Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am doing research on Google's Blogger service and its privacy protection features. They say that Google complies with the U.S.-EU Safe Harbor Framework and the U.S.-Swiss Safe Harbor Framework. I've read EU Safe Harbor on website. The first sentence says

The European Commission’s Directive on Data Protection went into effect in October of 1998, and would prohibit the transfer of personal data to non-European Union countries that do not meet the European Union (EU) “adequacy” standard for privacy protection.

So can someone explain me what second part of this sentence really means? For example Russian user registers a blog on blogger.com platform and writes notes. Basically user transfers his private information (mobile number, real name, email, address) to Google.

Am I right that next case is the point of quoted paragraph?

After some time someone (government for example) wants to get user's private data. EU commission must consider it "adequate" as they say and if it is, commission should enforce Google to give away private data.

Google has its own mechanism and policy for handling this kind of requests, but I want to discuss Safe Harbor, not Google. Google's policy should correspond to quoted paragraph since Google says that they compile with Safe Harbor, am I right?

Now, EU (or US) committee must decide whether requesting side is "adequate" or not. And here comes third question: where lies that line between adequate or not-adequate government standarts? There is a list of adequate countries? :) Or not-adequate? Or decision about country's adequacy in terms of privacy protection should be discussed in court? Which court then, russian, european or american?

I fail to see connection between these points. Please explain.

I found this paper on the internet: Internet data protection and privacy law, but seems that it doesn't have legal status. It says

Although there are over forty Russian laws that in some way address personal or sensitive data, Russia has neither bureaucracies nor tailored judicial procedures to enforce its web of privacy rules. Violations, and privately held databases of private information, are said to be common.

So is russian privacy protection adequate or not? What about case I provided? Should Google give away users privacy information to Russian government or not?

I know that in this case can be a lot of different gradations, but can someone explain situation in general?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

Google has complied with 1% of requests for user data from Russian authorities, according to Google's Transparency Report.

Russian authorities can also make such requests via other countries who regularly break their own laws, like E.U. countries or the U.S.

share|improve this answer
    
Thanks, I've seen this statistics and agree with you. Possibly Google will never admit or reject this thesis because Google has two offices in Russia as far as I remember. –  dig Dec 12 '11 at 13:35

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.