![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png){kind=small}
In 2003, the EU made a secret agreement to share airline passenger data with the US Department of Homeland Security, although the US doesn't have privacy protections sufficient to satisfy European law. The DHS promised to use the data only to fight terrorism.
DHS then turned around and, in another secret agreement, gave the data to the Centers for Disease Control and Prevention. That Memorandum of Understanding promises that CDC will protect the data--data that DHS shouldn't have had by EU law, and shouldn't have shared according to its own previous agreement. In general, I'd rather trust CDC than DHS. I'm surer of their competence and their good intentions. In this case, it's not clear that they have any practical use for the data: names, nationalities, and whatever else is on those lists won't tell CDC "the passenger in 17F showed signs of X communicable disease," which is the sort of thing they might reasonably have a use for.
As the ACLU points out,
the U.S. government is distributing information that it explicitly promised it would not share. This is very troubling for several reasons.
First, it is continuing evidence that the American government, and especially its security establishment, does not take privacy and data protection seriously.
Second, it undermines the respect and credibility of our government when it makes promises as a result of careful negotiations among different stakeholders and then breaks those promises.
[Crossposting from my weblog.]