> It is literally not possible to adequately safeguard personal data in the US, because there are no redress mechanisms to improper access from US law enforcement.
Isn’t it possible by signing a DPA with the standard contractual clauses? (Of course it’s usefulness is limited mostly to B2B use cases)
Assuming a DPA + SCCs are signed, I suppose the redress mechanism would be a lawsuit.
US law is that data from non-Americans does not have 4th amendment protection, and so any US entity is required to hand over data on request. It may require an NSL, I really can’t recall, but an NSL is a rubber stamp that is no harder to get than a subpoena.
There is also no facility for redress in the event that a US entity illegally retrieves your data, largely because the aforementioned belief that US law enforcement is literally entitled to that data. In other words it is inherently impossible for any “illegal” search or retrieval.
The US government has also ruled the old workaround of keeping data of EU folk in the EU does not work: if the data is under the control of a US entity, then the data is subject to arbitrary demands from US law enforcement.
Even if you put those aside, the US doesn’t provide its own residents with the level of data protection ostensibly guaranteed by the EU. That’s unlikely to change as long as google, Facebook, continue paying to stop any data protection legislation.