10 ms·
Europe continues to wrestle with the long arm of American law
- rebuilder 7y agoI Don't see what the conflict between the CLOUD act and GDPR, as described in the article is. GDPR requires companies to get consent before storing data, the CLOUD act enables US authorities to demand access to data even if it is stored on servers outside the USA.
- tapland 7y agoDo the US authorities log every one who views the files and when and all propagation of them? And sent that back to the business and make it available for the user?
- rtkwe 7y agoDoes the GDPR actually require a company to be able to provide all that data when the copy has been requested and sent to a state entity? I doubt the EU is going to require companies to do that either way though.
- pjc50 7y ago> The CLOUD act enables US authorities to demand access to data even if it is stored on servers outside the USA. That's the conflict. The GDPR imposes conditions on transferring that data to the USA. See https://gdpr-info.eu/art-44-gdpr/ https://gdpr-info.eu/art-44-gdpr/ and following sections especially https://gdpr-info.eu/art-49-gdpr/ https://gdpr-info.eu/art-49-gdpr/ If the data is not adequately protected - if it is fed into unaccountable law enforcement databases - then the transfer may not be lawful.
- big_chungus 7y ago> the transfer may not be lawful Lawful under whose law? It's legally required by CLOUD act, so mandatory under American law. This is the long arm of Europe just as much as America. You could have a company based and hosted in Belize that stores data about a European who committed a crime in America. America can demand that data under her law; Europe can demand it deleted under hers. Who is right? This is the making of both entities, not just America, unless there is some legal reason that the European law ought to take precedent. It's pretty clear what to do if you're incorporated in Europe or America; you follow the law of your base of operations. For multinationals or corporations alien to both, however, there's a dilemma. In other words, your moral favor towards GDPR doesn't make it more legally important than CLOUD, nor vice-versa. Both are just as significant for an alien company or for a multinational.
- gmueckl 7y agoEver since the Peace of Westphalia, the international law is that each country sets its own laws for its own territory. Country A cannot enact a law that is effect on the territory of country B. So if the data is physically stored in the EU, it is naturally subject to the GDPR and no law outside the EU can do a damn about that. The CLOUD act, on the other hand, breaks that principle: it tries to compel actors outside the territory of the US to comply with US law.
- rebuilder 7y agoIs it that clear-cut? The "actors" would be companies with a business presence in the USA. It's the data that is stored outside the country. I suppose the closest equivalent would be financial assets, e.g. funds held in bank accounts. Can a court in the USA order a US company, or one doing business in the USA, to hand over assets held in a foreign bank account?
- gmueckl 7y agoYour question is missing an imprtant stipulation: "when it is illegal for the bank to execute that order under the laws of the country in which the bank account resides." In this case, compliance with the court order is simply impossible. No ifs, no buts.
- tzs 7y agoThe bank wouldn't be the one executing the order. In a situation analogous to a CLOUD Act situation, the account holder would be ordered to withdraw the money from his foreign account and turn it over. To the foreign bank, it is no different than any other customer withdrawing money from their account.
- gmueckl 7y agoNo, the client gives the order and the bank executes it. If the order is unlawful for the bank, they cannot execute it.
- rebuilder 7y agoOk, that would be a clear conflict. There seems to be an exception for when "the transfer is necessary for the establishment, exercise or defence of legal claims". I'm not qualified to say whether that would cover law enforcement requests, or whether some other considerations would make it illegal under GDPR to comply with 3rd country legal requirements. It would seem like a serious oversight if the legislators haven't given thought to this, though.
- LunaSea 7y agoWouldn't the access by the US authorities be an infringement with the GDPR since they don't have a data processing contract and are not declared as official data broker third parties on every american company's website.
- big_chungus 7y agoUnder European law, sure. But the American government is not and cannot be bound by European law, only by bi-lateral treaty. In fact, not doing so would be a violation of American law, and deleting that data in compliance with GDPR would be illegal under American law. Regardless of your moral stance on the issue, one law does not have a greater legal significance. This is exactly why we have bi-lateral treaties.
- rebuilder 7y agoIt's the companies that are bound by laws in both jurisdictions. If a company operates in several jurisdictions, and can not comply with the laws in one without breaking the laws in others, it's not a matter of precedence, just a bad situation to be in. Edit:sorry, I didn't understand the point you were making. You're correct.
- harumph 7y agoYou don't see the problem with US authorities making demands of other nations? Are you the poster child for US entitlement? The US does not have the authority to police the world.
- throwaway744678 7y agoIs the CLOUD act applicable to non-US companies? Regarding GDPR, access to the data by law enforcement has specific rules [1] which makes them lawful in some cases. [1] https://www.dataprotection.ie/en/organisations/law-enforcement-directive https://www.dataprotection.ie/en/organisations/law-enforceme...
- HenryKissinger 7y agoSooner or later, a global government with global enforcement powers will be necessary if we want to tackle challenges of global magnitude, like digital privacy, climate change, and artificial intelligence. As long as national governments are free to do as they please, these situations will continue to exist. Think an EU-like structure, but for the world.
- ChuckNorris89 7y agoSooo...the UN but on steroids?
- TeMPOraL 7y agoHopefully, one day, because a world divided into nations is woefully unequipped to handle challenges that don't respect national borders.
- solidsnack9000 7y agoA world divided into provinces... A world divided into counties... A world divided into cities... Sub-jurisdictions are a fact of life.
- Someone 7y agoThe claim isn’t that subdivisions are evil, it is that we should aim for a tree, not a forest. When “city” was the top-level structure, there was more than one, and cities had conflicts (economical and wars). Countries solve that problem, but, because there’s more than one country, introduce the problem that countries had conflicts. Country groups (Germany, the USA, the EU, NATO, Warschau pact) solve that problem, but, because there’s more than one, introduce the problem that country groups have confocts. The UN, in theory, solves that, and, because there’s only one, don’t introduce another, but it isn’t powerful enough.
- solidsnack9000 7y ago
- danielfoster 7y agoThis article jumps from the CLOUD Act to the extradition of Dimitry Firtash to something about the US financial system to Iran... I see each point but this piece feels more like rambling than a comprehensive examination of any particular issue. It's very confusing that the article intertwines domestic issues (the CLOUD act) with unrelated foreign policy issues. I'm sure there are much better articles on this topic somewhere.
- gmueckl 7y agoI see the contrary. The US has started to try to enact its laws outside its boundaries in ways that run counter to international conventions. This is maybe not a strategy, but at least a general trend. The article tries to make that obvious by listing examples that underscore how broad that trend is. You have to look elsewhere for the juicy details. There's a lot to be discovered.
- agapon 7y agoAmong those examples, it's interesting that Ukraine would gladly either prosecute or extradite Firtash -- a citizen of Ukraine, but Austria does not let either to happen. And I think that it speaks heaps of Austria and its business and political elite's connections to Russia.
- kofejnik 7y agoI, for one, would be _very_ happy to see Firtash extradited; he's Putin's ally, his dirty money and connections corrupted justice in Ukraine for years and obviously had some influence over Austrian bureaucrats, and I hope DOJ have their way with him, preferably with a rusty shovel
- agapon 7y agoI am curious who and why downvotes the parent comment without providing any counter-argument or just a comment of their own indeed.
- imgabe 7y agoMeanwhile here in the US I have to acknowledge that websites use cookies 500,000 times a day. Thanks, Europe.
- xurias 7y agoWell, we figured if we're so powerless, we might as well punish the US for their misdeeds in other ways. You're welcome.
- throwaway744678 7y agoWe also punish ourselves in the process, though.
- xurias 7y agoWe have to be prepared to sacrifice if we're to effect change in the world.
- janc_ 7y agoThat has nothing (or not much) to do with Europe, but everything with the website owners/makers.
- briandear 7y agoThose website owners put those cookie notices up just for fun?
- brnt 7y agoBecause they want your data. If they didn't, no need to give the user any options.
- Permit 7y agoBefore this law websites collected my data. After this law, websites collect my data AND I am harassed with notices. If the intent of this law was to stop websites from collecting user data then it appears to me it has completely failed while also introducing more friction for users.
- hartator 7y ago> Europe continues to wrestle with the long arm of American law In the case of the right to be forgotten, isn’t that the reverse? Europe trying to make Americans not to talk about past crimes of EU citizens?
- CrazyStat 7y agoEurope claims that the GDPR applies to data stored outside Europe, USA claims that their search warrants apply to data stored outside the USA. Seems pretty symmetrical to me.
- avocado4 7y agoThis article is a nationalist piece with few to no logical arguments. It's meant to spread a flamewar online.
- gitanovic 7y agoI don't agree, the article is unilateral, but it has very sound arguments
- missjellyfish 7y agoNo, these are apples and oranges. GDPR regulates what obligations a site collecting data of european users has (for example, acquiring consent). This imposed regulations on a direct, contractual relationship (whether the contract is implicit doesn’t matter here). Every party involved then has rights to sue if the agreed contract is violated. A US company providing service to US customers has no obligation from GDPR (but have fun making that distinction in practice) US search warrants on the other hand basically circumvent local law. I, as an Austrian Citizen, have no way to protect myself against such warrants if I decide to put my data in, let’s say, office365, even if the physical location of my data is within Europe and the actual operation of the Servers is handled by a different, European company. In my opinion, this is nuts. The US should have to go through the same channels for foreign police assistance as everybody else.
- InTheArena 7y agoNot a very well reasoned article. I think you can make a general argument about the role of US power, but in terms of legal structure, there is no question that GDPR - at the moment - is by far the most invasive on laws that apply to other countries, without respecting sovereignty. Similarly cases requiring other countries to censor peach - although as this article notes, this was brought back down to earth.
- antirapepolice 7y ago> is by far the most invasive on laws that apply to other countries, without respecting sovereignty It is so strange that Europe tries to protect European citizens? Now imagine being Italian and have witnessed the Cermis massacre, in time of peace, knowing that US covered the assassins... https://en.wikipedia.org/wiki/Cavalese_cable_car_disaster_%281998%29 https://en.wikipedia.org/wiki/Cavalese_cable_car_disaster_%2...
- briandear 7y agoMy problem is with the impacts of FATCA — a law that has dire outcomes for Americans and “accidental” Americans (and their spouses) living abroad. These data laws have limited material effects to someone’s daily life, but FATCA affects everything from mortgage eligibility, retirement accounts and even daily banking. https://etcanada.com/news/521610/hundreds-sue-french-bank-boursorama-for-discrimination-and-possibly-a-brad-pitt-ad/ https://etcanada.com/news/521610/hundreds-sue-french-bank-bo...
- timoth 7y agoIt's even annoying for non-Americans living in other countries who have to declare that they're not American and don't have any tax liabilities to the USA.
- parsimo2010 7y agoI don't see how this is confusing to people. EU and USA laws don't apply to the data- you can't put data in jail and you can't fine data. The laws apply to the people that control the data. It's not about whether or not the data is stored in a particular locality, it's whether or not there is a person within your jurisdiction that has access to/control of the data (if a server is located in your jurisdiction that implies that a person is around to shut the server down). The big issue is that we underestimate the exposure we have to other countries, especially if you sell a service or ads to foreign entities. The large scale of big websites means that they have people working in multiple countries, so they are subject to multiple sets of laws. I don't really think any American lawyer is arguing in a courtroom in the EU that American laws apply in Europe. But they might be telling a company HQ in the EU to follow American laws or they will shut down their American servers, bank transactions, employees, and supporting contractors/software- all of which are subject to American laws. And if a European citizen travels to the USA, breaks the law, and then travels back to Europe, then an extradition request is valid, and the EU is going to have a tough time if they deny it. The EU won't comply with an extradition request from the USA if the law wasn't broken in the USA. However, I think we often underestimate the amount of exposure that these multi-national companies really have. A company in the EU can't flaunt American laws and tell their American employees to break American laws. So when we find situations where it is literally impossible to comply with both the GDPR and CLOUD act these multi-national companies are going to have to separate themselves. Facebook-EU and Facebook-USA are going to have to have a big wall between them, and there can be an API that lets Facebook-EU users see the profiles of Facebook-USA users, but they will have to be separate entities to comply with each set of laws, and so that American lawyers can't pressure Facebook-EU to comply with something by threatening the American version.
- RcouF1uZ4gsC 7y ago> Washington cannot have a veto over European legislation or foreign policy initiatives In regards to foreign policy, Europe will really have to invest in its military capabilities if they want more independence from the US. The fact that Europe was not able to effectively intervene in either Bosnia or Libya without US assistance when they are literally in the EU’s back yard means that the EU foreign policy will play second fiddle to US foreign policy.
- cycop 7y agoSounds like bad foreign policy , there are plenty of examples in history of what is bad for EU is even worse for the rest of Western countries. But works in reverse also, what is bad for the US is bad for the EU. Isolation is never the answer and only makes dictators that suppress human rights.
- jnurmine 7y agoTo understand the situation of today it is helpful to understand the past; the European efforts to build up a common pan-European defence infrastructure has been traditionally continuously torpedoed by Great Britain and this has taken place over a long period of time. There are of course reasons for this, and obviously Great Britain is acting in their self-interest (they don't want a "shadow NATO" and they don't want to diminish in importance in USAs eyes, UKUSA/FVEY etc.), but Great Britain's interests are not really in the interests of Europe as a whole. Now that Brexit seems to be happening, one way or another, expect to see a lot of European Union movement in the defence area. Also, time will tell if the e.g. UK Joint Expeditionary Force will stay in existence and enhance the new pan-European defence mechanisms with, among other things, British nuclear weapons, or not. Furthermore, it is very naïve to assume that Europe is not already doing full-on preparations for the military implications of Brexit as well as the everso more likely dismantling of NATO. Mr. Trump has been signalling the latter for a long time, and even though much of his output seems to be a clumsy way to lure EU into doing more military business with the USA, the fact is that the White House and particularily the President of the USA is acting more and more erratic every day, so basically anything could happen (and probably will!). Having a strategical autonomy and owning a substantial defence ability and capability is an existential issue for Europe, given its geographical location, as well as the increasingly hostile political rhetoric and gray zone actions of its neighbours, as well as the continuously erratic behaviour of its number one ally.