Encrypted personal data is still person related, because somebody has a key and can decrypt it again.
So there is no way around it.
Regarding the U.S. surveillance issues, we have discussed this encryption issue intensively at the European Court of Justice.
That is the reason why these so-named "supplementary measures" have been discussed.
One problem is that the U.S. wiretabs the data in the international backbone already.
And one argument was: well, how can I, as a German company, guarantee that my recipient in Australia complies with data protection,
but in the meantime the data flows through China and 20 other countries and may be intercepted there?
And the answer was, of course: encryption. So if I have a proper end-to-end encryption, I don't have to worry about the 20 transit countries in between.
That's true for the U.S. as well.
So when we talk about upstream surveillance - that's practically copying at the backbone of the Internet - Encryption can be a solution, if my receiver itself doesn't fall under those surveillance laws.
I just recently answered a brief from Google last week.
They have now defined encryption like this: well, we have HTTPS websites, that's encryption. And that is why the NSA is no longer an issue.
Because the keys are held by Google, Google can decrypt the data at any time.
This means that I can use encryption when I receive data in the U.S. if I can practically achieve zero knowledge.
That is, when I say: well, my recipient in the USA can no longer decrypt this data.
This can work for backups, for example. So if I say: well, I take all my backups encrypted like here, send only the scrambled eggs to the USA. Fair enough.
If I still have the data live and it needs to be processed there... - I'm not a technician, but to my technical knowledge... Google always needs the key.
And so the NSA also has the key. Because they have to be made available again.