|
“PRISM” Complaints against Facebook, Apple, Skype, Microsoft and Yahoo!
In Summer 2013 the PRISM Scandal was one of the first NSA spy programs which was uncovered through the Edward Snowden revelations. In contrast to other secret spying programs by European and American agencies this program is reported to be based on direct cooperation by some of the biggest US internet companies.
European Offices. Most of the named companies have European offices, which are subject to EU law. Facebook and Apple are headquartered in Ireland, Skype and Microsoft are based in Luxembourg and Yahoo! is based in different European countries, including Germany.
European Law. The offices of Facebook, Apple, Skype, Microsoft and Yahoo! are forwarding Europeans’ data to the servers of their US parent companies. However “export of data” to a non-EU country (legal speak: “transfer to a third county”) is generally only allowed if an “adequate level of protection” is ensured (see Article 25, Regulation 95/46/EC). We claim that after PRISM was revealed there can in no way be an “adequate protection” for Europeans’ data on the servers of the involved US companies.
“Safe Harbour” Agreement. The case gets more complicated as the EU has made the so-called “Safe Harbour” decision. This allows US companies to “self-certify” to stick to certain (very basic) privacy principles. If they do so they are generally deemed to provide an “adequate protection”. However “Safe Harbour” does not allow for forwarding as it is performed under PRISM. If it would allow such forwarding the “Safe Harbour Decision” would itself be illegal under Regulation 95/46/EC and Article 8 of the Charter of Fundamental Rights and Article 8 ECHR.
5 Complaints, 3 Countries. To clarify this issue we have filed 5 complaints with the relevant data protection authorities in Ireland (DPC), Luxembourg (CNPD) and Germany (BfDI). The relevant documents in all three countries are listed below.
Transparency. All Complaints, answers and letters will be published here. For strategic reasons and reasons of privacy, certain parts must be edited, publication must be delayed, or cannot be published at all.
|
