4 ms·

From the Schrems II judgment: > Where the controller or a processor established in the European Union is not able to take adequate additional measures to guara

From the Schrems II judgment: > Where the controller or a processor established in the European Union is not able to take adequate additional measures to guarantee such protection, the controller or processor or, failing that, the competent supervisory authority, are required to suspend or end the transfer of personal data to the third country concerned. It would seem as though any EU company that can be compelled to transfer data to the US would be found not to be able to take adequate measures to guarantee the protection of the data. I'm not familiar enough with the law in the US to understand whether the US authorities can compel an EU subsidiary of a US company to transfer data out of the EU, but if so...

Kbelicius 5y ago
> I'm not familiar enough with the law in the US to understand whether the US authorities can compel an EU subsidiary of a US company to transfer data out of the EU, but if so... They can. If I remember correctly Microsoft refused FBI request for some data that was stored in Ireland so the Cloud Act was created.
- realityking 5y ago
  It’s slightly more nuanced. In the case the FBI compelled Microsoft’s US operations, with employees based in the US to access data stored on a server in Ireland and to hand them over. GP is wondering if no US employees had access to the data directly if US law would have Microsoft US order Microsoft Ireland (which is a wholly owned subsidiary) to transfer the data to the US. It’s an interesting question. My non-lawyer take, even if they can force Microsoft US to make the request ultimately Microsoft Ireland is an Irish company operating under Irish law. If the data transfer to Microsoft US is illegal, they mustn’t do it. A situation where this already happens is technology transfers. If information is export controlled (mostly military related), a foreign non-EU/non-NATO owner of a German company can ask and demand as much as they want, non of their employees will ever see that information.
j16sdiz 5y ago
guess this meant EU company can't do business with Chinese either.

Kbelicius 5y ago

> I'm not familiar enough with the law in the US to understand whether the US authorities can compel an EU subsidiary of a US company to transfer data out of the EU, but if so... They can. If I remember correctly Microsoft refused FBI request for some data that was stored in Ireland so the Cloud Act was created.

realityking 5y ago
It’s slightly more nuanced. In the case the FBI compelled Microsoft’s US operations, with employees based in the US to access data stored on a server in Ireland and to hand them over. GP is wondering if no US employees had access to the data directly if US law would have Microsoft US order Microsoft Ireland (which is a wholly owned subsidiary) to transfer the data to the US. It’s an interesting question. My non-lawyer take, even if they can force Microsoft US to make the request ultimately Microsoft Ireland is an Irish company operating under Irish law. If the data transfer to Microsoft US is illegal, they mustn’t do it. A situation where this already happens is technology transfers. If information is export controlled (mostly military related), a foreign non-EU/non-NATO owner of a German company can ask and demand as much as they want, non of their employees will ever see that information.

j16sdiz 5y ago

guess this meant EU company can't do business with Chinese either.