5 ms·

What’s been hard recently in regards to EU privacy laws is the impact of SchremsII ruling. We have found multiple EU countries that interpret the guidance of “y

What’s been hard recently in regards to EU privacy laws is the impact of SchremsII ruling. We have found multiple EU countries that interpret the guidance of “you can’t use US-owned clouds (Ie all of them)” even with client encryption and data locality enforcement for fear of FISA. That’s not privacy concerns but it piggybacks on privacy concerns via GDPR. https://www.theregister.com/2020/11/23/european_recommendations_on_schrems_ii/ https://www.theregister.com/2020/11/23/european_recommendati... There’s still a lot to work out for these privacy laws.

mrweasel 5y ago
We have the same “problem” the AWS team is most helping customers migrate of AWS to on-prem (well our datacenters). Nothing new have been built on public cloud for almost a year. That’s also why I’m currently extremely negative about new SaaS solution presented on HN. We can’t use ANY of them. There’s a huge market for anyone who care to built and ship on-prem software right now. Atlassian for instance just left a massive hole in the EU market, by killing Jira and Confluence server products.
- joshuaissac 5y ago
  > Atlassian for instance just left a massive hole in the EU market, by killing Jira and Confluence server products. They still provide the Data Center product for those who really want to self-host, but the cost is a lot higher.
  - mrweasel 5y ago
    I know, we use data center edition, but we have perhaps 15 customers who cannot afford the licens, but also can’t use Atlassian Cloud.
belter 5y ago
Uhmm...need to dig deeper into this SchremsII rullling. Looking at the comments going on in the Register reference you included and what are the moment recommendations: https://edpb.europa.eu/sites/edpb/files/consultation/edpb_recommendations_202001_supplementarymeasurestransferstools_en.pdf https://edpb.europa.eu/sites/edpb/files/consultation/edpb_re... ...It would look like using GSuite or Office365 would also not be allowed. Although I am strongly in favor all possible privacy measures, the move to onsite solutions is likely to cause an decrease in privacy safety. Most data center and private companies are completely unable to match anything near the SOC controls and internal procedures of most cloud providers.
- dbernick 5y ago
  That’s correct. Conservative interpretation of SchremsII is that US privacy Shield is dead and no US-owned asset may hold sensitive EU data. We have found in practice since this ruling that each country has different interpretations as to what “countermeasures” are allowed. From “yeah just make sure to use data locality” to “use sgx enclaves but you’re ok after that.” To “if you cannot resist fisa, we cannot trust you.”
fmajid 5y ago
That’s eminently sensible. What country, if I may ask?
- malermeister 5y ago
  All of the EU. It's a ruling by the Court of Justice of the European Union.
- dbernick 5y ago
  I can’t say which countries have been MOST conservative and which haven’t for confidential reasons. However some countries, like France, have recently come around and said “yeah we need an eu cloud but for right now just use an American cloud.” https://www.google.com/amp/s/venturebeat.com/2021/05/17/france-says-google-microsoft-cloud-services-are-ok-for-sensitive-data/amp/ https://www.google.com/amp/s/venturebeat.com/2021/05/17/fran... Another country we deal with doesn’t agree and has no legal path, despite customer controlled keys and SGX, to use a US cloud.
  - fmajid 5y ago
    I agree the French position is a stunning capitulation, specially from a country that is generally hard-nosed on sovereignty issues and quite justifiably cynical about espionage.
jimmaswell 5y ago
Europe continues to slowly make itself a no-man's land for tech. How long until the great firewall of the EU?
deleted 5y ago
[deleted]

mrweasel 5y ago

We have the same “problem” the AWS team is most helping customers migrate of AWS to on-prem (well our datacenters). Nothing new have been built on public cloud for almost a year. That’s also why I’m currently extremely negative about new SaaS solution presented on HN. We can’t use ANY of them. There’s a huge market for anyone who care to built and ship on-prem software right now. Atlassian for instance just left a massive hole in the EU market, by killing Jira and Confluence server products.

joshuaissac 5y ago
> Atlassian for instance just left a massive hole in the EU market, by killing Jira and Confluence server products. They still provide the Data Center product for those who really want to self-host, but the cost is a lot higher.
- mrweasel 5y ago
  I know, we use data center edition, but we have perhaps 15 customers who cannot afford the licens, but also can’t use Atlassian Cloud.

belter 5y ago

Uhmm...need to dig deeper into this SchremsII rullling. Looking at the comments going on in the Register reference you included and what are the moment recommendations: https://edpb.europa.eu/sites/edpb/files/consultation/edpb_recommendations_202001_supplementarymeasurestransferstools_en.pdf https://edpb.europa.eu/sites/edpb/files/consultation/edpb_re... ...It would look like using GSuite or Office365 would also not be allowed. Although I am strongly in favor all possible privacy measures, the move to onsite solutions is likely to cause an decrease in privacy safety. Most data center and private companies are completely unable to match anything near the SOC controls and internal procedures of most cloud providers.

dbernick 5y ago
That’s correct. Conservative interpretation of SchremsII is that US privacy Shield is dead and no US-owned asset may hold sensitive EU data. We have found in practice since this ruling that each country has different interpretations as to what “countermeasures” are allowed. From “yeah just make sure to use data locality” to “use sgx enclaves but you’re ok after that.” To “if you cannot resist fisa, we cannot trust you.”

fmajid 5y ago

That’s eminently sensible. What country, if I may ask?

malermeister 5y ago
All of the EU. It's a ruling by the Court of Justice of the European Union.
dbernick 5y ago
I can’t say which countries have been MOST conservative and which haven’t for confidential reasons. However some countries, like France, have recently come around and said “yeah we need an eu cloud but for right now just use an American cloud.” https://www.google.com/amp/s/venturebeat.com/2021/05/17/france-says-google-microsoft-cloud-services-are-ok-for-sensitive-data/amp/ https://www.google.com/amp/s/venturebeat.com/2021/05/17/fran... Another country we deal with doesn’t agree and has no legal path, despite customer controlled keys and SGX, to use a US cloud.
- fmajid 5y ago
  I agree the French position is a stunning capitulation, specially from a country that is generally hard-nosed on sovereignty issues and quite justifiably cynical about espionage.

jimmaswell 5y ago

Europe continues to slowly make itself a no-man's land for tech. How long until the great firewall of the EU?

deleted 5y ago

[deleted]