Fining foreign big tech over EU privacy nuances is like taking candy from a baby. The narrative zeitgeist on both sides of the pond is in support (stories of rigged elections for 4 years turned public opinion brilliantly).
While protecting your citizens rights is a noble cause, its hard not to see the moral hazard inherent in this approach.
Abusing your position as a desirable market to impose post-hoc tariffs via an endless stream of fines is questionable IMO. Especially while the US provides Europe with its extremely expensive military support blanket (NATO) against the angry bear at its door.
There's a simple scenario in which Meta wouldn't have had to pay these fines: Don't break the law. And don't continue breaking the law after being told to stop it. It's not abusive to remind companies that actions have consequences in the language they understand and respect.
EU to US data transfers used to be okay for years, then there was a single ruling that brought that into question. Because government moves slow, there hasn't been a new framework implemented. Ruling for Billions in fines during the interim, while the US government and EU are still negotiating the details of the new framework is not an environment conducive to full compliance. US companies would essentially need to stop operating in the EU altogether if they wanted to be fully compliant.
Combine this with giant companies which also are slow moving (albeit faster than government) and you have a recipe for never-ending fines no matter how much you try to comply in good faith.
That's exactly what they should've done to not break the law while there was no legal basis for what they were doing.
They didn't. Now they suffer the consequences for breaking the law.
If it was a domestic company, of course, assets could just be seized to pay the fine plus whatever non payment penalty. Is there a criminal charge after asset seizure? Or does this just never happen because there is no incentive to do it domestically?
Plus, Meta actually is a domestic company in the E.U. They handle all their E.U. business through an Irish subsidiary (which is why the Irish data protection agency is responsible for all of this) and they also have subsidiaries to manage political and customer relations in many other E.U. countries, as well as presumably data centers, etc. Removing all of this would be a big project and would give government agencies plenty of time to seize assets. These assets could also include non-tangibles, i.e. the .de/.fr domains for their websites.
EU to US data transfers were questionable for years, until a whole string of rulings through several levels of national and E.U. courts made clear that they weren't under some circumstances. Other companies have found ways to deal with that, Meta obviously could have, but chose not to (because profits). One obvious way would be for Meta to save E.U. customer data on E.U. servers exclusively, splitting the social graph (and advertising shadow profiles, which likely is what they really care about). Good faith does not enter into the equation, would be my guess.
Yeah, standing up a data center is not trivial, but Meta also hires the best in the world. Move fast and break things. In this case they didn’t even move at a medium speed, so they get no sympathy from me.
Yes, absolutely. Laws are never clear and require human beings to interpret.
Lawyers jobs are about assessing risk. While they might not have explicitly said "you will get fined $B", they will definitely say "here is the likelihood that the EU fines you" and then meta management would make a strategic (e.g. do we want to risk this based on how much money we can profit) decision based on that.
And law isn't binary, yes/no. Much US law is very murky and ambiguous. It takes litigation and court action to actually figure out what the poorly worded laws mean. Congress is really bad at creating law for some reason.
Or 260 engineers $1mil a year for 5 years with that money.
You honestly think it would take it would 2600-13000 engineers 10 years to do the work needed for compliance?
this will likely be found to be unlawful too in the way the last two were
the EU commission shouldn't be creating frameworks that it knows are unlawful (definition of malfeasance?)
a new framework passing wouldn't retroactively legalize the transfers happening before that, so this doesn't make sense.
Purely from a logical perspective, preventing the data of a company operating in the United States and Europe from contaminating or coming into contact is a pure utopia no matter how much effort it puts into goal or any other company operating in the same or similar field. There will always be a point of contact and a way for European data to be under the lens of some American agency or body.
In addition to Facebook is not really famous for its transparency in data management so any commitment to the contrary I see it as a paper promise
NATO's excuse that because the US finances then anything is allowed is a fallacious argument.
Black Books (S01E01) put it best:
> NICK VOLEUR: This new system, it's very closely modelled on the old system isn't it?
> BERNARD BLACK: I'd go further than that Nick, I'd say it was more or less exactly the same[.]
Given the US side of said framework is established by executive order[1] and the “court” it creates is part of the executive (much like the “ombudsperson” office that the CJEU struck down Privacy Shield over), it’s unclear if it will work, or if the Commission (an executive body who can establish these things but is subject to judicial review) is setting itself up for a Schrems III another ten years down the line for foreign-relations reasons. The EU privacy regulator very politely said it was dubious[2], while the relevant parliamentary committee expressed open scorn[3].
> Its possible this fine was intended to pre-empt the passing of any new frameworks and cash in on the uncertainty in the interim.
As the legal basis for the transfer is fixed at the time it’s performed, a framework cannot be retroactive (but “the Commission was wrong, the transfers weren’t lawful after all” decisions can be). So while the FUD may be real, the case could just as well have been decided after the new framework were passed.
[1] EO 14086, https://www.federalregister.gov/d/2022-22531
[2] https://iapp.org/news/a/edpb-welcomes-improvements-to-eu-us-...
[3] https://iapp.org/news/a/meps-urge-european-commission-to-rej...
What specifically has changed about US law relating to mass surveillance of foreign nationals that is going to make this one work?
Until it's struck down by the court again.
The agreement will not - it cannot - satisfy the requirements of the GDPR and CFR unless and until the US changes its law.
Or unless and until the EU changes its laws.
US: "we demand the right to spy on anyone for any reason, except US citizens where we absolutely must recognize their constitutional rights"
EU: "we demand basic protections for the rights of our citizens"
For another, if one looks past my vague wording, the EU (or at least Germany, which I'm most familiar with) doesn't have the dogma that it's required to set up a world spanning total surveillance state, no compromises beyond the ones absolutely necessary with their own constitution (and even those are followed within a rather "liberal" framework for the three-letter-agencies: they do have all possible data they can get their hands on, just pinky-promise to not abuse it, if US citizens are impacted, in the eyes of secret courts).
[0]: https://law.yale.edu/sites/default/files/area/center/china/d...
The reason we have regulations is that the opposite proved to be true.
Of course, this doesn't work if another country has such a law. But if it's a smaller country, then it doesn't have as much leverage (e.g. Facebook could accept the smaller fine or pull out).
These are not acceptable options to the EU.
Naïve libertarian takes like "let adults make their own informed decisions" are all fine and well, but when there's a track record of their harm that can be pointed to already, it is, as stated, a non-starter.
You do know how that worked out so far, right?
https://www.nytimes.com/2018/10/15/technology/myanmar-facebo...
https://www.amnesty.org/en/latest/news/2022/09/myanmar-faceb...
Your position is an ideology, and it is one with a poor track record; you're welcome to it, but thankfully you're not going to force it on Europe.
How much power do you want to give the government because you are incapable of making your own decisions?
Sounds like something that the US does routinely.
>"Especially while the US provides Europe with its extremely expensive military support blanket"
1) I think it is more than compensating by Europe agreeing to use USD as the reserve currency. The US gets enormous benefits as the result.
2) Angry bear seems not to be able to win over a single country. Beside the US does it for self serving reasons. It is not a charity. And if it did not I think the Europe is quite capable to create and maintain their own army and weapons.
There’s already been two attempts at this, both of which were ratified, then struck down by the ECJ.
There’s already clear indications that attempt there isn’t much better than attempt one and two, and the smart money is betting on it not being ratified, or being struck down if it is.
In the meantime it’s been illegal for a years to transfer EU data to the U.S. So even if it did suddenly become legal, those laws aren’t going to retrospect, and Facebook still engaged in blatantly illegal behaviour.
And, the 5-eyes(my term) still do collect some data behind the scenes that has minimal court oversight including GDPR.
To an extent GDPR already allows this. The fines are only occurring because Facebook is transferring data into a jurisdiction which doesn’t have strong enough data protection laws to satisfy GDPR.
In the U.S. case specifically, it’s issues around laws that allow the U.S. government to force U.S. companies to handover data arbitrarily with very little (if any) due process. If the U.S. modified their draconian laws to ensure that everyone was afforded due process before their data was scooped up by the U.S. government, then there wouldn’t be an issue.
Unfortunately verifiable processes packages don’t solve the fundamental problem that the various three letter U.S. agencies can send a secret order, with effectively zero judicial oversight, to Facebook and compel them to handover data, plus gag Facebook from telling the individuals about the demand.