I am doing research on Google's Blogger service and its privacy protection features. They say that Google complies with the U.S.-EU Safe Harbor Framework and the U.S.-Swiss Safe Harbor Framework. I've read EU Safe Harbor on website. The first sentence says
The European Commission’s Directive on Data Protection went into effect in October of 1998, and would prohibit the transfer of personal data to non-European Union countries that do not meet the European Union (EU) “adequacy” standard for privacy protection.
So can someone explain me what second part of this sentence really means? For example Russian user registers a blog on blogger.com platform and writes notes. Basically user transfers his private information (mobile number, real name, email, address) to Google.
Am I right that next case is the point of quoted paragraph?
After some time someone (government for example) wants to get user's private data. EU commission must consider it "adequate" as they say and if it is, commission should enforce Google to give away private data.
Google has its own mechanism and policy for handling this kind of requests, but I want to discuss Safe Harbor, not Google. Google's policy should correspond to quoted paragraph since Google says that they compile with Safe Harbor, am I right?
Now, EU (or US) committee must decide whether requesting side is "adequate" or not. And here comes third question: where lies that line between adequate or not-adequate government standarts? There is a list of adequate countries? :) Or not-adequate? Or decision about country's adequacy in terms of privacy protection should be discussed in court? Which court then, russian, european or american?
I fail to see connection between these points. Please explain.
I found this paper on the internet: Internet data protection and privacy law, but seems that it doesn't have legal status. It says
Although there are over forty Russian laws that in some way address personal or sensitive data, Russia has neither bureaucracies nor tailored judicial procedures to enforce its web of privacy rules. Violations, and privately held databases of private information, are said to be common.
So is russian privacy protection adequate or not? What about case I provided? Should Google give away users privacy information to Russian government or not?
I know that in this case can be a lot of different gradations, but can someone explain situation in general?
