Hi,
Our company is developing Safemails.Net, a network where companies and individuals can exchange safe emails end-to-end and making this activity PAINLESS, secure and fast on all devices.
If you want to deeply impact cyber crime and making world better place, contact us in twitter @safemails, www.safemails.net
Your questions are to the point. If the actors you mention are independent and no one single actor has authority over them, we have system that is self regulating. This system is working in mature democracies.
Surveillance itself is opportunity protection job to be done better and effectively. The problems is with possessors of surveillance data and decisions makers. No man, no problem. May be regulations should be more stricter in not allowing people to abuse surveillance.
I think for email encryption to be used two factors should be present:
1. Very cheap or free for contacts, and
2. Very easy to be used at least for contacts
It is next to impossible for Initiator to convince his/her contacts to use any encryption solution that put burden on them.
I am not talking about the security because it should be paramount and by default but with upper features.
I think it is possible and believe if enough users use email encryption the trend of cyber crime can be turned back.
It's a shame. If I was FB I would continue to sell peoples data and pay the fines.
Balance? = price of private data minus fines;
That is great business.
Chelsea Manning was granted clemency when it was right time (end of presidency of Obama). It is possible for Snowden as well if right time will come. He has nice team of advisors and I think they will play that game to the end. However I am afraid he has to wait long time for this.
I assume you are from EU state. GDPR is valid only for EU citizens no matter where their data are around the world.
If you are company (no mater EU or no-EU) and you have personal data breach you should report it to your local regulator in 72 hours or you risk 2mln euro or 4% from the turnover fine.
I think one reason Google+ to be closed is they didn't report personal data breach so have to pay 4% of whole turnover of Alphabet which could be billions.
In order to be compliant with GDPR companies have to encrypt, mask and pseudo-randomize personal data. This isn't possible even for big companies to be done on time. And on top of this you should have rigorous incident management process so not missing 72 hours deadline.
I can tell you that even big companies are not ready.