Schrems VII, The Return of Safe Harbor

Show Notes:
Links:
TechCrunch Schrems II

Full Transcript:
Ben:
Speaking of town meetings though, we had a streamed event from our local school district last night in which they revealed that our school district will not be having school in person for the first semester of the year. They're going to do a wait and see approach and see if they can have school opening and the next semester, in I guess January, but for now, the kids are going to be at home.

Starr:
So how do you feel about that?

Ben:
I think that's the right decision and in the state of Washington and in King County, in which we live, the coronavirus cases are going higher than they were in the initial, back in March. So I don't see how it's a good idea to have a bunch of kids in an enclosed space for an extended period of time in those kind of conditions.

Starr:
The difference this time is that it's over.

Ben:
Yeah.

Josh:
It's-

Starr:
The hurricane's past us.

Josh:
It's a good thing that it fizzled out. You know, the flame was extinguished.

Ben:
My son is not too excited about the idea because he actually likes to leave the house and see his friends and things that we would do in normal world where we had good leadership that helped us keep things under control. But no. So that part's unfortunate, but at least we won't die.

Josh:
Silver linings.

Starr:
Yeah. We try and keep the podcasts pretty nonpolitical, but it's hard to contain the simmering rage sometimes. My new greeting for people when I'm just checking on them. It's like, "How's the apocalypse going?"

Ben:
So I saw a tweet talking about the resurgence in cases. And she said, "well, how am I supposed to open my emails now? Because now it's precedented times."

Josh:
That's good. Yeah.

Starr:
I know. It's kind of weird how, yeah. How precedented this is feeling because it's like, okay. Yeah. I have all this list of things I can't do. That's normal now. I've got all these precautions I take when I leave the house. That's normal now it's just daily life.

Ben:
Yeah. It's like back in March when they were talking about what the new normal is going to be they weren't thinking just March, it's like, Oh.

Josh:
Mm-hmm (affirmative).

Starr:
Yeah, just March, but you're a little more comfortable with all the PPE and I don't know, I stopped spraying down, like all the, the bags of chips with bleach. I've stopped doing that. Because apparently that's not very important to do.

Ben:
I've installed that UVC conveyor belt device in my front room so I can just pass all the groceries through there instead.

Starr:
Oh, that's a great idea.

Josh:
Should we send a precedented times email? Like should we finally get around to sending that COVID email?

Ben:
Yeah. Hope this email finds you well in this precidented time.

Josh:
Yeah. I've completely been ignoring our email marketing lately.

Ben:
Yeah. We should do some of that someday.

Josh:
Probably. I've also been enjoying getting work done.

Star:
So today I think we're going to talk about, about Safe Harbor. 2020 just really sucks. Right? 2020 it's like the pillars that you've built your life on, just sort of crumble out from underneath you. And one of these sort of milder pillars I guess, is Safe Harbor. So what is Safe Harbor-

Ben:
It's funny actually, because it's not Safe Harbor-

Starr:
It's not Safe Harbor.

Ben:
But that goes along well with precedented times because Safe Harbor was the thing that happened five years ago. And now we're dealing with it again because of Privacy Shield.

Starr:
Oh, Privacy Shield! I'm sorry.

Josh:
Was Privacy Shield the thing that was in response to Safe Harbor? I'm trying to remember.

Ben:
Yes.

Josh:
Yeah. Okay.

Ben:
Yeah. When Safe Harbor got torpedoed, then Privacy Shield came around. Yup.

Starr:
I can't keep my bullshit straight.

Ben:
So yes, precedented times, indeed.

Josh:
So yeah. So we're still shielding the Harbor though. Was that the idea? But I do know we no longer now, like the shield is, the shields are down. Is that? I'm losing track of this metaphor.

Ben:
Can't take much more of this captain.

Starr:
Well, they've sort of dropped it though, because it was... Well, which one came first? Safe Harbor?

Ben:
Yeah, Safe Harbor.

Starr:
And then Privacy Shield. And now it's standard contractual clauses or something like that?

Josh:
Right. Yeah.

Ben:
Right, today we're talking about data.

Starr:
Data, okay.

Ben:
And again, not Star Trek.

Josh:
And what to do with it.

Starr:
Ones and zeros.

Josh:
Yeah.

Ben:
So yeah. So a brief history is in order. So back in the olden days in pre 2015, so the whole thing is data transfer from the EU to the US that's what we're talking about. And that's why we care because we have customers in the EU and they want to send us data. In our case, in Honeybadger's case, we have customers who are sending potentially confidential data about their customers, right? Maybe an email address or an address or something that might show up at an exception report. And so they have to be concerned, our customers do, about what data they send us and how we protect that data because there are varying laws around the world about data protection.

Ben:
Like we've seen with GDPR the past few years. So I guess a brief history is back in the early 2000s, the EU started to get concerned about the US not having as good as protections on data as the EU and so they came up with this agreement with the US on how data would be treated. They got transferred to the US from the EU. And that ended up in the Safe Harbor agreement, which basically said that, "Oh, US companies, if you agree to this kind of thing, then you can accept data from the EU because you agree to do these kinds of protections. You're not just going to publish it on a billboard or, or whatever." Right. But then it got kind of blown up from a court case in the European union let's see, that's a Schrems, is that what it's called?

Josh:
Yeah, Schrems one and Schrems two then. Yeah.

Ben:
Well, Schrems one was a case that got decided by the court of justice of the European Union. And that was basically a privacy advocate who said, "Man, the Safe Harbor stuff, it's not really good enough." And so he sued and the court of justice agreed and invalidated Safe Harbor. And that sucked.

Josh:
Yes.

Starr:
Safe Harbor it was kind of weak sauce. Right. It seemed to me more like the pledge of allegiance than a binding sort of contract.

Ben:
True. True. Yeah.

Starr:
It was just like, we hold these data to be protected. We really, really promise.

Ben:
Right, right. Cross my heart, hope to die, it will be protected. Yeah. So the court decided, "Nope, not good enough." And so everybody hustles and put in a valiant effort and came up with the Privacy Shield and that was fine. It still was like, okay, you're going to, as a US company, you're going to pledge to assure that you're going to do these kinds of things with data. But overall, my impression being on the implementation end was that it felt a little more, I don't know, real?

Ben:
I don't know, it was less of just saying you're going to do the system stuff and then more of a, yes, you're actually doing some stuff. I don't know. There really was no Privacy Shield police that came and knocked on your door, but it was more detailed. It felt a little more...