TLDR: Europe’s top court last week struck down Privacy Shield, a data transfer pact between the European Union and the United States that allowed U.S. companies to process and store European users’ data in America. The decision, which could have an outsized impact on U.S. startups, stems from U.S. government surveillance programs that European courts have repeatedly found issues with—especially in the wake of the disclosures from former National Security Agency contractor Edward Snowden in 2013. Without the U.S. scaling back its sweeping surveillance programs, however, it’s unlikely that the EU and U.S. will be able to agree on a new framework to replace Privacy Shield—something that growing startups need to reach potential users across Europe.
Startup News Digest 07/17/20
The Big Story: EU court strikes down transatlantic data transfer pact. The Court of Justice of the European Union this week struck down Privacy Shield, a transatlantic agreement that lets U.S. companies process and store European users’ data in the U.S. The ruling creates uncertainty for many U.S. and EU companies by jeopardizing the flow of data between Europe and the United States. The case, known as “Schrems II,” evolved out of Austrian privacy activist Max Schrems’ 2013 lawsuit following the revelations about the U.S. government’s surveillance programs by NSA whistleblower Edward Snowden.
Statement on the Lawful Access to Encrypted Data Act
Statement on the Consumer Data Privacy and Security Act
Statement on the EARN IT Act
The Eliminating Abusive and Rampant Neglect of Interactive Technologies (or EARN IT) Act from Sens. Lindsey Graham (R-S.C.) and Richard Blumenthal (D-Conn.) addresses a critical issue—stopping online child exploitation, which is a goal that startups share. But, as currently drafted, the bill threatens to unnecessarily disrupt the regulatory framework that has helped the Internet flourish and potentially ban the use of strong encryption technologies that protect user safety.
Report: Nuts & Bolts of Encryption
This report examines several recent developments in the policy debate over encryption, including the debate over building backdoors to encrypted content for law enforcement, as well as reports about law enforcement’s current capabilities and impediments to accessing data in criminal investigations, and growing concerns on how encryption may affect efforts to combat the spread of child exploitation material on the Internet.
Startups and State Privacy Laws
Consumer privacy has been on the minds of companies, regulators, and consumers in the wake of high-profile privacy missteps by major Internet companies and sweeping new privacy rules in Europe. While the U.S. approaches consumer privacy law on a sector-by-sector basis, states are using the momentum around the consumer privacy debate to pass their own varying — and sometimes conflicting — laws.
Report: Nuts & Bolts of User Privacy
The Coming “Privacy Troll” Problem
Congress is currently at work on a federal privacy bill that will hopefully strengthen consumer privacy while correcting some of the problems with state privacy laws like the California Consumer Privacy Act. While this is a good sign for the startup community, some policymakers are pushing for a provision in the draft federal privacy bill that could open the floodgates to expensive, bad-faith lawsuits against startups.
The importance of well-crafted federal privacy protections to startups
Engine Files Comments to California AG on State Privacy Law
Primer: California Consumer Protection Act
Startup News Digest 1/25/19
The Big Story: GDPR’s biggest hit yet. The French privacy watchdog has issued a $57 million fine against Google, the largest fine yet under Europe’s General Data Protection Regulation, the sweeping privacy rules that went into effect in the European Union last year.
The Privacy Debate Needs the Startup Perspective
Startup News Digest 9/28/2018
Startup News Digest 9/21/2018
The Big Story: Privacy Looms Large in Washington.
This week, the European Parliament approved sweeping changes to its copyright regime, including Article 13, which would effectively require all websites hosting user generated content to adopt expensive and ineffective content filters. The proposal also creates a new IP right for publishers that requires websites to pay publishers if the website creates a link to the publisher’s content.