3 ms·

>but it remains ludicrous for a US corp to tell a US court to piss off. Assume I build a storage box business with headquarters in the US. After a few years of

>but it remains ludicrous for a US corp to tell a US court to piss off. Assume I build a storage box business with headquarters in the US. After a few years of good business I decide to expand and open a subsidiary in Ireland with a local CEO in charge. I now get an order from a US court saying I need to hand over the contents of box #371 that's sitting in Ireland. I consult my lawyers in Ireland who tell me handing over those contents will be a breach of Irish law and very likely to be prosecuted. As the US based CEO do you think I should go to jail or I should send my Irish CEO to jail?

Eridrus 9y ago
I do not think this is an accurate analogy, specifically I do not think an Irish CEO would be violating the law, but in any case, most jurisdictions do not care if you have placed yourself between a rock and a hard place legally and will operate as if no other jurisdictions exist; the main question is usually "can the US entity do what is being demanded"
- kobeya 9y ago
  The Irish company would be violating Irish and/or EU law in this example. This is a reasonable analogy for what is happening in this Google case.
- yxhuvud 9y ago
  The EU is not most jurisdictions and have put pretty hard rules in place. What you are saying is that you think that it is OK for a lowly judge to force all companies that deal in personal data to choose to either operate in the EU or in the USA. That is clearly not an optimal situation and will clearly have to be resolved, either by one side changing their rules or by a common agreement that voids GDPR for American courts.
  - Eridrus 9y ago
    This is not an optimal solution, which would be a negotiated agreement between the US and EU on how to reconcile the laws, but saying that doing what the court demands would put you in a hard spot of your own making isn't really a defense. On the off chance an agreement is reached with the EU I fully expect that they will allow law enforcement access from both jurisdictions; None of the EU laws restrain law enforcement in this regard. You can try and denigrate the judge all you want, but they have the authority to make these demands, and your only recourse is the supreme court or congress. Laws are a cost of doing business in the US.
closeparen 9y ago
Tech company backend systems aren't independently owned/operated/engineered silos like a storage company's subsidiaries. Any notion of data having a geographic home, unless specifically created to address a regulatory requirement, is a performance optimization. In any realistic architecture, there are are a million exceptions to "this Irish user's data is stored in Ireland": offsite backups, cross-datacenter requests within backend systems, offline analytical stores, queries, derived tables, etc. The same engineers who build and operate code for the US would build and operate code for Ireland, and in fact the developer platforms would be designed to hide differences between datacenters as much as possible. If an Irish citizen logs into GMail in the US, they're not going to hit a frontend proxy in Ireland. Their data is going to be processed, and at least cached, by Google servers in the US. Data having a geographical location is an incoherent concept in the context of the architectures of modern multinational tech companies. That much is obvious from simply reading their engineering blogs and whitepapers. It would be a coherent legal standard (and one I favor) to say that an EU citizen's data is subject to EU protections regardless of where it's stored. It would also be coherent (and the one we unfortunately seem headed for) to say that anything an American employee can get over any remote access tool, he's required to hand over in response to a valid court order. But pretending that data has a location is a weird hack, nowhere near as clear cut as your analogy suggests. Can you imagine, arguing in the courtroom over which member of a trans-continental Paxos group was master at the time a warrant was processed?
- pedrocr 9y ago
  I know the case was a massive simplification on the technical side, that was on purpose. It wasn't a simplification on the jurisdiction side though. Google does have a subsidiary in Ireland and so handing over the EU data does put you in that conundrum as you definitely are subject to Irish law when dealing with the data of Irish users. That you decided to architect your systems so that data is not geographically separate is your own problem.
  - closeparen 9y ago
    To my understanding, neither US nor EU law give a crap about the data's geography. And rightly so, because data doesn't have geography. EU privacy laws apply to all EU citizens, and US warrants apply to all US persons capable of facilitating them. The exception for US-owned databases in European datacenters was a bizarre, short-lived loophole created by case law which maps poorly onto the realities of the situations. I'd say it's the companies which have twisted themselves into knots to take advantage of this loophole, and expected that to be an enduring investment, which are having a problem.

Eridrus 9y ago

I do not think this is an accurate analogy, specifically I do not think an Irish CEO would be violating the law, but in any case, most jurisdictions do not care if you have placed yourself between a rock and a hard place legally and will operate as if no other jurisdictions exist; the main question is usually "can the US entity do what is being demanded"

kobeya 9y ago
The Irish company would be violating Irish and/or EU law in this example. This is a reasonable analogy for what is happening in this Google case.
yxhuvud 9y ago
The EU is not most jurisdictions and have put pretty hard rules in place. What you are saying is that you think that it is OK for a lowly judge to force all companies that deal in personal data to choose to either operate in the EU or in the USA. That is clearly not an optimal situation and will clearly have to be resolved, either by one side changing their rules or by a common agreement that voids GDPR for American courts.
- Eridrus 9y ago
  This is not an optimal solution, which would be a negotiated agreement between the US and EU on how to reconcile the laws, but saying that doing what the court demands would put you in a hard spot of your own making isn't really a defense. On the off chance an agreement is reached with the EU I fully expect that they will allow law enforcement access from both jurisdictions; None of the EU laws restrain law enforcement in this regard. You can try and denigrate the judge all you want, but they have the authority to make these demands, and your only recourse is the supreme court or congress. Laws are a cost of doing business in the US.

closeparen 9y ago

Tech company backend systems aren't independently owned/operated/engineered silos like a storage company's subsidiaries. Any notion of data having a geographic home, unless specifically created to address a regulatory requirement, is a performance optimization. In any realistic architecture, there are are a million exceptions to "this Irish user's data is stored in Ireland": offsite backups, cross-datacenter requests within backend systems, offline analytical stores, queries, derived tables, etc. The same engineers who build and operate code for the US would build and operate code for Ireland, and in fact the developer platforms would be designed to hide differences between datacenters as much as possible. If an Irish citizen logs into GMail in the US, they're not going to hit a frontend proxy in Ireland. Their data is going to be processed, and at least cached, by Google servers in the US. Data having a geographical location is an incoherent concept in the context of the architectures of modern multinational tech companies. That much is obvious from simply reading their engineering blogs and whitepapers. It would be a coherent legal standard (and one I favor) to say that an EU citizen's data is subject to EU protections regardless of where it's stored. It would also be coherent (and the one we unfortunately seem headed for) to say that anything an American employee can get over any remote access tool, he's required to hand over in response to a valid court order. But pretending that data has a location is a weird hack, nowhere near as clear cut as your analogy suggests. Can you imagine, arguing in the courtroom over which member of a trans-continental Paxos group was master at the time a warrant was processed?

pedrocr 9y ago
I know the case was a massive simplification on the technical side, that was on purpose. It wasn't a simplification on the jurisdiction side though. Google does have a subsidiary in Ireland and so handing over the EU data does put you in that conundrum as you definitely are subject to Irish law when dealing with the data of Irish users. That you decided to architect your systems so that data is not geographically separate is your own problem.
- closeparen 9y ago
  To my understanding, neither US nor EU law give a crap about the data's geography. And rightly so, because data doesn't have geography. EU privacy laws apply to all EU citizens, and US warrants apply to all US persons capable of facilitating them. The exception for US-owned databases in European datacenters was a bizarre, short-lived loophole created by case law which maps poorly onto the realities of the situations. I'd say it's the companies which have twisted themselves into knots to take advantage of this loophole, and expected that to be an enduring investment, which are having a problem.