3 ms·

> Google isn't removing data protection from UK users, it's moving their data to the US This means that Google is removing data protection from UK users. There

> Google isn't removing data protection from UK users, it's moving their data to the US This means that Google is removing data protection from UK users. There is absolutely no way to claim in good faith that you can protect your users when the data exists (or is touched in any way by, but that's another story) in the US, the examples for which we've seen often enough that every reader can be assumed to be familiar with them by now.

makomk 7y ago
The EU's position is that you can, in fact, claim in good faith that you're protecting your users when the data exists in the US, despite evidence to the contrary. There have been a few court cases about this, one of which is currently in progress, and at least one of which they lost and carried on doing it anyway. In any case, it's not something you can rely on EU data protection rules to protect against right now. On the other hand, the EU has been threatening to refuse to agree on the same for the UK, despite both having the exact same data protection frameworks as it currently stands. The actual rules have at least as much to do with internaational politics as they do with protecting people's privacy.
thu2111 7y ago
The physical location of the data doesn't matter. US employees can access any datacenter remotely around the world, so I often wonder why this topic comes up at all. For a while playing games with physical location was a neat legal hack in the US specifically, but the USG closed that loophole a few years back if I recall correctly and can now force US firms to give up data even if it's in a foreign datacenter.
- toyg 7y ago
  US employees accessing EU data held in the EU in manners that contravene EU laws, would be breaking the law and would expose their company to prosecution in EU courts. The issue is not about technical feasibility, it’s about exposure to legal repercussions. You can argue that respecting EU laws might expose you to prosecution in US and vice-versa, and that’s absolutely true. International law is messy.

makomk 7y ago

The EU's position is that you can, in fact, claim in good faith that you're protecting your users when the data exists in the US, despite evidence to the contrary. There have been a few court cases about this, one of which is currently in progress, and at least one of which they lost and carried on doing it anyway. In any case, it's not something you can rely on EU data protection rules to protect against right now. On the other hand, the EU has been threatening to refuse to agree on the same for the UK, despite both having the exact same data protection frameworks as it currently stands. The actual rules have at least as much to do with internaational politics as they do with protecting people's privacy.

thu2111 7y ago

The physical location of the data doesn't matter. US employees can access any datacenter remotely around the world, so I often wonder why this topic comes up at all. For a while playing games with physical location was a neat legal hack in the US specifically, but the USG closed that loophole a few years back if I recall correctly and can now force US firms to give up data even if it's in a foreign datacenter.

toyg 7y ago
US employees accessing EU data held in the EU in manners that contravene EU laws, would be breaking the law and would expose their company to prosecution in EU courts. The issue is not about technical feasibility, it’s about exposure to legal repercussions. You can argue that respecting EU laws might expose you to prosecution in US and vice-versa, and that’s absolutely true. International law is messy.