11 ms·

I Don't see what the conflict between the CLOUD act and GDPR, as described in the article is. GDPR requires companies to get consent before storing data, the CL

I Don't see what the conflict between the CLOUD act and GDPR, as described in the article is. GDPR requires companies to get consent before storing data, the CLOUD act enables US authorities to demand access to data even if it is stored on servers outside the USA.

tapland 7y ago
Do the US authorities log every one who views the files and when and all propagation of them? And sent that back to the business and make it available for the user?
- rtkwe 7y ago
  Does the GDPR actually require a company to be able to provide all that data when the copy has been requested and sent to a state entity? I doubt the EU is going to require companies to do that either way though.
pjc50 7y ago
> The CLOUD act enables US authorities to demand access to data even if it is stored on servers outside the USA. That's the conflict. The GDPR imposes conditions on transferring that data to the USA. See https://gdpr-info.eu/art-44-gdpr/ https://gdpr-info.eu/art-44-gdpr/ and following sections especially https://gdpr-info.eu/art-49-gdpr/ https://gdpr-info.eu/art-49-gdpr/ If the data is not adequately protected - if it is fed into unaccountable law enforcement databases - then the transfer may not be lawful.
- big_chungus 7y ago
  > the transfer may not be lawful Lawful under whose law? It's legally required by CLOUD act, so mandatory under American law. This is the long arm of Europe just as much as America. You could have a company based and hosted in Belize that stores data about a European who committed a crime in America. America can demand that data under her law; Europe can demand it deleted under hers. Who is right? This is the making of both entities, not just America, unless there is some legal reason that the European law ought to take precedent. It's pretty clear what to do if you're incorporated in Europe or America; you follow the law of your base of operations. For multinationals or corporations alien to both, however, there's a dilemma. In other words, your moral favor towards GDPR doesn't make it more legally important than CLOUD, nor vice-versa. Both are just as significant for an alien company or for a multinational.
  - gmueckl 7y ago
    Ever since the Peace of Westphalia, the international law is that each country sets its own laws for its own territory. Country A cannot enact a law that is effect on the territory of country B. So if the data is physically stored in the EU, it is naturally subject to the GDPR and no law outside the EU can do a damn about that. The CLOUD act, on the other hand, breaks that principle: it tries to compel actors outside the territory of the US to comply with US law.
    - rebuilder 7y ago
      Is it that clear-cut? The "actors" would be companies with a business presence in the USA. It's the data that is stored outside the country. I suppose the closest equivalent would be financial assets, e.g. funds held in bank accounts. Can a court in the USA order a US company, or one doing business in the USA, to hand over assets held in a foreign bank account?
      - gmueckl 7y ago
        Your question is missing an imprtant stipulation: "when it is illegal for the bank to execute that order under the laws of the country in which the bank account resides." In this case, compliance with the court order is simply impossible. No ifs, no buts.
        tzs 7y ago
        The bank wouldn't be the one executing the order. In a situation analogous to a CLOUD Act situation, the account holder would be ordered to withdraw the money from his foreign account and turn it over. To the foreign bank, it is no different than any other customer withdrawing money from their account.
        gmueckl 7y ago
        No, the client gives the order and the bank executes it. If the order is unlawful for the bank, they cannot execute it.
- rebuilder 7y ago
  Ok, that would be a clear conflict. There seems to be an exception for when "the transfer is necessary for the establishment, exercise or defence of legal claims". I'm not qualified to say whether that would cover law enforcement requests, or whether some other considerations would make it illegal under GDPR to comply with 3rd country legal requirements. It would seem like a serious oversight if the legislators haven't given thought to this, though.
LunaSea 7y ago
Wouldn't the access by the US authorities be an infringement with the GDPR since they don't have a data processing contract and are not declared as official data broker third parties on every american company's website.
- big_chungus 7y ago
  Under European law, sure. But the American government is not and cannot be bound by European law, only by bi-lateral treaty. In fact, not doing so would be a violation of American law, and deleting that data in compliance with GDPR would be illegal under American law. Regardless of your moral stance on the issue, one law does not have a greater legal significance. This is exactly why we have bi-lateral treaties.
  - rebuilder 7y ago
    It's the companies that are bound by laws in both jurisdictions. If a company operates in several jurisdictions, and can not comply with the laws in one without breaking the laws in others, it's not a matter of precedence, just a bad situation to be in. Edit:sorry, I didn't understand the point you were making. You're correct.
harumph 7y ago
You don't see the problem with US authorities making demands of other nations? Are you the poster child for US entitlement? The US does not have the authority to police the world.
throwaway744678 7y ago
Is the CLOUD act applicable to non-US companies? Regarding GDPR, access to the data by law enforcement has specific rules [1] which makes them lawful in some cases. [1] https://www.dataprotection.ie/en/organisations/law-enforcement-directive https://www.dataprotection.ie/en/organisations/law-enforceme...

tapland 7y ago

Do the US authorities log every one who views the files and when and all propagation of them? And sent that back to the business and make it available for the user?

rtkwe 7y ago
Does the GDPR actually require a company to be able to provide all that data when the copy has been requested and sent to a state entity? I doubt the EU is going to require companies to do that either way though.

pjc50 7y ago

> The CLOUD act enables US authorities to demand access to data even if it is stored on servers outside the USA. That's the conflict. The GDPR imposes conditions on transferring that data to the USA. See https://gdpr-info.eu/art-44-gdpr/ https://gdpr-info.eu/art-44-gdpr/ and following sections especially https://gdpr-info.eu/art-49-gdpr/ https://gdpr-info.eu/art-49-gdpr/ If the data is not adequately protected - if it is fed into unaccountable law enforcement databases - then the transfer may not be lawful.

big_chungus 7y ago
> the transfer may not be lawful Lawful under whose law? It's legally required by CLOUD act, so mandatory under American law. This is the long arm of Europe just as much as America. You could have a company based and hosted in Belize that stores data about a European who committed a crime in America. America can demand that data under her law; Europe can demand it deleted under hers. Who is right? This is the making of both entities, not just America, unless there is some legal reason that the European law ought to take precedent. It's pretty clear what to do if you're incorporated in Europe or America; you follow the law of your base of operations. For multinationals or corporations alien to both, however, there's a dilemma. In other words, your moral favor towards GDPR doesn't make it more legally important than CLOUD, nor vice-versa. Both are just as significant for an alien company or for a multinational.
- gmueckl 7y ago
  Ever since the Peace of Westphalia, the international law is that each country sets its own laws for its own territory. Country A cannot enact a law that is effect on the territory of country B. So if the data is physically stored in the EU, it is naturally subject to the GDPR and no law outside the EU can do a damn about that. The CLOUD act, on the other hand, breaks that principle: it tries to compel actors outside the territory of the US to comply with US law.
  - rebuilder 7y ago
    Is it that clear-cut? The "actors" would be companies with a business presence in the USA. It's the data that is stored outside the country. I suppose the closest equivalent would be financial assets, e.g. funds held in bank accounts. Can a court in the USA order a US company, or one doing business in the USA, to hand over assets held in a foreign bank account?
    - gmueckl 7y ago
      Your question is missing an imprtant stipulation: "when it is illegal for the bank to execute that order under the laws of the country in which the bank account resides." In this case, compliance with the court order is simply impossible. No ifs, no buts.
      - tzs 7y ago
        The bank wouldn't be the one executing the order. In a situation analogous to a CLOUD Act situation, the account holder would be ordered to withdraw the money from his foreign account and turn it over. To the foreign bank, it is no different than any other customer withdrawing money from their account.
        gmueckl 7y ago
        No, the client gives the order and the bank executes it. If the order is unlawful for the bank, they cannot execute it.
rebuilder 7y ago
Ok, that would be a clear conflict. There seems to be an exception for when "the transfer is necessary for the establishment, exercise or defence of legal claims". I'm not qualified to say whether that would cover law enforcement requests, or whether some other considerations would make it illegal under GDPR to comply with 3rd country legal requirements. It would seem like a serious oversight if the legislators haven't given thought to this, though.

LunaSea 7y ago

Wouldn't the access by the US authorities be an infringement with the GDPR since they don't have a data processing contract and are not declared as official data broker third parties on every american company's website.

big_chungus 7y ago
Under European law, sure. But the American government is not and cannot be bound by European law, only by bi-lateral treaty. In fact, not doing so would be a violation of American law, and deleting that data in compliance with GDPR would be illegal under American law. Regardless of your moral stance on the issue, one law does not have a greater legal significance. This is exactly why we have bi-lateral treaties.
- rebuilder 7y ago
  It's the companies that are bound by laws in both jurisdictions. If a company operates in several jurisdictions, and can not comply with the laws in one without breaking the laws in others, it's not a matter of precedence, just a bad situation to be in. Edit:sorry, I didn't understand the point you were making. You're correct.

harumph 7y ago

You don't see the problem with US authorities making demands of other nations? Are you the poster child for US entitlement? The US does not have the authority to police the world.

throwaway744678 7y ago

Is the CLOUD act applicable to non-US companies? Regarding GDPR, access to the data by law enforcement has specific rules [1] which makes them lawful in some cases. [1] https://www.dataprotection.ie/en/organisations/law-enforcement-directive https://www.dataprotection.ie/en/organisations/law-enforceme...