gdpr surveillance
Are surveillance laws in EU member states necessary and proportionate?
<p>On the 10th of July the EU Commission adopted a new adequacy decision, as a successor to the failed Safe Harbour and Privacy Shield agreements, to allow data transfers from the EU to the USA. The two areas this covers are legal redress if data is wrongly handled, and the question if the surveillance laws that allow the US government to collect data are &quot;necessary and proportionate&quot;.</p>
<p>As a citizen of a EU member state I am happy that these questions are addressed. What I do wonder is if we (as in &quot;we, the EU&quot;) ask more from others than we are prepared to deliver ourselves, because of course every EU member state has their own surveillance laws and agencies, and constitutional protections only apply to their own nationals, and the GDPR applies only to EU residents. It does not seem like we offer any protection e.g. to the data of US nationals that is processed in the EU (I might be wrong here, but such laws are certainly not broadly discussed if they exist).</p>
<p>I am also not sure if national laws are always particularly proportional - e.g. in my native Germany, the Bundesnachrichtendienst has a right by law to listen in to telecommunication world wide; while it says that complete surveillance is unlawful, the constraint is that they have to restrict themselves to not tap into more than 30% of global telecommunication networks at the same time. If your constraint exceeds your actual capabilities, then for practical purposes you do not have a constraint at all.</p>
<p>So, would surveillance in the EU pass muster under the GDPR, or does the EU ask for protections for its citizens that it is not willing to grant to foreigners?</p>
<p>I am not asking for a line-by-line discussion of specific laws, that would be impractical, but I am curious if if this has been discussed as a part of the process that resulted in the GDPR or the adequacy decisions, and if so, if the discussion had any influence on the proceedings.</p>

<h2>These are only tangentially related to the GDPR</h2>
<p>A government entity processing data in accordance with a member state law is <em>ipso facto</em> in compliance with the GDPR.</p>
<p>That’s because lawful government data processing is a legitimate reason for processing data under the GDPR. If Germany, for example, passes a law saying German police can record every phone call in Germany, then that would be a lawful basis for processing under the GDPR. There may be  constitutional  or other legal limitations on such a law but as far as the GDPR is concerned, they’re fine.</p>
