NSA/PRISM: Legal Actions against European Subsidiaries of Facebook, Apple, Microsoft, Skype and Yaho

[temmer]

Today several members of the student group "europe-v-facebook.org" have filed complaints under EU data protection law against Facebook, Apple, Microsoft, Skype and Yahoo because of the alleged cooperation with the US Secret Service NSA under the PRISM Program.

The complaints were filed in Ireland against Facebook (PDF) and Apple (PDF), in Luxembourg against Skype (PDF) and Microsoft (PDF) and in Germany against Yahoo(PDF). All complains are directed at the European subsidiaries of the US-based internet companies.

EU data protection law.While the PRISM scandal is taking place in the US, most of the involved companies conduct their business through subsidiaries in the EU in order to avoid US taxes. These companies therefore fall fully under the European privacy laws, even if the users’ data is processed by the US parent company. In order to avoid taxes US companies have spun a network of subsidiaries. At the same time these ‘tax avoidance strategies’ lead to a situation where the companies have to abide by US and EU laws. This can get tricky when they have to adhere to EU privacy laws and US surveillance laws.

Key Issue: Data Export. If a European subsidiary sends user data to the American parent company, this is considered an “export” of personal data. Under EU law, an export of data is only allowed if the European subsidiary can ensure an “adequate level or protection” in the foreign country. After the recent disclosures on the “PRISM” program such trust in an “adequate level of protection” by the involved companies can hardly be upheld.

Read more: http://europe-v-facebook.org/EN/en.html

[temmer]

1. continued...

Procedures under EU law. For European subsidiaries of the involved companies American “gag order" does not apply – in contrast to that the companies are even under an obligation to tell the truth under European proceedings. According to our initial research, there are e.g. even prison sentences of up to one year for false testimonies in Luxembourg.

Precedent "SWIFT".Already in 2006 the group of the EU data protection authorities decided in the "SWIFT" case that a mass transfer of data to the US authorities is illegal under EU law [WP 128 (PDF) and Press Release (PDF)]. In this case the payment processor 'SWIFT' forwarded transaction details to US authorities via a data center in the US. The data was transferred through a “black box”. The SWIFT case has led to an agreement between the US and the EU on the use of payment data to combat crime. After SWIFT has moved European data to a server center in Switzerland the responsible Belgian data protection authority has closed the case.

Two goals.It is now up to the data protection authorities in Germany, Luxembourg and Ireland to decide whether it is legal for European companies to "mass transfer" personal data to a foreign intelligence agency. We want a clear statement by the authorities if a European company may simply give foreign intelligence agencies access to its customer data. If this turns out to be legal, then we might have to change the laws. In addition to the legal clarification europe-v-facebook.org expects a deeper insight into the handling of data by the companies involved. During European procedure, companies must say precisely what they do with the users’ data. If the companies remain silent and do not submit credible evidence, then they run the risk of not being allowed to transfer data to their US parent companies. This means they would have to rearrange their whole infrastructure. We will of course ask for access to the files. We are already excited to see what companies have to say.

Google and YouTube yet to come.Since the company structure of Google and YouTube is somewhat different, they were not included in the first round of complaints. Google and YouTube do not use European intermediates, therefore the situation is somewhat more complicated from a European perspective. But since Google has data centers in Ireland, Belgium and Finland we can take similar actions on a slightly different path.

[Downwinder]

2. Joys of off-shoring.

Might be better to pay their taxes.

[Rise Rebel Resist]

3. kick