Dutch DPA fines Uber €290M because of transfers of drivers’ data to the US

Schrems I [1] (the old CJEU judgment invalidating Safe Harbor) endorses (§90) the opinion that:

> [D]ata subjects [whose personal data was transferred to the US] had no administrative or judicial means of redress enabling, in particular, the data relating to them to be accessed and, as the case may be, rectified or erased.

In what reads like a reference to FISA, it continues (§95):

> Likewise, legislation not providing for any possibility for an individual to pursue legal remedies in order to have access to personal data relating to him, or to obtain the rectification or erasure of such data, does not respect the essence of the fundamental right to effective judicial protection, as enshrined in Article 47 of the Charter [of Fundamental Rights of the European Union].

It then stops short of calling out FISA by name, instead (IIUC) invalidating on the basis that the adequacy of the legal regime was not addressed in the Safe Harbour decision to begin with. Privacy Shield came next and did, so Schrems II [2] (the newer judgment invalidating Privacy Shield) states (§181–2):

> According to the findings in the Privacy Shield Decision, the implementation of the surveillance programmes based on Section 702 of the FISA is, indeed, subject to the requirements of PPD‑28. However, although the Commission stated, in recitals 69 and 77 of the Privacy Shield Decision, that such requirements are binding on the US intelligence authorities, the US Government has accepted, in reply to a question put by the Court, that PPD‑28 does not grant data subjects actionable rights before the courts against the US authorities. Therefore, the Privacy Shield Decision cannot ensure a level of protection essentially equivalent to that arising from the Charter [...].

> As regards the monitoring programmes based on E.O. 12333, it is clear from the file before the Court that that order does not confer rights which are enforceable against the US authorities in the courts either.

It sounds like the official legal position of the US executive is that individual foreigners do not have standing to contest FISA 702 surveillance of them. (I could not quickly find the text of that position.) This is a 2020 judgment in a case from July 2018 regarding a European Commission decision from 2016, so the implications of the CLOUD Act, signed in March 2018, do not look to be in scope.

[1] https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62...

[2] https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62...

Every company I have worked for (including banks, FSP and retailers) have different interpretations of GDPR and do vastly different things. National agencies were also responsible for specifying which certifications cloud providers should have to be GDPR compliant, but they did not do that for years, and I think they still have not done it. The end result was that you would spend months with internal deliberations with incompetent lawyers internally trying to determine if you can, for example, use GCP — while government agencies in the same country are using GCP — and ultimately, there is no way to know without the agencies doing their job which they did not do.

Then there is the cookies popup mess.

> Likewise, afaict it only applies to doing business with EU citizens... So if you don't want to comply, or not be subject to the fees, don't?

I have not worked for one company that is subject to GDPR that actually knew for sure if they are compliant with GDPR. So, easier said than done. In practice, it's a racket to enrich lawyers.

The biggest ever fine was against Google and 4.3 billion several years ago (2018). As far as I know that has been fought over in court for several years and I am not sure if that actually has been paid yet.

So it certainly isn't a steady income stream and doesn't even come close to the actual EU budget.

I am all for discussions about topics like this. But it really is ridiculous to see takes like this, where clearly no single thought or piece of research has gone into the comment. Do better.