, since no one else seems to care that much (other than China but for completely different reasons).

Unless you think that the protocol of tech giants to poor data protection is fine, when they are saying:

"Ups, we're sorry :(... it won't happen again!"

Borderless with users behind a walled garden where their personal data is mined like gold.

Yeah that’s part of the original vision of the Internet.

if profits from this borderless internet are not borderless, then there is little incentive for a borderless internet.