Re:Use of Google Analytics declared illegal by French data p...
by fprct on Thursday February 10, 2022 @10:45AM
(#30287786)
Wait, wouldn't that imply that EU startups can't host their infra on GCP, AWS or Azure? I'm not even talking about analytics - just about simple user email required to login would be problematic now.
Re:Use of Google Analytics declared illegal by French data p...
by judge2020 on Thursday February 10, 2022 @11:13AM
(#30288281)
Pretty much, it really sounds like Schrems II + this ruling mean that US corporations can't be involved with EU at all besides via licensing software to a completely independent EU corporation (which isn't a given either, though, since the US company could threaten withholding software updates/revoking the software license to pressure the EU corporation to hand over EU citizen data to US Law Enforcement).
Re:Use of Google Analytics declared illegal by French data p...
by altairprime on Thursday February 10, 2022 @11:32AM
(#30288610)
Yes, that is correct.
The ruling on Schrems II (the court case that struck down Privacy Shield) did not state that SCCs on their own would be sufficient. It said that SCCs + "additional safeguards" would be allowable. There have been several rulings already that SCCs on their own are not sufficient.
The "additional safeguards" must include a risk analysis of US access to EU residents' data. Every court case I've seen from Schrems II onward identifies the US CLOUD Act as the privacy risk to address. CNIL is basically ruling that you cannot transfer data to a US company subject to the CLOUD Act, and an SCC cannot deal with that. This still leaves open the possibility of using US services that are not subject to the CLOUD Act. This is consistent with all rulings to date.