3 ms·

I know the case was a massive simplification on the technical side, that was on purpose. It wasn't a simplification on the jurisdiction side though. Google does

I know the case was a massive simplification on the technical side, that was on purpose. It wasn't a simplification on the jurisdiction side though. Google does have a subsidiary in Ireland and so handing over the EU data does put you in that conundrum as you definitely are subject to Irish law when dealing with the data of Irish users. That you decided to architect your systems so that data is not geographically separate is your own problem.

closeparen 9y ago
To my understanding, neither US nor EU law give a crap about the data's geography. And rightly so, because data doesn't have geography. EU privacy laws apply to all EU citizens, and US warrants apply to all US persons capable of facilitating them. The exception for US-owned databases in European datacenters was a bizarre, short-lived loophole created by case law which maps poorly onto the realities of the situations. I'd say it's the companies which have twisted themselves into knots to take advantage of this loophole, and expected that to be an enduring investment, which are having a problem.
- pedrocr 9y ago
  In that case how do you propose US-based companies operate in Europe? If it's not possible to follow EU privacy laws because US courts can compell you to break them should Google/Facebook/Microsoft just leave the EU market?
  - closeparen 9y ago
    What other choice do they have? With the "data lives in Europe" loophole ending, then yeah, the US will have to suffer the economic consequences of its failure to come to an agreement with the EU.
    - pedrocr 9y ago
      I think there are two cases: 1. An AWS Ireland instance bought by a EU member: here the storage box analogy should apply fully. The data is indeed geographically located and being operated within that geography. US courts need to accept that they need to go through the local authorities to get a warrant for that data just like they would for any physical good. 2. A worldwide distributed database like the Facebook graph: here the analogy breaks down completely and the US courts are taking advantage of that to access anything they like. I'm sure their tune would change if suddenly the Chinese authorities forced the local Facebook subsidiary to hand over all the data of US citizens. For this the solution will need to be an international arbitration for data access. If the database is not geographically bound then the mechanism to ensure its privacy will have to be international as well. I think the Microsoft case was of type 1 and so new laws should not be needed. Cases of type 2 will be much harder and it may very well mean that Facebook becomes de facto illegal in Europe.
- bonesss 9y ago
  > To my understanding, neither US nor EU law give a crap about the data's geography How do you think search warrants and national espionage programs are carried out? ... That's where the law comes in: data is just "property". The law gives many craps about property :) > I'd say it's the companies which have twisted themselves into knots to take advantage of this loophole, and expected that to be an enduring investment, which are having a problem. The business conundrum is whether to cede massive, growing, markets to regional players or to try and straddle multiple legal regimes. That straddling means trying to reconcile different legal requirements, and that's what we're seeing: saying no to party A to respect the demands of party B. Far from a problem, this is a consequence of expansion and profitability. Far from a "pretzel" this is par for the course for multinationals, and a key area of legal precedence for the current IT behemoths (read: impacts billions in revenue). There are other corporate solutions to this issue, they're just much less profitable than todays approach from MS, Google, and others.
  - closeparen 9y ago
    >How do you think search warrants and national espionage programs are carried out? Based on the citizenship of the targets. >Far from a "pretzel" this is par for the course for multinationals, and a key area of legal precedence for the current IT behemoths Well, not anymore if this ruling stands.
    - bonesss 9y ago
      > To my understanding, neither US nor EU law give a crap about the data's geography ... [search warrants... are carried out] based on the citizenship of the targets. Executing a legal search warrant involves using legally binding power on a legal entity within a specific jurisdiction. If property or entity is outside that jurisdiction then the laws do not apply. US and EU law give very, very, much a crap about their jurisdictions, and where property is (ie where data is located).
      - closeparen 9y ago
        Whether US jurisdiction applies to data held by US companies outside the US has so far depended on which court you ask, and appears to be leaning towards "yes." Certainly the citizenship of the entity holding the data matters, and from the GDPR's perspective, the citizenship of the data subject matters, but the "location" of the data itself has (maybe) mattered for about 2 years, and may not anymore after this works its way through the system. See, for example: https://arstechnica.com/tech-policy/2017/09/feds-google-stops-challenging-most-us-warrants-for-data-on-overseas-servers/ https://arstechnica.com/tech-policy/2017/09/feds-google-stop...

closeparen 9y ago

To my understanding, neither US nor EU law give a crap about the data's geography. And rightly so, because data doesn't have geography. EU privacy laws apply to all EU citizens, and US warrants apply to all US persons capable of facilitating them. The exception for US-owned databases in European datacenters was a bizarre, short-lived loophole created by case law which maps poorly onto the realities of the situations. I'd say it's the companies which have twisted themselves into knots to take advantage of this loophole, and expected that to be an enduring investment, which are having a problem.

pedrocr 9y ago
In that case how do you propose US-based companies operate in Europe? If it's not possible to follow EU privacy laws because US courts can compell you to break them should Google/Facebook/Microsoft just leave the EU market?
- closeparen 9y ago
  What other choice do they have? With the "data lives in Europe" loophole ending, then yeah, the US will have to suffer the economic consequences of its failure to come to an agreement with the EU.
  - pedrocr 9y ago
    I think there are two cases: 1. An AWS Ireland instance bought by a EU member: here the storage box analogy should apply fully. The data is indeed geographically located and being operated within that geography. US courts need to accept that they need to go through the local authorities to get a warrant for that data just like they would for any physical good. 2. A worldwide distributed database like the Facebook graph: here the analogy breaks down completely and the US courts are taking advantage of that to access anything they like. I'm sure their tune would change if suddenly the Chinese authorities forced the local Facebook subsidiary to hand over all the data of US citizens. For this the solution will need to be an international arbitration for data access. If the database is not geographically bound then the mechanism to ensure its privacy will have to be international as well. I think the Microsoft case was of type 1 and so new laws should not be needed. Cases of type 2 will be much harder and it may very well mean that Facebook becomes de facto illegal in Europe.
bonesss 9y ago
> To my understanding, neither US nor EU law give a crap about the data's geography How do you think search warrants and national espionage programs are carried out? ... That's where the law comes in: data is just "property". The law gives many craps about property :) > I'd say it's the companies which have twisted themselves into knots to take advantage of this loophole, and expected that to be an enduring investment, which are having a problem. The business conundrum is whether to cede massive, growing, markets to regional players or to try and straddle multiple legal regimes. That straddling means trying to reconcile different legal requirements, and that's what we're seeing: saying no to party A to respect the demands of party B. Far from a problem, this is a consequence of expansion and profitability. Far from a "pretzel" this is par for the course for multinationals, and a key area of legal precedence for the current IT behemoths (read: impacts billions in revenue). There are other corporate solutions to this issue, they're just much less profitable than todays approach from MS, Google, and others.
- closeparen 9y ago
  >How do you think search warrants and national espionage programs are carried out? Based on the citizenship of the targets. >Far from a "pretzel" this is par for the course for multinationals, and a key area of legal precedence for the current IT behemoths Well, not anymore if this ruling stands.
  - bonesss 9y ago
    > To my understanding, neither US nor EU law give a crap about the data's geography ... [search warrants... are carried out] based on the citizenship of the targets. Executing a legal search warrant involves using legally binding power on a legal entity within a specific jurisdiction. If property or entity is outside that jurisdiction then the laws do not apply. US and EU law give very, very, much a crap about their jurisdictions, and where property is (ie where data is located).
    - closeparen 9y ago
      Whether US jurisdiction applies to data held by US companies outside the US has so far depended on which court you ask, and appears to be leaning towards "yes." Certainly the citizenship of the entity holding the data matters, and from the GDPR's perspective, the citizenship of the data subject matters, but the "location" of the data itself has (maybe) mattered for about 2 years, and may not anymore after this works its way through the system. See, for example: https://arstechnica.com/tech-policy/2017/09/feds-google-stops-challenging-most-us-warrants-for-data-on-overseas-servers/ https://arstechnica.com/tech-policy/2017/09/feds-google-stop...