The activist at the heart of killing off the EU-US Safe Harbour data protection scheme scrutinises 'Privacy Shield', the proposed replacement.

'Privacy Shield: Safe Harbour with teeny tiny changes' - Max Schrems

Until October 2015, the so-called  Safe Harbour agreement

was supposed to govern the privacy of  EU citizens' data, transferred to the US.

Max Schrems wanted his data  back from Facebook

and successfully prompted the EU Court  of Justice to invalidate Safe Harbour.

You effectively killed off Safe Harbour.

So how would you describe today  the situation with my data. Is my data safe?

We see different trends. A couple of  companies are moving data back to Europe

where it's not subject to US law,  which is typically the better choice.

It really depends  on the Member State where it's at.

There are cases where  they implemented new limitations,

such as on standard contractual clauses,  which allow much less data usage,

especially in the commercial sector,  than Safe Harbour did.

The problem is that  we need to replace all this.

And the replacement that the Commission  has proposed now, called Privacy Shield,

It is supposed to replace Safe Harbour  which in theory doesn't exist anymore.

Where are the weak points?  You say it didn't change anything.

Basically yes.  Unfortunately that's the situation.

We have two different main issues.  One is government surveillance.

Privacy Shield doesn't  change anything on that.

There is an Ombudsman  that you can address,

but she'll only tell you whether everything  is fine, but nothing about your case.

It won't even tell you  if you were subject to surveillance.

The other issue is the commercial sector,

so what for example Facebook or Google  can do with the data internally,

and there we have teeny tiny limitations,

where as a lawyer you only need two lines  in a privacy policy to overwrite them.

That's very interesting,  as the Court has requested

essentially equivalent protection  from the Privacy Shield.

It doesn't give it in either sector, neither on  mass surveillance nor in the private sector.

If we go back to the years  you were fighting Facebook -

of course this is not against Facebook,  this is about the issue of data protection.

In the long run the big question in Europe is  are we enforcing our right to privacy

or are we continuing to post it everywhere,  saying we are great privacy protectors,

but in reality not doing anything about it.

That may change in two years, when  the data protection reform comes along.

Mainly because we have no fines.  In Austria, the maximum is 25,000 euros.

So asking a lawyer  how to comply with the law

will be more expensive for a company  than breaking it.

because privacy was seen as a  consumer right that would be nice to have.

But since the Lisbon Treaty  it's a fundamental right in the EU,

and we haven't caught on to that so far.

You studied in the US. The US would have  to change something on the other side.

If they want to do so,  they have to change the Patriot Act.

The EU cannot exert enough pressure  to make them change the Patriot Act.

The big question is  getting certain limitations.

You have to see that the Silicon Valley  is one of their biggest exports.

If they have the biggest market in the world,  which in the end is the EU,

effectively blocking them  because of all these surveillance laws,

the Silicon Valley would push Washington,

saying that the surveillance laws are  damaging their international business.

This would be the pressure point to use.

Unfortunately the Commission  has given in before doing that.

Let's go back to Facebook. What should I  do to ensure my data is safe on Facebook?

It's a question I don't have an answer to,  because if you're not stupid online,

which most people aren't -  if they're not posting their naked pictures -

Companies try to say that  you're in charge of it, but in fact you're not.

You have friends posting your data,  colleagues uploading your phone number.

You don't even have to be a member  for Facebook to have your data

and have a profile on you.  We call it a shadow profile.

So the idea that you as a person could  change something substantial is wrong.

We could possibly change something  through legislation.

The European Parliament has pushed  for data protection reform.

And I do think that would be  a substantial change.

Putting that on the individual user  is something I find very unfair

because no-one, not even tech experts,  knows what these devices really do,

so how should the average person  make this 'informed decision'?

But one more time, is 'data protection'  even possible today? Is it feasible?

I hate the word!  It's about informational self-determination.

It's about you being in charge of  who knows something about you,

who can use your information and  who is making money off your information.

You should get to choose. You might  choose to be naked or public online,

but you should get that choice,  not someone else.