Max Schrems: Safe Harbor

32C3 preroll music

Herald: Our next talk is
called “Safe Harbor”.

Background is: back in October, in
the light of the Snowden revelations

the Court of Justice of the European
Union – that’s the “EuGH” in German

declared the Safe Harbor agreement
between the EU and the US invalid.

This talk is about how we got there
as well as further implications

of that decision. Please believe me when
I say our speaker is ideally suited

to talk about that topic. Please give it
up for the man actually suing Facebook

over Data Protection concerns:
Max Schrems!

applause and cheers

Max Schrems: Hallo! Hey!
applause and cheers

applause

It’s cheerful like some Facebook Annual
conference where the newest things

are kind of presented. I’m doing a little
intro basically where I got there.

This was my nice little university in
California. And I was studying there

for half a year and there were a
couple of people from Facebook

and other big companies and
they were talking about

European Data Protection law. And
the basic thing they said – it was

not an original quote but basically what
they said is: “Fuck the Europeans,

you can fuck their law as much as you
want and nothing is going to happen.”

And that was kind of the start of the
whole story because I thought: “Okay,

let’s just make a couple of
complaints and see where it goes.”

I originally got 1.300 pages Facebook data
back then, because you can exercise

your right to access. And Facebook
actually sent me a CD with a PDF file

on it with all my Facebook data.
It was by far not everything

but it was the first time that someone
really got the data and I was asking

someone from Facebook why they were so
stupid to send me all this information.

Because a lot of it was obviously illegal.
And the answer was “We had internal

communications problems.” So someone was
just stupid enough to burn it on a CD and

send it on. One of the CDs actually was
first going to Sydney in Australia because

they put “Australia” instead of “Austria”
on the label which was one of the things

as well.
applause

Anyway, this was basically how
my interest in Facebook started;

and the media got crazy about it because
there is like a little guy that does

something against the big guy. And this
is basically how the whole thing got

this big. This is like a cartoon from my
Salzburg newspaper. This should be me,

and it’s like basically the reason why
the story got that big because it’s

a small guy doing something against
Facebook, not necessarily because

what I was doing was so especially smart.
But the story was just good for the media,

’cause data protection is generally a very
dry topic that they can’t report about

and they’re they had like
the guy that did something.

A couple of introductions. We actually
had 3 procedures. So if you heard about

what I was doing… There was originally
a procedure at the Irish Data Protection

Commission, on Facebook itself – so what
Facebook itself does with the data.

This procedure has ended after 3 years.
There’s a “Class Action” in Vienna

right now that’s still ongoing. It’s in
front of the Supreme Court in Austria

right now. And there is the procedure
that I’m talking about today which is

the procedure on Safe Harbor at the
Irish Data Protection Commission.

A couple of other background
informations: I personally don’t think

Facebook is the issue. Facebook
is just a nice example for

an overall bigger issue. So I was never
personally concerned with Facebook but

for me the question is how we enforce
Data Protection or kind of stuff.

applause
So it’s not a Facebook talk; Facebook is

applause
the example. And of course the whole thing

is just one puzzle piece. A lot of people
are saying: “This was one win but there

are so many other issues!” – Yes, you’re
totally right! This was just one issue.

But you got to start somewhere.
And the whole thing is also

not an ultimate solution. So I can
not present you the final solution

for everything, but probably a couple
of possibilities to do something.

If you’re interested in the documents
– we pretty much publish everything

on the web page. It’s a very old style web
page. But you can download the PDF files

and everything if you’re interested
in the facts and (?) the details.

Talking about facts, the whole thing
started with the Snowden case,

where we kind of for the first time had
documents proving who is actually

forwarding data to the NSA in this case.
And this is the interesting part, because

we have a lot of rumours but if you’re in
a Court room you actually have to prove

everything and you cannot just suspect
that very likely they’re doing it. But you

need actual proof. And thanks to Snowden
we had at least a bunch of information

that we could use. These are the slides,
you all know them. The first very

interesting thing was the FISA act and we
mainly argued under 1881a as an example

for the overall surveillance in the US. So
we took this law as an example but it was

not the only thing we relied on. And I
think it’s interesting for Europeans to

understand how the law actually works.
The law actually goes after data and not

after people. We typically have laws in
criminal procedures that go after people.

This law goes after data. So it totally
falls outside of our normal thinking of

“we’re going after a suspect,
someone that

may have committed a crime”. Basically the

law says that there’s an electronic
communications service provider that holds

foreign intelligence information. That’s
much more than just terrorist prevention,

that’s also things that the US is
generally interested in.

And this is the level that’s publicly
known and everything else is basically

classified. So under the law the FISA
Court can do certification for one year

that basically says “the NSA can access
data”. In this certifications there are

these minimization and targeting
procedures that they have to describe.

But they’re not public.
We don’t know how

they look like. And basically they’re here

to separate data from US people out of
the data set. So it doesn’t really help

a European. And then there is a so called
Directive that goes to the individual

service provider which basically says:
“Give us the data in some technical

format.” So very likely it’s some kind
of API or some kind of possibility

that they can retrieve the data. That’s
what the law says. We don’t know

how it actually looks and we don't
have perfect proof of it. So there are

a lot of things that are disputed and
still disputed by the US government.

So the exact technical implementations,
the amount of data that’s actually pulled,

all the review mechanisms they have
internally. That’s all stuff that was

not 100% sure, and not sure enough
to present it to a Court. Which was

the basic problem we had. First of
all after the Snowden thing broke

we had different reactions. And that was
kind of how I started the procedure.

The first reaction was demonstrations.
We were all walking in the streets.

Which is good and which is important,
but we all know that this is something

we have to do but not something that’s
gonna change the world. Second thing:

we had parliaments like the European
Parliament doing resolutions saying

that we should strike down the Safe Harbor
and this is all bad and evil. We had

the Commission pretty much saying the
same thing. We had national politicians

saying the same thing. And we all knew
that basically this means that they all

send an angry letter to the US. Then they
can walk in front of the media and say:

“Yes, we’ve done something, we sent
an angry letter to the US”, and the US

is just thrown basically in some trash bin
of crazy Europeans wanting strange things

and that was it. So I was actually called
by a journalist and asked if there’s

some other option. And I was then
starting to think about it and there’s

the so called Safe Harbor agreement. To
explain the “Safe Harbor”: In Europe

we have Data Protection law that is on
the papers but factually not enforced.

But at least, in theory, we have it. And
we have a couple of other countries

that have the same level of protection
or similar laws. And generally

Data Protection only works if you keep
the data within the protected sphere so

you’re not allowed to send personal
data to a third country that

doesn’t have adequate protection. There
are a couple of other countries that do;

and therefore you can transfer data e.g.
to Switzerland. This is what the law says.

And there are certain servers that
are outside these countries where

we can have contractual relationships. So
basically if you have a server in India,

you have a contract with your
Indian hosting provider saying:

“You apply proper Data Protection to it”.
So you can transfer data there, too.

All of this is approved by the European
Commission. This is how data

flows legally outside of the EU – personal
data. This all doesn’t apply

to any other kind of data, only personal
data. And we had a basic problem

with the US because there was this
Directive saying you can forward data

to other countries but there is no Data
Protection Law in the US. So basically

you wouldn’t be allowed to send
data there unless you have

some contractual relationship which
is always kind of complicated.

So the solution was to have a self
certification to EU principles

and this was put into an Executive
Decision by the European Commission.

So basically how Safe Harbor is working
is that e.g. Google can walk up and say:

“Hereby I pledge that I follow European
Data Protection Law. I solemnly swear!”.

And then they do whatever they
want to do. And basically

that’s the Safe Harbor system and the
Europeans can walk around saying:

“Yeah, there is some seal saying
that everything is fine, so don’t worry.”

Everybody knew that this is a fucked-up
system but for years and years

everyone was looking away because politics
is there and economics is there and

they just needed it. So basically Safe
Harbor works that way that a US company

can follow the Safe Harbor principles
and say: “We follow them”, then

the Federal Trade Commission and private
arbitrators are overlooking them

– in theory, in practice they never do –
and this whole thing was packaged

into decision by the European
Commission. And this is the so called

Safe Harbor system. So from a European
legal point of view it’s not an agreement

with the US, it’s a system that the US has
set up that we approved as adequate. So

there’s no binding thing between the US
and Europe, we can kind of trash it

any time. They’ve just never done that.
Which brings me to the legal argument.

Basically if I’m this little Smiley down
there, I’m sitting in Austria and

transfer my data to Facebook Ireland,
because worldwide – 82% of all users

have a contract with Facebook Ireland.
Anyone that lives outside the US

and Canada. So anyone from China,
South America, Africa has a contract

with Facebook in Ireland. And legally they
forward the data to Facebook in the US;

technically the data is directly
forwarded. So the data is actually flowing

right to the servers in the US. However
legally it goes through Ireland. And

my contract partner is an Irish company.
And under the law they can only transfer

data to the US if there is adequate
protection. At the same time we know

that the PRISM system is hooked up in
the end. So I was basically walking up

to the Court and saying: “Mass
Surveillance is very likely not

adequate protection, he?” And
that was basically the argument.

applause

The interesting thing in this situation
was actually the strategic approach.

So, we have the NSA and other surveillance
organizations that use private companies.

So we have kind of a public-private
surveillance partnership. It’s PPP in

a kind of surveillance way. Facebook is
subject to US law, so under US law they

have to forward all the data. At the same
time Facebook Ireland is subject to

European law so they’re not
allowed to forward all this data.

Which is interesting because
they’re split. The EU law regulates

how these third cwountry transfers work.
And all of this has to be interpreted

under Fundamental Rights. So this was
basically the system were looking at.

And the really crucial thing is that we
have this public-private surveillance.

Because we do have jurisdiction over
private company. We don’t have

jurisdication over the NSA. We can
send angry letters to the NSA. But

we do have jurisdiction over Facebook,
Google etc. because they’re basically

based here. Mainly for tax reasons.
And this was the interesting thing that

in difference to the national surveillance
where we can pretty much just send

the angry letters we can do something
about the private companies. And

without the private companies there is
almost no mass surveillance in this scale

because the NSA is not in our phones,
it’s the Googles and Apples and whatever.

And without them you’re not really
able to get this mass surveillance.

This is like the legal chart. Basically
what we argued is: there’s 7 and 8

of the Charta of Fundamental Rights.
That’s your right to Privacy and

your right to Data Protection. There
is an article in the Directive that

has to be interpreted in light of it. Then
there’s the Executive Decision of the EU.

This is basically the Safe Harbor
decision which refers to Paragraph 4

of the Safe Harbor principles. And the
Safe Harbor principles basically say

that the FISA Act is okay. So
you have kind of this circle

of different legal layers which is getting
really crazy. I’ll try to break it down

a little bit. Basically 7 and 8 of the
Charta we basically compared

to Data Retention, so the
“Vorratsdatenspeicherung”.

We basically said PRISM is much worse. If
“Vorratsdatenspeicherung” (Data Retention)

was invalid then PRISM has to be 10 times
as bad. That was basically the argument.

Very simple. We just compared: the
one was content data – the other one

was meta data. The one is storage
– the other one is making available.

And the one is endless – the other
one is 24 months. So basically

in all these categories PRISM was much
worse. And if the one has to be illegal

the other one has to be as well. And
what’s interesting – and that’s something

that the US side is typically not getting
– is that Article 8 is already covering

“making available of data”. So the
fun thing is I only had to prove

that Facebook makes data available,
so basically it’s possible

the NSA is pulling it. I didn’t even have
to prove that the NSA is factually pulling

my personal data. And this was like the
relevant point because under US law

basically your Fundamental Rights only
kick in when they factually look at your

data and actually surveil you. So I was
only: “They’re making it available

– that’s good enough for me!” which
was making all these factual evidence

much easier. So basically I only had
to say: “Look at the XKeyscore slides

where they say ‘user name Facebook’
they can get somehow the data out of it.

It’s at least made available; that’s
all I need to prove”. And this is

the big difference between the US
– it’s very simplified, but basically

between the US approach and the European
approach; is that in the US you have to

prove that your data is actually pulled.
I only had to prove that my data is made

available. So I had to… I was able to
get out of all the factual questions.

This is a comparison – you basically…
in the US we have very strict laws

for certain types of surveillance while in
Europe we have a more flexible system

that covers much more. So it’s a
different approach that we just have

in the two legal spheres. We’re both
talking about your Fundamental

Right to Privacy, but in details it’s
very different. And that’s kind of

the differences what we used. The fun
thing is if you’re European you don’t have

any rights in the US anyways because
the Bill Of Rights only applies to people

that live in the US and US citizens so
you’re out of luck anyways. So you’re

only left with the European things.
Basically the law which is

the second level after the Fundamental
Rights is saying that there has to be

an adequate level of protection as I said
and this third country has to ensure it

by domestic law or international
commitments. And I was saying: “You know

there’s the FISA Act, you can read
it, it definitely doesn’t ensure

your fundamental rights and an
adequate protection. So we're

kind of out of Article 25”. And there is
paragraph 4 of the Safe Harbor principles

which say that all these wonderful privacy
principles that US companies sign up to

do not apply whenever a national law
in the US is overruling it. So there are

principles that companies say: “We
follow!” but if there is a city in Texas

saying: “We have a local ordinance
saying: ‘You have to do differently!’”

all these Safe Harbor principles
don’t apply anymore. And this is

the fundamental flaw of the self
certification system that it only works

if there is no law around that conflicts
with it. And as there are tons of laws

that conflict with it you’re hardly
able to hold up a system like that.

So basically if you go through all these
different legal layers you end up with

a conflict between the US FISA Act
and the European Fundamental Rights.

So you’re going through different layers
of the system but you’re basically making

a circle. This is what we did which was
a little bit complicated but worked.

applause

Basically now to the procedure,
so how the whole thing happened.

First I went through the Safe Harbor. Safe
Harbor allows you to go to TRUSTe or

the Federal Trade Commission and there’s
an online form to make your complaint. And

I was making a complaint and I think you
were only allowed to put in 60 characters

to explain what your complaint is. Which
is a little bit complicated if you’re

trying to explain NSA mass surveillance.
So I only wrote: “Stop Facebook, Inc.’s

involvement in PRISM!”. That
was everything I could actually

put in the text box; that was
the absolute maximum.

And the answer I got back was: “TRUSTe
does not have the authority to address

the matter you raise.” Which is obvious,
it’s a private arbitration company

that can hardly tell Facebook to not
follow the NSA’s guidelines. So

this was the arbitration mechanism under
Safe Harbor. You can also go to the

Federal Trade Commission and have your
complaint filed there. But they basically

just ignore them. This was the letter I
got back, that they received it. But

I was talking to the people at the FTC and
they say: “Yeah, we get these complaints

but they’re ending up in a huge storage
system where they stay for ever after”.

So this was enforcement done by
Safe Harbor. And we knew that

in the private field already; but in this
case it was especially interesting.

To be fair, both of these institutions
have no power to do anything

about mass surveillance. So
there was really a reason why

they didn’t do anything.
The next step you have is

the national Data Protection Commissioner.
So we have 28 countries

with 28 [Commissioners]; plus Germany has
– I think – a Data Protection Commissioner

in every province. And you end up at
this. And this is my most favourite slide.

This is the Irish Data
Protection Commissioner.

applause

To be super precise
– I don’t know if you

can see the laser pointer. But this is a

super market. And this is the Irish Data
Protection Commissioner back there.

laughter, applause

To be a little more fair, actually they’re
up here and they’re like 20 people

when we filed it originally. The fun thing
is back at the times they didn’t have

a single lawyer and not a single
technician. So they were 20

public employees that were dealing
with Data Protection and no one

had any clue of the technical
or the legal things about it.

The fun thing is: this is Billy Hawkes,
the Data Protection Commissioner

at the time. He went on the
national radio in the morning.

And in Ireland radio is a really big
thing. So it was a morning show.

And he was asked about these complaints.
And he actually said on the radio:

“I don’t think it will come
as much of a surprise

that the US services have access
to all the US companies”.

And this was the craziest thing!
I was sitting in front of the radio

and was like: “Strike! He just
acknowledged that all this is true!”.

And the second thing, he said: “This US
surveillance operation is not an issue

of Data Protection”. Interesting.

It’s actually online and you can listen
to it. But the fun thing was really that

the factual level is so hard to prove that
I was afraid that they would dispute:

“Hah, who knows if all this is true?
We don’t have any evidence!

The companies say we are
not engaging in all of this.”

So having the Data Protection Commissioner
saying: “Sure they surveil you!

Are you surprised?” was great
because we were kind of out of

the whole factual debate.

I actually got a letter back from them
saying that they’re not investigating

any of it. And I was asking them why. And
they were naming 2 sections of the law,

a combination thereof. So there was one
thing where it says they shall investigate

– which means they have to – or
they may investigate. And they say

they only “may” investigate complaints
and they just don’t feel like

investigating PRISM and Facebook
and all of this. Secondly they say

that a complaint could be “frivolous
and vexatious” – I love the word!

And therefor they’re not investigating
it. “A combination thereof or indeed

any other relevant matter.” So we
transferred this letter into a picture

which is basically what they said: “So
why did you not investigate PRISM?”

– “‘Shall’ means ‘may’, frivolous
or

vexatious, a combination of A and B

or any other reason.”
So this was the answer

by the Irish Data Protection Commissioner
why they wouldn’t want to investigate

the complaint. Just to give
you background information:

these are the complaints that the Irish
Data Protection Commissioner is receiving

– the blue line – and the red line is
all

of the complaints they’re not deciding.

Which is 96..98% of the complaints

they receive on an average year.
Which is interesting because you have

a right to get a decision but they don’t.

To give you the bigger picture: we
also made complaints on Apple

and all the other PRISM companies.
And Ireland basically said

what I just told you. Luxembourg, where
Skype and Microsoft are situated, said

that they do not have enough evidence for
the participation of Microsoft and Skype

[in PRISM]. And the funniest thing
about the answer was that they said

that they’re restricted by their
investigations to the territory

of Luxembourg. And since all of this is
happening in the US they have no way

of ever finding out what was going on.
So I was telling them: “You know,

most of this is online and if you’re not
able to download it I can print it out

for you and ship it to Luxembourg.” But
the problem is why we didn’t go down

in Luxembourg is because they went down
this factual kind of argument. They said:

“It’s all illegal but factually we
don’t believe it’s true”. And

then there was Germany that are
still investigating until today.

This was Yahoo. Actually that was
Yahoo in Munich but they now

moved to Ireland as well. So I don’t
know what happened to this complaint.

We never heard back. But whenever we sent
an email they were like: “Yeah, we’re

still investigating.” So what happened now
is that I went to the Irish High Court.

To jeopardize the non-decision of the
Irish Data Protection Commissioner.

This is the case that then went down as
“Schrems vs. the Data Protection

Commissioner” which is so strange because
I never wanted to have my name

on any of this and now the decision is
actually called after my second name

which is always freaking me out in a way.
Because you’re fighting for Privacy and

suddenly your name is all over the place.
applause and laughter

applause

And this is the Irish High Court. So you…

It’s very complicated to
get a procedure like that.

The biggest issue is that you need money.
If you’re in front of an Irish Court

and you lose a case you
end up with a legal bill of

a couple of hundred thousand
Euros. Which is the reason why

never anybody ever challenged the
Irish Data Protection Commissioner.

Because you just gonna
lose your house over it!

So what I did is: we did a little
bit of crowd-funding! And

we actually got about 70.000 Euros out
of it. This was a crowd-funding platform

that basically worked in a way
that people could donate

and if we don’t need the money we either
donate it to another Privacy cause

or we actually give people the money
back. Which we got to have to do

because we won the case. And all
our costs are paid by the other side.

applause

So the fun thing is you then have to
walk into this wonderful old Court here

on Mondays at 11:30. And
there’s a room where you can

make your application. And about 100 other
people making their application as well.

And there is no number. So there
are 100 lawyers sitting in a room,

waiting for the judge to call out your
case. So we were sitting there until 4 PM

or something until suddenly our case was
called up. And we actually got kind of

the possibility to bring our case and then
it’s postponed to another date and

blablablablabla. In the end you
end up with something like this.

Which is all the paperwork
because in Ireland the Courts

are not computerized so far. So you
have to bring all the paperwork,

anything you rely on, in 3 copies.
And it’s all paper, noted of the pages,

so all these copies have pages 1 to 1000.
Someone’s writing all of them on the page.

And then they copy it 3 times and it’s
then in this wonderful little thing.

I thought it’s great. And
what happened is that

we walked into the judge’s room and you
get a judge assigned on the same day.

So you end up in front of a judge
that has never heard about Privacy,

never heard about Facebook and
never heard about Snowden and PRISM

and any of this. So you walk into the
room as like “We would like to debate

the Safe Harbor with you” and he was like
“What the fuck is the Safe Harbor?”.

So what happened is that he told us to
kind of explain what it is for 15 minutes.

And then he postponed the
whole thing for 2 hours I think

and we walked over to a pub and had a
beer. So that the judge could remotely

read what he’s about to look into.

And Ireland is very interesting because
you need a Solicitor and a Counsel

and then the Counsel is actually talking
to the Judge. So I actually had 2 filters.

If I’m the client down here I had to
talk to my Solicitor. The Solicitor

was telling the Counsel what to say to the
Judge. So half of it was lost on the way.

And when I was asking if I could
just address the Judge personally

they were like “No, no way that you could
possibly address the Judge personally

even though you’re the claimant”.
Which is

funny ’cause they talk about this “person”

in the room. It’s like “What’s the problem
of this Mr. Schrems?”. And you’re like

sitting right here, it’s like
“This would be me!”.

So what happened in Ireland is that we
had about 10 reasons why under Irish law

the Irish Data Protection Commissioner
would have to do its job but the Court

actually wiped all of this from the table
and said actually the Safe Harbor

is the issue, which legally they’re
not allowed to do what politically

was very wise and forwarded this
wonderful easy-to-understand question

to the European Court of Justice.

The reason why they put this kind
of very random question is that

if you jeopardize a law in Ireland you
have to get some Advocate General engaged.

And they didn’t want to do that
so they kind of “asked a question

around the actual question”
to not really get them engaged.

Which was very complicated
because we didn’t know how

the European Court of Justice ’d kind of
react to this random question because

it was so broad that they could just walk
any other direction and not address

the real issue. What was wonderful is
that in the judgment by the Irish Court

they have actually said that
all of this is factually true.

All the mass surveillance is factually
true. And the fun thing to understand

is that the factual assessment is done by
the national Courts. So the European

Court of Justice is not engaging in
factual matters anymore. They only

ask legal questions: “Is this legal or
not”. So we had a split of responsibility.

The Irish Court only said that all of this
is true. And Luxembourg only said

that all of this would be legal if all of
this would be true. Which was kind of

an interesting situation. But to be
fair no one before the European

Court of Justice has ever questioned
that this is true. So even the UK

that was in front of the Court and that
should possibly know if all of this

is true or not, they have never
questioned the facts. laughs

There is a pretty good factual basis.
What was interesting as well is

that I said I’m not gonna go in front
of the European Court of Justice.

Because the cost is so high that even the
60 or 70.000 Euros I got in donations

wouldn’t cover it. And I knew the judge
wants to get this hot potato off his table

and down to Luxembourg. So I was asking
for a so called “protective cost order”

which kind of tells you beforehand that
there is a maximum amount you have to pay

if you lose a case. And it
was actually the first one

to ever get protective cost
order in Ireland granted.

Which was really cool and the Irish
were like outraged about it, too.

applause

So we basically walked into the
European Court of Justice which is

a really hefty procedure.
In this room were…

13 judges are in front of you. The
European Court of Justice has assigned it

to the Great Chamber. So there is a
Small, a Medium and a Great Chamber.

Which is the highest thing you can
possibly end up in Europe. And

it’s chaired by the President of the
European Court of Justice. And this is

kind of where the really really basic,
really important questions are dealt with.

So I was like: “Cool, I’m getting to the
European Court of Justice!”. And it’s

funny because all the lawyers that were in
the room, everyone was like “I can pledge

in front of the European Court of
Justice!”. They all took pictures like

they were in Disneyland or something.
audience laughing

And it was – lawyers can be
very… kind of… interesting. And

we ended up in front of these 3 major
people. It was the President,

Thomas von Danwitz – who is the German
judge and he also wrote the lead decision.

He’s the Judge Rapporteur, so within
the 13 judges there’s one that is

the reporting judge and actually drafts
the whole case. And he was also

doing the Data Retention. And then there
was Yves Bot as the Advocate General.

The hearing was interesting
because we got questions

from the European Court of Justice before
the hearing. And in these questions

they were actually digging down into
the core issues of mass surveillance

in the US. When I got the questions
I was like “We won the case!” because

there’s no way they can decide differently
as soon as they address the question.

There were participants from all over
Europe. These are the countries,

then there was the European Parliament,
the European Data Protection Supervisor

and the European Commission.
There was me – MS down there,

the Data Protection Commissioner
and Digital Rights Ireland. And

what was interesting was the countries
that were not there. Like Germany, e.g.

was not there in this major procedure.
And as far as I’ve heard there were

reasons of not getting too engaged in
the Transatlantic Partnership problem.

So this was kind of interesting because
the UK walked up but Germany was like:

“No, we rather don’t want
to say anything about this.”

What was interesting as well is that there
were interventions by the US Government.

So I heard… we were… on a Tuesday we
were actually in the Court. And on Mondays

I got text messages from people of
these different countries telling me that

the US just called them up. And
I was like: “This is interesting”

because I know a lot of these people from
conferences and stuff. So they were like

telling me: “The US just called me
up and said they wanna talk to my

lead lead lead supervisor and tell me
what to say tomorrow in the Court”.

It was like: “This is very interesting!”.

I was actually in the Court room and there
was the justice person from the US embassy

to the European Union. And he was actually
watching the procedure and watching

what everybody was arguing.
Where I had a feeling this is

like a watchdog situation. And someone
pointed out that this is the guy,

so I knew who it is. And he was walking up
to me and asked: “Are you the plaintiff?”

And I said: “Yeah, hey!” and he was
trying to talk to me and I said:

“Did you manage calling everybody by now
or do you still need a couple of numbers?”

audience laughing

And he was like: “(?) arrogant!”. He was
like: “He didn’t just ask this question?”.

He said: “No, we kind of we’re in contact
with all of our colleagues and of course

we have to kind of push for the interest
of the US” and blablabla. I thought:

“This is very interesting!”. But
anyway, it didn’t help them.

No one of them was really kind
of arguing for the US, actually.

The findings of the European Court of
Justice, so what was in the judgment

in the end. First of all, Safe Harbor
is invalid. Which was the big news.

And this was over night. We were expecting
that they would have a grace period

so it’s invalid within 3 months or
something like this. But in the minute

they were saying it there all your data
transfers to the US were suddenly illegal.

applause
Which was kind of big.

The second biggie was that they actually
said that the essence of your rights

is violated. Now this, for an average
person, doesn’t mean too much.

But for a lawyer it says: “Oh my
god, the essence is touched!!”.

To explain to you what the essence is and
why everybody is so excited about it is:

basically if you have a violation of
your rights you have no interference.

So if a policeman was walking
down the street and watching you

there’s no interference with any of your
rights. If they probably tapped your phone

there is some kind of proportionality
issue which is what we typically debate

before a Court. There is a system how
you argue if something is proportionate

or not. So e.g. Data Retention
was not proportionate.

And Data Retention would be somewhere
here probably. points to slide

So not legal anymore but
still in a proportionality test.

And then there is “the essence”
which means whatever the fuck

you’re trying to do here is totally
illegal because what you’re doing

is so much out of the scale
of proportionality that

it will never be legal. And on Data
Retention it actually said that

for the first time…
applause

applause

…and this was actually the
first time as far as I saw

that the European Court of Justice has
ever said that under the convention.

So the convention is only
in place since 2008, I think.

But it’s the first time they actually
found that in a case which was

huge for law in general. There
was a couple of findings

on Data Protection powers that
are not too interesting for you.

What may be interesting is that

– there is a story to this picture
that’s the reason I put it in –

basically they said that a
third country doesn’t have

to provide adequate protection, as
I said before. So the story was

that third countries originally had
to provide equivalent protection.

But there was lobbying going on,
so the word “equivalent” was

changed to “adequate”. And
“adequate” means basically nothing.

Because anything and nothing can be
adequate. “Adequate” has no legal meaning.

I mean if you ask what an adequate
dressing is – you don’t really know.

So they changed that actually back to the
law… to the wording that was lobbied

out of the law and said it has to be
“essentially equivalent” and that’s how

we now understand “adequate”. Which is
cool because any third country now

has to provide more or less the same
level of protection than Europe has.

There has to be effective detention
and supervision mechanisms. And

there has to be legal redress. Just
a really short thing on the picture:

I was actually just pointing at two
people and they were taking a picture

from down there to make it a Victory
sign. And that’s how the media

is then doing: “Whoo”.
making short Victory gesture

I have to speed up a little bit.
Not too much but a little bit.

The future, and I think that’s probably
relevant for you guys as well…

First of all, what this whole judgment
means. First of all the US

basically lost its privileged
status as being a country

that provides adequate [data] protection.
Which is kind of the elephant in the room

that everyone knew anyway, that they’re
not providing it. And now, officially,

they’re not providing it anymore. And the
US is now like any third country.

So like China or Russia or India or
any country we usually transfer data to.

So it’s not like you cannot transfer
data to the US anymore.

But they lost their special status.
Basically what the judgment said:

“You can’t have mass surveillance
and be at the same time

an adequately [data] protecting country”.
Which is kind of logical anyway.

The consequence is that you have to
use the derogations that are in the law

that we have for other countries as well.
So a lot of people said: “You know,

the only result will be that there will be
a consent box saying ‘I consent that my

[personal] data is going to the US.’”
Now the problem is: consent has to be

freely given, informed, unambiguous
and specific; under European law.

Which is something all the Googles
and Facebooks in the world have

never understood. That’s the reason
why all these Privacy Policies are

typically invalid. But anyway. So if
you have any of these wordings that

they’re currently using, like “Your data
is subject to all applicable laws” it’s

very likely not “informed” and
“unambiguous”. Because you don’t have

any fucking idea that your data is
ending up at the NSA if you read this.

So what they would have to do is to have
some Policy saying: “I agree that all of

my personal data is made available to the
NSA, FBI and whatsoever – YES/NO”.

applause
Because it has to be “freely given”, so

applause
I have to have the option to say “No”.

Now this would theoretically be possible
but under US law they’re placed under

a “gag order”, so they’re
not allowed to

say this. So they’re in a legal kind of

Limbo because on the one hand they have to
say: “It’s this way” but on the other hand

they have to say “No it’s not”. So consent
is not going to give you any solution.

Then there are Standard Contractual
Clauses. That’s the one from Apple that

they’re using right now.

And Standard Contractual Clauses allow
you to have a contract with a provider

in a third country. And that
pledges to you in a contract

that all your data is safe. The problem
is that they have exception clauses.

That basically say: “If there’s mass
surveillance your whole contract is void”

because you cannot have a contract
saying: “Hereby I pledge full Privacy”

and at the same time be subject to these
laws. And this is the interesting thing:

all these companies are saying: “Now we’re
doing Standard Contractual Clauses”,

but none of them are going to hold
up in Courts and everybody knows,

but of course to their shareholders
they have to tell: “Oh we have

a wonderful solution for this.”

The big question here is if we have
a factual or legal assessment.

So do we have to look at factually what
data is actually processed by the NSA

and what are they actually doing. Or do we
just have to look at the laws in a country

and the possibility of mass access. So the
factual assessment works fine for Apple,

Google etc. who are all in these Snowden
slides. If you look at the abstract and

legal assessment which is legally the
thing that probably we have to do

you actually end up with questions like
Amazon. Amazon was not a huge

cloud provider when the Snowden slides
were actually drafted and written.

They’re huge now. And very likely
they’re subject to all of these laws.

So how do we deal with a company like
this? Can we still forward [personal] data

to an Amazon cloud? If we know
they’re subject to these US laws.

So this is the question of which
companies are actually falling

under this whole judgment.

Basically you still have a couple of
other exemptions. So this basic thing

that a couple of people say that you’re
not allowed to book a hotel [room]

in the US anymore is not true. There
are a lot of exceptions in the law e.g.

the performance of a contract. So if
I book a hotel [room] in New York online

my [personal] data has to go to New York
to actually book my hotel [room]. So

in all these cases you can still transfer
[personal] data. The ruling is mainly

on outsourcing. So if you could
theoretically have your [personal] data

in Europe you’re just not choosing because
it’s cheaper to host it in the US or

it’s easier or it’s more convenient. In
these cases we actually get problems.

So what we did is we had a second round
of complaints. That is now taking

these judgments onboard. You can download
them on the web page as well. And there’s

also the deal that Facebook Ireland
with Facebook US has signed.

To have safety to your data. And this is
currently under investigation in Ireland.

Basically I argued that they have a
contract but the contract is void because

US law says they have to do all this mass
surveillance. I just got the letter that

on November, 18th Facebook has actually
given them [to the DPC] a huge amount

of information on what they’re actually
doing with the data. This is now going

to be under investigation. The big
question is if the DPC in Ireland is

actually giving us access to this
information. Because so far all these

evidence that they had they said:
“it’s all secret and you cannot know

what Facebook is doing with your data
even though you’re fully informed about

what they’re doing with your data.”
Which is kind of interesting as well. But

– different issue. A big question was also
if there’s gonna be a Safe Harbor 2.0.

I already was told by everybody they’re
not gonna call it a Safe Harbor anymore

because they’re stuck with media
headlines like “Safe Harbor is sunk”

or something like this.

And what happened is that the US has done
a huge lobbying effort. They have said

right on the day that all of this is based
on wrong facts and they’ve never done

any of this; and all of this
is Trade War; and blablablabla.

So they put a lot of pressure on them.
I was actually talking to Jurova,

the Justice Commissioner. And I was
impressed by her. She actually took

a whole hour and she really knew what
was going on. And at the time they had

press releases saying: “We’re really
deeply working on the new Safe Harbor”.

And I was asking Jurova: “Did you get
any of the evidence you need to make

such a finding?” And the answer
was: “Yeah, we’re still waiting for it.

We should get it next week”.
Which basically meant this

is never going to work out anymore. But
of course I think there’s a blame game

going on. The EU has to say: “We
tried everything to find a solution”

and the US is saying: “We tried
everything to find a solution, too”.

And then in the end they will blame
each other for not finding a solution.

That’s my guess. But
we’ll see what happens.

The basic problem with a Safe Harbor 2
is that in the government sector

they’d basically have to rewrite the whole
US legal system. Which they haven’t done

for their own citizens. So they will very
likely not do it for European citizens.

Like judicial redress. Not even an
American has judicial redress. So

they would never give that to a European.
And the private area: they actually

have to redraft the whole Safe Harbor
principles because they now have to be

essentially equivalent of
what Europe is doing.

So this would also protect people on
the private sphere much more but it

would really take a major overhaul of
the whole system. To give you an idea:

all of these processing operations
are covered by European law. So

from collection all the way
to really deleting the data.

This is what’s covered by the Safe
Harbor principles. Only 2 operations

which is at the closure by “transmission”
and the “change of purpose”. Anything else

they can do as fully as they wanna do
under the current Safe Harbor things.

So if you talk about “essentially
equivalent” you see on these spaces

already points to slide
that this is miles apart.

So what is the future of US-EU-US data
flows? We will have massive problems

for the PRISM companies. Because
what they’re doing is just a violation

of our Fundamental Rights. Give or take
it – you can change the law as much

as you want but you cannot
change the Fundamental Rights.

And you’ll have serious problems
for businesses that are subject

to US surveillance law in
general. So I’m wondering

what the final solution is. And that
was part of the issue that I had

with the cases. Typically I like
to have a solution for all of this.

In this case I could only point at the
problems but I couldn’t really come up

with solutions. Because solutions are
something that has to be done politically.

An interesting question was: “How
about EU surveillance, actually?”

Because aren’t they doing more or
less the same thing? Which is true.

And the problem is that the Charta of
Fundamental Rights only applies

to anything that’s regulated by the EU.
And national surveillance is exempt

from any EU law. It’s something that
member states are doing all by themselves.

So you’re out of luck here. You
can possibly argue it through

a couple of circles; but it’s hard to
do. However, 7 and 8 of the Charta

– exactly the same wording as the
European Convention of Human Rights.

And this applies to National Security
cases. So the relevant Court here

is actually in Strasbourg. So you
could probably end up at this Court

with the same argument and say: if they
already found that this is a violation

of your essence in Luxembourg – don’t
you want to give us the same rights

in Strasbourg as well? And these cool
Courts are in kind of a fight about

kind of providing proper Privacy
protection and protection in general.

So very likely you can walk up with
a German case or with a UK case

or a French case and pretty much do
the same thing here. So the judgment

will be interesting for European
surveillance as well because

it’s a benchmark. And you can hardly
argue that the US is bad and we’re

not doing the same thing. Either solutions
are possibly technical solutions.

So what Microsoft did with the cloud
services and hosting it with the Germans.

And the German Telekom. And there
is really the issue that if you can get

a technical solution of not having any
access from the US side you can actually

get out of the whole problem. So you can
try with encryption or data localization;

all this kind of stuff. However none
of this is really a very sexy solution

to the whole issue. However it's
something that you can possibly do.

Last thing: enforcement. And this a
little bit of a pitch, I got to confess.

We have the problem so far that

we have Data Protection law in Europe.

But we don’t really have enforcement. And
the problem is that the lawyers don’t know

what’s happening technically. The
technical people hardly know

what the law says. And then you
have a funding issue. So the idea

that I have right now is to create some
kind of an NGO or some kind of

a “Stiftung Warentest for Privacy”. To
kind of look into the devices we all have

and kind of have a structured system of
really looking into it. And then probably

do enforcement as well if your
stuff that you have on your device

is not following European law.
I think this is an approach that

probably changes a lot of the issues.
It’s not gonna change everything.

But this could possibly be a solution to
a lot of what we had. And that’s kind of

what we did in other fields of law as
well. That we have NGOs or organizations

that take care of these things. I think
that would be a solution and probably

helps a little bit. Last - before we
have a question/answer session –

a little Bullshit Bingo to probably get a
couple of questions answered right away.

So the first thing is that a lot
of questions are if the EU

does the same thing. I just answered it:
Of course they do the same thing and

we’ll have to do something about it
as well. And I hope that my case

is a good case to bring other cases
against member states of the EU.

The second question is these whole PRISM
companies are saying they don’t do this.

It’s absurd because they’re all placed
under gag orders. Or the people that are

talking to us don’t even have the
security clearance to talk about

the surveillance system. So it’s insane
when a PR person comes up and says:

“I hereby read the briefing from Facebook
that we’re not doing this!”. Which

basically is what we have right now.
And that’s what a lot of the media

is referring to as well. Another thing
that Facebook and the US government

have argued later is that they weren’t
asked. They were not invited to the Court

procedure. The fun thing is: both of them
totally knew about the Court procedure.

They just decided not to step in and not
to get a party of the procedure. So they

were like first: “Ouh,
we don’t wanna talk

about it” and then when the decision

came around they were like:
“Oh we weren’t asked”.

Of course it’s a win-on-paper mainly
but we’re trying to get it implemented

in practice as well. And there
is kind of this argument

“The EU has broken the Internet”
which I typically rebut in “No, the US

has broken the Internet and
the EU is reacting to it”.

applause

Another issue that was interesting
is that a lot of the US side said that

this is protectionism. So the EU is only
enforcing these Fundamental Rights

to hurt US companies. Which is funny
because I’m not involved in kind of

getting more trade to Europe. I’m
just like someone interested in

my Fundamental Rights. And secondly the
European politics has done everything

to kind of not get this case to cross.
So kind of this idea that this is

a protectionist thing is kind of strange,
too. And the last question which is:

“What about the Cables? What about all
the other types of surveillance we have?”

They’re an issue, too. In these cases you
just have more issues of actual hacking,

government hacking, basically. So
illegal access to servers and cables.

Which is harder to tackle with than
these companies. Because we have

this private interference. So there are a
lot of other issues around here as well,

I was just happy to kind of get one thing
across. And I’m happy for questions,

as well.
applause

Herald: Alright…
applause

Max: at lowered voice
Wie lange haben wir noch für Fragen?

Herald: We have about
10 minutes for questions.

I would ask you to please line up at
the microphones here in the hall.

We have 6 microphones. And we have also

questions from the IRC.
While you guys queue up

I would take one from the internet.

Signal Angel: Yeah, just
one – for the first time.

Does TTIP influence any of this?

Max: Basically, not really. Because
the judgment that was done was

on the Fundamental Rights. So if they
have some kind of wording in TTIP

it would again be illegal. And there was
actually a push to get something like that

into TTIP. And as far as I know this idea
was done, after the judgment. laughs

Just a little intro: EDRI has organized
an ask-me-anything thing at 7 PM as well.

So if you got specific questions, you
can also go there. Just as a reminder.

Herald: OK, great.
Microphone No.2, please.

Question: Thank you for your
efforts. The question would be:

Could US businesses
under these findings ever

be again employed
in critical sectors? E.g.

public sector, Windows in the
Bundestag, e.g. and stuff like that?

Max: Yep, yip. That’s a huge problem.
And that’s a problem we had for a while.

I was mainly talking actually with people
in the business area. I’m mainly invited

to conferences there. And people
were telling me: “Yeah, we’re doing

all our bank data on Google
now”. And I was like: WTF?

Because this is not only Privacy.
That’s also trade secrets, all of

this kind of stuff. So there is this
huge issue and if you talk about

the new Windows that is talking home a
little more than the old did, you probably

have the same issue here because
Microsoft is falling under the same thing.

Q: No plausible deniability,
therefor culpability.

M: Yep, yep, yep.
Q: Thank you!

Max: Thank you!

Herald: OK, microphone No.3,
please, for your next question.

Question: How would you assess
Microsoft saying they put up

a huge fight that they… well,

they said they had customers’
data in Ireland and they said

they refuse to give it to the FBI.
What’s to think of that?

Max: I think to be fair a lot of
these companies have realized

that there is an issue. And that
they are the “Feuer am Arsch”.

And Microsoft… actually a couple of
Microsoft people is talking to me

and is like: “We’re actually not
unhappy about this case because

we have a good argument in the US
now that we’re getting troubles here…”

But the companies are between
these 2 chairs. The US law says:

“We kill you if you’re not giving us all
the data” and the problem so far is

that in the EU… e.g. in Austria

the maximum penalty is 25.000 Euro
if you don’t comply with this.

Q: Peanuts.
M: Which is absurd.

And in most other countries it’s the same.
We now have the Data Protection regulation

that is coming up which gives
you a penalty of a maximum

of 4% of the worldwide turnover,
which is a couple of millions.

And if you want to thank someone there’s
Jan Philipp Albrecht, probably in the room

or not anymore, who is the member of [EU]
Parliament from the Green Party, that’s

actually from Hamburg who
has negotiated all of this.

And this actually could possibly
change a couple of these things.

But you have this conflict of laws
and solutions like the Telekom thing –

that you host the data with the Telekom –
could possibly allow them to argue

in the US that they don’t have any factual
access anymore so they can’t give the data

to the US Government. But we’re splitting
the internet here. And this is not really

something I like too much, but
apparently the only solution.

Herald: OK, thank you for your
question. We have another one

at microphone 4, please.

Q: Thank you very much for your
efforts, first of all. And great result!

M: Thank you.
Q: The question from me would also be:

Is there any change in the system
in Ireland now? So somebody has

a similar struggle to yours – the
next round might be easier or not?

Max: Basically what the Irish DPC got
is a wonderful new building. And

the press release is too funny.
Because it says: “We have a very nice

Victorian building now downtown Dublin
in a very nice neighborhood“ and blablabla

and they get double the staff of what
they had before. The key problem

is none of this. I only took the picture
because it kind of shows what’s

inside the building. And the key
problem is that we have 2 countries

– Luxembourg and Ireland, where
all of these headquarters are – and

these 2 countries are not interested
in collecting taxes, they’re

not interested in enforcing Privacy Law,
they’re not interested in any of this. And

they’re basically getting a huge bunch of
money in the back of the rest of the EU.

And until this actually changes
and there’s a change of attitude

in the Irish DPC it doesn’t really
matter in which building they are.

So they got a lot of more money to kind
of – to the public – say: “Yes we have

more money and we have
more staff and dadadadada”…

Q: …but the system did not change!

M: The big question is what the system is
doing: they can prove now! As they have

the new complaint on their table on Safe
Harbor and PRISM and Facebook.

They can prove; if they do something
about it or not – my guess is that

they’ll find “some” random reasons
why unfortunately they couldn’t do

anything about it. We’ll see.
Q: OK, thanks!

Herald: OK, thank you! It’s
your turn, microphone No.2.

Question: OK, thank you very much and also
thank you for your service for the public.

M: Thanks for the support!
applause

Q: What that will…
Sorry about the English…

M: Sag's auf Deutsch!

Q: Was bedeutet das eigentlich für die
Geschichte mit der Vorratsdatenspeicherung

wenn die jetzt wieder kommt?
Und inwiefern wird Social Media

damit jetzt sozusagen freigestellt
wieder oder nicht?

M: To be honest I didn’t really look
into the German Data Retention thing

too much. To be honest, being an Austrian
I’m like “Our Supreme Cou… Constitu…”

Q: Me, too!
audience laughing

M: Yeah, I heard. “Our Constitutional
Court kind of killed it”, so…

I don’t think we’ll see a Data
Retention in Austria too soon.

But for Germany it’s gonna be interesting
especially if you find a way to

go to Luxembourg in the end. Like if you
find some hook to say: “Actually,

this German law violates something
in the Data Protection Regulation

or in the Directive“. So we can probably
find a way to go back to Luxembourg.

Could help. The other thing is that just
the fact that the Luxembourg Court

has been so active has probably boosted
up a lot of the National Courts as well.

Because the German decision, I had
the feeling was like a “We don’t really

feel like we can fully say that this is
actually illegal and we kind of argued

that it’s somehow not illegal the way
it is, but possibly you can do it

in the future and uooah…“. And after
Luxembourg has really thrown

all of this right out of the door and was
like: “Get lost with your Data Retention

thing and especially with the PRISM thing”
you probably have better case law now,

as well. And that could be relevant
for National Courts as well. Because

of course these things are question of
proportionality. And if we ask everybody

here in the room what they
think is proportionate or not,

everyone has another opinion. And
therefore it’s relevant what our people

are saying and what other Courts are
saying to probably get the level of

what we feel as proportionate
somehow a little bit up.

Q: So thank you very much. And go on!
M: Thank you!

Herald: OK, just for the record, in
case you couldn’t tell by the answer:

the question was about the implications
for the Data Retention Laws, like

in Germany and Austria. Microphone
No.1, we have another question.

Question: Hi! Two questions. One: could
you tell a little bit more about your idea

of “Stiftung Datenschutz” Europe-wide?
And how do we get funding to you…

M: Send me an email!
Q: …if you don’t mind?

Second question: when I argue with people
about like “Let’s keep the personal data

of all activists within Europe!” I always
get this answer: “Yeah, are you so naive,

do you think it’s anything different
if the server stands in Frankfurt

instead of San Francisco?”
What do you say to that?

Max: The same problem, like pretty much
what we have is – and that’s the reason

why I said I hope this judgment is used
for National surveillance in Europe,

as well. Because we do have the same
issues. I mean when you are an Austrian

and the German “Untersuchungsausschuss”
is basically saying: “Ah, we’re only

protecting Germans” I feel like my
fucking data is going through Frankfurt

all the times. And I’m kind of out of
the scope, apparently. So we do need

to take care of this as well. I hope
that this is a case showing that

you can actually take action. You
just have to poke long enough and

kind of poke at the right spot especially.
And I think this is something that…

there’s not an ultimate solution to it.
It’s just one of the kind of holes

that you have. The other thing that we
may see is that a lot of companies that

are holding this data are much more
questioning an order they get.

Because if they get legal problems from
an order they got by a German Court

or whatever it is they probably
are now more interested in – and

actually looking at it. Because
right now it’s cheaper for them

to just forward the data. You don’t need
a whole Legal Team, reviewing it all.

So I think to kind of split the private
companies that are helping them

from the Government and kind of get some
issue between them probably helps there,

as well. But of course it’s just like
little peanuts you put in there.

But in the end you have that
issue, in the end. Yeah.

On the “Stiftung Datenschutz” or whatever:
I think that’s kind of a thing I just

wanted to blow out to people here, because
I’m mainly in the legal sphere and in,

like the activist/consumer side. And
I think that’s the big problem we have

in the legal and consumer side is that we
don’t understand the devices that much.

And we lack the evidence. We
don’t really have the evidence of

what’s actually going on on devices
and you need to have this evidence

if you go in front of Courts. I think
a lot of the people in the room probably

have this evidence somewhere on the
computer. So the idea of really getting

this connection at some point – it’s not
something I can pitch to you right away,

because it’s not… like I don’t wanna
start it tomorrow. But it’s something

I wanted to circulate to get feedback
as well, what you guys think of it.

So if there’s any feedback on it, send me
an email, or twitter. Or whatever it is.

applause

Herald: So we do have a bit time left,

microphone No.2 with the
next question, please.

Question: What can I do as an individual
person now? Can I sue Google

or can I sue other companies
just to stop this?

And would it create some
pressure if I do that?

So what can the ordinary
citizen do now?

Max: We’re right now… I already prepared
it but I didn’t have time to send it out

to have complaints against the Googles and
all the others that are on the PRISM list.

We started with Facebook because I kind
of know them the best. And, you know, so

it was a good start. And the idea
was really to have other people

probably copy-pasting this. The complaint
against Facebook we actually filed

with the Hamburg DPC, as well, and the
Belgium DPC. The idea behind it was

that the Irish now suddenly have 2 other
DPCs that are more interested in

enforcing the law in their boat. So
they’re not the only captains anymore.

And it’s interesting what’s gonna happen
here. If there are other people

that have other cases and just file a
complaint with your Data Protection

authority, a lot of them, especially the
German Data Protection authorities

– most of them – are really interested
in doing something about it, but

they oftentimes just need a case. They
need someone to complain about it and

someone giving them the evidence and
someone arguing it, to get things started.

So if anyone is using Google Drive
or something like that – let’s go.

And basically the wording is on our web
page. You just have to download it

and reword it. And we’re gonna probably
publish on the website the complaints

against the other companies, as soon as
they’re out. Probably the next 2..3 weeks.

Something like this. So just
copy-paste and spread the love.

Herald: OK, thank you
very much, Max, again!

For your great talk. This is it!

postroll music

Subtitles created by c3subtitles.de
in 2016. Join and help us do more!