Well, this should be a depressing read -- notably because t…

Well, this should be a depressing read -- notably because the UK and the US are both terrible when it comes to data protection, but the UK appears to be getting a pass. So much for 'adequacy'.

At least we have a draft of the adequacy decision. I haven't read it yet, mostly because I'm afraid I'll be disappointed that it doesn't address the UK's penchant for surveillance. https://t.co/puJiVET2SJ
— Don Edwards (@DMEdwards) February 20, 2021

A few initial thoughts on the Draft Decision on UK Adequacy: https://t.co/ncAqc93UFm

The decision goes into great detail about the state of the UK surveillance system, and notably, "bulk acquisition" of data, and I think I get their argument. /1

For one, while the UK allows similar "bulk powers," it differs from the US regime both in terms of proportionality, oversight, and even notice. Some of this came about after the Privacy International case in 2019 (Privacy International) v Investigatory
Powers Tribunal [2019]) /2

Whereas, other bits were already baked in by virtue of the fact that the Human Rights Act is a thing (This concept doesn't exist in the US; rather we hand-wave about the Constitution and Bill of Rights, and then selectively apply it) /3

For example, UK bulk surveillance (I'm keeping this broad, but the draft policy breaksk it down), substantially limits collection to three agencies: MI5, MI6, and GHCQ). By contrast, it's a bit of a free-for-all in the US, where varying policies /4

and a general lack of oversight, mean that foreign and domestic law enforcement (NSA, CIA, FBI, DHS, LLE) basically do bulk collection of US and non-US citizens on the regular. And only a handful of these efforts go through any sort of judicial review (e.g., the FISC). /5

By contrast, UK surveillance has multiple levels of oversight - including from the ICO (Sec. 2.6 of the draft), the Judicial Data Protection Panel (Sec. 2.6.3), the Investigatory Powers Commissioner (Sec. 3.3.3.2), and Parliament (Sec. 3.2.3.4) /6

(I'm skipping a few, because there's a lot of oversight!). One thing that also exists is direct rights of redress by data subjects -- primarily through the ICO (Sec. 3.2.4). Unlike in the US, where the FISC is fairly hollow and a rubber-stamp, the ICO actually /7

seems to have some enforcement teeth. (Sec. 3.2.6, 3.2.3.1), and there's a right of redress against the ICO if they become too rubber-stampy (Sec. 2.6.4). But there's also process through the Investigatory Powers Tribunal (3.3.4.2), and the European Court of Human Rights /8

This is, by contrast, to the nearly non-existent redress rights in the US noted in the Schrems II decision. Hell, data subjects can't even find out if they've been surveilled due to gag orders tied to CLOUD Act and FISA orders. /9

Finally, there's collection and retention obligations that (AFAIK) don't exist in the US. (Sec. 3.3.1.1.1), with strict periods of collection (E.g., 3.3.1.1.2 for telecom data, 12 months for communications data).

Honestly, there are way more safeguards /10

than I originally realized.

That said, I'm saying the UK is the best system, or that it's all roses and sunshine for data subjects. But on a preliminary level, I think the EC's draft proposal is well thought out and provides clear insight /11

As to why the concerns of Schrems II are easier to address/satisfy within the UK regime, compared to that of the US.

That said, I'm no expert. What am I missing? What didn't I consider?

@threadreaderapp unroll pls

Well, this should be a depressing read -- notably because the UK and the US are both terrible when it comes to data protection, but the UK appears to be getting a pass. So much for 'adequacy'.

More from Internet

You May Also Like