chrisacky

Based on the EDPB Decision [1], it seems the most weight of the decision is from paragprah 107:

> As explained by the EDPB in its Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data (hereinafter ‘EDPB Recommendations on Supplementary Measures’) 243, when assessing third countries and identifying appropriate supplementary measures, controllers should assess if there is anything in the law and/or practices in force of the third country that may impinge on the effectiveness of the appropriate safeguards of the transfer tools that they are relying on 244. In this regard, the EDPB notes that, according to Meta IE’s assessment, ‘the level of protection required by EU law is provided for by relevant US law and practice’ and that Meta IE implemented supplementary measures in addition to the 2021 SCCS in order to ‘further ensure that an adequate level of protection continues to apply to User Data transferred from FIL to FB, Inc’ 245 . In other words, Meta IE has implemented supplementary measures on the basis of an assessment which concluded that there was no need for such measures, since, in Meta IE’s view, the relevant US law and practice were already providing a level of protection equivalent to the one provided under EU law

My follow on question, let's say they understood the risk, I fail to see any safeguards which could be equivalent to the EU law? FISA 702 + other intrusive surveillance laws basically make this impossible.

So it seems that because Meta:

> seems to identify its own test for determining suitability of supplemental measures by lowering the standard to include measures that can “address” or “mitigate” any “relevant remaining” inadequacies in the protections offered by US law and practice and the SCCs’ 249, and concludes in the Draft Decision that ‘Meta Ireland does not have in place any supplemental measures which would compensate for the inadequate protection provided by US law’

I'm just confused what would have been sufficient for Meta in this circumstance?

The decision continues in paragraph 121 to say:

> In this regard, the EDPB recalls that the IE SA carries out a detailed assessment of whether Meta IE implemented supplementary measures that could address the inadequate protection provided by US law 273. More specifically, the IE SA analyses the organisational, technical and legal measures implemented by Meta IE and concludes that these measures cannot, ‘whether viewed in isolation, or in tandem with the 2021 SCCs and the full suite of measures outlined in the ROS’, compensate for the deficiencies identified in US law and cannot provide essentially equivalent protection to that available under EU law 2

I am aware of zero technical and organsiational measures which could protect against 702 FISA DOWNSTREAM (PRISM), short of not transfering the data to US?

Thoughts?

I gave it the requirements and just copied and pasted.

Red = External (Very Likely, I need preparation + Notes). Blue = Internal Green = 121 Session etc. Black = Self-Blocked to Stop People trying to Add me to Calls

Basically, I have 40+ events a week. If I have to go through each one and self-organise when I already organise in my Gmail calendar via Color Coding, it would be huge barrier for me.