> In any realistic architecture, there are are a million exceptions to "this Irish user's data is stored in Ireland": offsite backups, cross-datacenter requests

> In any realistic architecture, there are are a million exceptions to "this Irish user's data is stored in Ireland": offsite backups, cross-datacenter requests within backend systems, offline analytical stores, queries, derived tables, etc. ... Data having a geographical location is an incoherent concept in the context of the architectures of modern multinational tech companies. That much is obvious from simply reading their engineering blogs and whitepapers. Italicized for emphasis, because that's the part where one discussion attempts to diverge into two. It's true what you're saying, in exactly that one context: from the point of view of a multinational cloud provider there's a lot of different ingredients coming together to make "a" stew. For what the OP was discussing though: what you're saying is completely wrong. From the context of the Irish Government who is protecting sensitive personal data on Irish citizens and deciding how it, the Irish Government, and their related services should handle data, there is only one legally defensible position as of today: full control of the legal entities handling the data. The EU has very little legal sway outside the EU, there is no baked in legal reciprocity, and your suggestion for data handling laws fall woefully short of the real world issues (like... hate speech legislation, abortion politics, etc). You're thinking about GMail. The legislation is looking at something like the entirety Irish health services and handling sensitive individual research data. From that context the idea of having no data governance and relying on inadequate legal agreements directly contradicts expert opinion and legal requirements. Personal Identification Numbers do a lot to streamline public services, they also change the relative sensitivity of data at rest. Therefore the EU has decided that putting such data in an environment where something like Paxos would be relevant is a complete no-go. Data has a location until it is copied multiple places. The EU has decided they don't want any of those places to be outside their jurisdiction for the good of their citizens.