34 ms·

Austrian DPA Ruling Against Google Paves the Way to EU-Based Cloud Services

138 points by endofreach 5y ago

taubek 5y ago
What would happen if Google would decide to host all of EU related data in EU? They would be 100% compliant?
- john61 5y ago
  No, because Google hast to comply with US law and has to transfer data to US officials.
  - dbbk 5y ago
    Not if it's run through a European subsidiary surely
    - ToruiDev 5y ago
      They still do since they're a subsidiary/related. Microsoft tried to get around that by not hosting in the EU but having a european trustee do it for them. That got us the CLOUD act
    - floatingatoll 5y ago
      The rulings this past week specifically contradict this. Subsidiaries of US corporations are subject to illegal-under-GDPR data collection requests by US authorities, just as much as any other US corporation, as the subsidiary has no legal protections under US law from GDPR-illegal requests by its parent.
- Deukhoofd 5y ago
  It'd only be compliant if they would then also not allow US intelligence agencies to access the data at will. That would however break US law, specifically section 702 of the Foreign Intelligence Surveillance Act
- deleted 5y ago
  [deleted]
radicalbyte 5y ago
This is an excellent decision from the Austrian DPA: there is no good argument for exfiltrating data to a country with low-to-non-existent data-protection standards. It would be nice if the same logic applied to manufacturing and environmental legislation - it stops the race to the bottom.
- nix23 5y ago
  Also cloud-act, not the best idea to open up your crown-jewels to every single US-Secret-service....by default ;)
- belter 5y ago
  Will make no difference for what really matters... "BND helped NSA to spy on Austria, EU partners: report" https://www.aa.com.tr/en/world/bnd-helped-nsa-to-spy-on-austria-eu-partners-report/51623 https://www.aa.com.tr/en/world/bnd-helped-nsa-to-spy-on-aust... "Alleged NSA post in Austria becomes state affair" https://apnews.com/a3537677459e41b9ba4d21d8208dd28a https://apnews.com/a3537677459e41b9ba4d21d8208dd28a "UK, Dutch spy agencies curb intel flow to Austria over Russia ties: MP" https://www.reuters.com/article/us-austria-security-idUSKCN1RL2CM https://www.reuters.com/article/us-austria-security-idUSKCN1... "Vienna Is the New Havana Syndrome Hot Spot" https://www.newyorker.com/news/news-desk/vienna-is-the-new-havana-syndrome-hotspot https://www.newyorker.com/news/news-desk/vienna-is-the-new-h...
  - Puts 5y ago
    At least it seems like the head of the Danish intelligence services is actually facing charges for helping the NSA spy on Swedish politicians: https://www.dw.com/en/danish-spy-chief-detained-over-highly-sensitive-leak/a-60379168 https://www.dw.com/en/danish-spy-chief-detained-over-highly-... But I think this more then anything shows why the US should not be regarded a country with adequate level of data protection. I would honestly just assume that they force Google to record every single meeting between heads of states or meetings with companies that work in telecom or weapon systems. Even the most boring meeting with officials in some small municipality can probably be valuable information about infrastructure and how it's going to be protected and these are maybe the most unsuspecting because they think "why would anybody care about the water distribution in our small city".
sirwitti 5y ago
This is already affecting websites and web apps. At least all of our customers are moving away from Google Analytics and many try to also get rid of other Google services like fonts and maps. I'm very interested to see what this changes in other european countries.
- mrweasel 5y ago
  We can't sell AWS consulting services to anyone right now, haven't been able to for over a year, almost two I think. Non of our clients trust Amazon right now. The claims from AWS is that it's fine to host EU data in AWS, but very few companies are willing to risk that.
  - WrtCdEvrydy 5y ago
    I mean, they have EU datacenters... the issue with Google Analytics is that this data can be moved through other datacenters. This was one of the ways the NSA programs worked... just tap the google lines which were unencrypted and slurp the data as it moved from datacenter to datacenter.
    - BjoernKW 5y ago
      > I mean, they have EU datacenters That doesn't matter anymore. According to the relatively recent ECJ ruling mentioned in the article you're not allowed to transfer any PII to companies that are in any way affiliated with a US-based entity (e.g., by virtue of having a US-based parent company), which clearly is the case for Amazon and AWS. It doesn't stop there. According to some privacy experts, even a third party just having a US-based supplier might be construed as a customer of that third party being in violation of GDPR, at which point we'd basically have to cease all economic activity.
      - jtbayly 5y ago
        Go GDPR for the win! I like the goal of privacy, but I won't be sad to see the ridiculous GDPR law implode.
wbl 5y ago
EU based cloud services always could compete before. Now they will compete on the basis of being in the EU instead of being better.
- DaiPlusPlus 5y ago
  Nah, what happens is the US-based companies will just geo-wall the data and throw more money at their EU-based AWS and Azure regions.
  - rini17 5y ago
    To me it reads as only walling the data off is insufficient. They will have to incorporate in Europe or in jurisdiction without FISA-like laws and completely split whole operation there.
    - 7steps2much 5y ago
      I believe that it would come down to this as well. The problem is both them being located in the US AND being a US company. Alternatively they could mirror an approach that Microsoft had with ther Office Online for a while, that is find a European company acting as "trustee" for the data, so that even if the NSA came knocking the US based company would not have any data on any of their infrastructure it could give them.
      - spaniard89277 5y ago
        But this is only viable for very large companies.
        slig 5y ago
        One might think that all these extra regulations benefits only the giants and curbs any newcomers.
        5y ago
ReleaseCandidat 5y ago
That's again based on the work of Noyb and Max Schrems: In July 2020, the CJEU has issued its groundbreaking "Schrems II" ruling, holding that a transfer to US providers that fall under FISA 702 and EO 12.333 violate the rules on international data transfers in the GDPR. The CJEU consequently annulled the transfer deal "Privacy Shield", after annulling the previous deal "Safe Harbor" in 2015. While this sent shock waves through the tech industry, US providers and EU data exporters have largely ignored the case. Just like Microsoft, Facebook or Amazon, Google has relied on so-called "Standard Contract Clauses" to continue data transfers and calm its European business partners. Max Schrems, honorary chair of noyb.eu: "Instead of actually adapting services to be GDPR compliant, US companies have tried to simply add some text to their privacy policies and ignore the Court of Justice. Many EU companies have followed the lead instead of switching to legal options." https://noyb.eu/en/austrian-dsb-eu-us-data-transfers-google-analytics-illegal https://noyb.eu/en/austrian-dsb-eu-us-data-transfers-google-... https://noyb.eu/en/101-complaints-eu-us-transfers-filed https://noyb.eu/en/101-complaints-eu-us-transfers-filed https://noyb.eu/en/update-noybs-101-complaints-eu-us-data-transfers https://noyb.eu/en/update-noybs-101-complaints-eu-us-data-tr...
jacquesm 5y ago
If there is ever going to be an EU version of a GoFundMe for a statue for Schrems I'm in. It's one thing to have good privacy laws, it's quite another to get them enforced. As public service comes this a fantastic job for all of us.
- rpadovani 5y ago
  You should support Noyb then, the no-profit he works for! https://noyb.eu/en https://noyb.eu/en I am not affiliated, but I am a massive supporter of them and is one of the donations I am happier to give
  - DavideNL 5y ago
    Agreed. Am a supporter too, as a matter of fact it's the only recurring donation payment i have...
zxienin 5y ago
The title sounds to a general impact ("..Paves the Way to EU-Based Cloud Services"). But on closer read, it seems to partially apply to SaaS/PaaS cloud services, which hold data outside EU. Google also provides IaaS/PaaS cloud offering based within EU as well [0]. [0]: https://cloud.google.com/about/locations#europe https://cloud.google.com/about/locations#europe
- Kbelicius 5y ago
  Considering that this ruling is based on schrems II case which concluded that FISA 702 and EO 12.333 are not compatible with GDPR it would seem that holding data within the EU is not a solution since FISA 702 and EO 12.333 are applicable to data held anywhere in the world by a US company.
  - cdrx 5y ago
    That is my understanding too. The issue is as much about jurisdiction as the physical location of the hard drive that holds data.
  - zxienin 5y ago
    Am not legally savvy on this to be educated on merits of what cited FISA/EO mean. I am curious as to what argument can find it acceptable to block US company, also when they place data within EU and can’t be compelled to handover to US law enforcement.
    - nisegami 5y ago
      >can’t be compelled to handover to US law enforcement Even if a US company holds their data in the EU, due to FISA 702, the CLOUD act and EO 12.333, they can still be compelled to hand over that data. So being a US company is a dealbreaker, regardless of where the data is stored.
      - zxienin 5y ago
        What if google uses EU based legal company? https://cloud.google.com/terms/google-entity https://cloud.google.com/terms/google-entity
iqanq 5y ago
All of this is similar to what China did back in the day. It helped foster an ecosystem for their own services, but of course they were (and are) of a lower quality.
- litgab 5y ago
  true, but to be fair: seems like it worked out pretty well for china...
  - iqanq 5y ago
    It worked out pretty well for politicians and those who work in the tech sector. Worked out terribly for the rest of citizens.
    - trasz 5y ago
      [citation needed]
- Kbelicius 5y ago
  > All of this is similar to what China did back in the day. In what way is it similar, I'm not seeing it? When did China introduce something like GDPR and how did it help foster an ecosystem of their own services?
  - iqanq 5y ago
    At first, western services were banned using laws similar to what some countries in the EU have (like how some tweets are unavailable in some European countries for disputing the holocaust, etc). Also: https://www.euronews.com/2022/01/26/germany-considers-banning-telegram-app-accused-of-facilitating-hate-speech https://www.euronews.com/2022/01/26/germany-considers-bannin... Now they have pushed something very similar to the GDPR. More info about these two things here: https://en.wikipedia.org/wiki/Internet_censorship_in_China#Legislative_basis https://en.wikipedia.org/wiki/Internet_censorship_in_China#L...
hestefisk 5y ago
Nice job. Now if EU could just export this to the rest of the world … that would be fantastic!
olivierduval 5y ago
Actually, there's an "easy" way out for Google & Co: set up a EU subsidiary and allow them to run autonomously. Il will be subject ONLY to EU laws, on EU servers... but with US technology... and money (ONLY and not datas) will flow back to the US ! As a side effect: Google.EU will be able to use the "full" power allowed by GDPR (european data & world data) as Google.WORLD will "only" be able to use world data excluding EU. But maybe Google.EU will be able to export "consolidated" (so anonymized) datas back to the US ? Same would be applicable for Apple, Amazon, MS & Co...
- kazen44 5y ago
  this would not work, as it would still fall under the FISA jurisdiction according to US law.
- BjoernKW 5y ago
  No, that wouldn't work either because that EU subsidiary would still be controlled by its US-based parent company.
viraptor 5y ago
The part in most curious about is not even the usual web services we talk about here, but who will be the new big pipe provider in the EU. Who can compete with CloudFlare / Fastly / Akamai / Maxcdn with the raw bandwidth of DDoS that they can sink in their network. Anyone apart from Gcore labs?
- Deukhoofd 5y ago
  OVH?
- zinekeller 5y ago
  I am not really sure, but I can at least list those that has a good chance (assuming that they weren't beaten over by a startup): European ISPs with Tier-1 capabilities: Sweden's Arelion (prev. Telia Carrier), Telecom Italia's Sparkle, T-Systems (part of Deustche Telekom), France's Orange, and the business and carrier division of Telefonica. Webhosting with demonstrated capabilities are another one: I can only name OVH to be frank. Iliad (dba Scaleway) has good European connections but not global, and Hetzner while a capable hoster is not that invested outside of Germany.
  - viraptor 5y ago
    It would be interesting if the ISPs got into this game. Although it doesn't look like they're interested so far - at least not in the non-big-government-contract way. US telcos didn't get involved either at consumer CDN level. Hetzner has only a handful of locations - they'd have to massively scale up to be a viable CDN and add all the needed tech.
    - zinekeller 5y ago
      T-Systems did dab on a, uhm, complicated partnership (legally-speaking, it was otherwise a boring one) with Microsoft (https://docs.microsoft.com/en-us/azure/germany/germany-welcome https://docs.microsoft.com/en-us/azure/germany/germany-welco...).
  - welterde 5y ago
the-dude 5y ago
I have read here on HN a comment which said the following : US companies will still be at an advantage as they can still mine their other customers and use this knowledge for their EU operations as well. EU based companies will not be allowed to mine US customers the same way.
- IgorPartola 5y ago
  Perhaps a business that doesn’t mine it’s customers data can find an advantage in that restriction. Plenty of successful businesses are built around the idea that you don’t need to sell out.
  - the-dude 5y ago
    Plenty? Or a handful?
    - IgorPartola 5y ago
      Every restaurant, every taxi, every plumber you have ever interacted with did not make their money by selling your personal information. They did it by providing value in exchange for a fee. Google and Facebook are the exception to the rule. Sure in the category of free and very popular social networks and search engines this may be the norm, but that category consists of less than a dozen companies.
      - the-dude 5y ago
        > Every restaurant, every taxi, every plumber Sure, except they don't find an advantage in the restriction. They are not cloudy. A dark kitchen OTOH ...
        IgorPartola 5y ago
        Proton Mail, GitLab, Pivotal Tracker, Dropbox, Square, ecobee, DuckDuckGo. All found ways to make money without selling your personal data.
Puts 5y ago
Whenever a company tries to sell you their GDPR compliance by stating data is "encrypted at rest" you should call bullshit. If the data is stored on servers that are online the data will never be at rest (until the day the servers are discarded) making this protective measure useless in the context of Schrems II. The EDPB Guidelines from November 2020 says: "where unencrypted personal data is technically necessary for the provision of the service by the processor, transport encryption and data-at-rest encryption even taken together, do not constitute a supplementary measure that ensures an essentially equivalent level of protection if the data importer is in possession of the cryptographic keys" https://edpb.europa.eu/sites/default/files/consultation/edpb_recommendations_202001_supplementarymeasurestransferstools_en.pdf https://edpb.europa.eu/sites/default/files/consultation/edpb...
- mschuster91 5y ago
  > Whenever a company tries to sell you their GDPR compliance by stating data is "encrypted at rest" you should call bullshit. "Encryption at rest" is part of any sensible GDPR compliance concept; the threat that is being defended against is theft or seizure of servers and in the case of portables like laptops and USB sticks also loss of them - without the keys or password, the data is useless.
larsnystrom 5y ago
So how does this apply to Gmail? If somebody sends an email to me, and I'm using Google Workspace, could they argue I'm sharing their personal information with Google then?
- Puts 5y ago
  Yes. If you have a Business plan for Workspace you can choose your data region to be in Europe (this is still not water tight but probably the best you can do if you want to use Google Workspace).
- floatingatoll 5y ago
  Yes, they could theoretically file a GDPR complaint. It is not certain that the courts would judge it a violation, but it’s quite likely, since their data is resting in servers owned (subsidiary-to) a US business.
thisisnotatest1 5y ago
- closewith 5y ago
  > It's amazing the amount of vitriol of some europeans (usually french and german) towards United States. Are you confusing holding US corporations to local standards with vitriol? > Regarding regulation, Google will just lock the data in the EU and keep doing business as usual. Isn't that the desired outcome?
- owlmirror 5y ago
  What do you mean with vitriol? The handling of personal data by the United States government is just an unsolved problem that has to be dealt with. How is Google going to lock the data in the EU, in a way that it can't be grabbed by the unbound US surveillance apparatus?
  - nickpp 5y ago
    I am much more afraid of my data being grabbed by EU / my government surveillance apparatus.
    - owlmirror 5y ago
      Can't you be worried about both? In the EU you at least theoretically have legal recourse. But these issues go hand in hand, as surveillance data sharing programs like Five Eyes have shown.
      - thisisnotatest1 5y ago
        Politicians: The kings of deception, the GOATs at breaking the terms and conditions
- zoobab 5y ago
  "Google will just lock the data in the EU and keep doing business as usual." Personal data of EU citizens cannot be processed by american companies, full stop.
BjoernKW 5y ago
I keep hearing that claim, yet it is never backed up by any substantive evidence or actionable advice as to which of these apparently abundant exclusively EU-based services to use for solving a particular problem. Well, other than the usual Fathom and Plausible, that is. It might come as a surprise to some, but the web and software in general isn't just comprised of analytics. Just to try and prove myself wrong I searched for a GDPR-compliant EU-based video conferencing tool on that "developed in Europe" site linked to in the article. The only result I got was "api.video - Video APIs for building, scaling and operating on-demand and live streaming videos". So, because of GDPR I'm now supposed to code and run my own video conferencing service?
- Deukhoofd 5y ago
  Livestorm.co - Paris Wonder.me - Berlin whereby.com - Oslo (technically not EU, but close enough) That site is just lacking.
  - Khalem 5y ago
    Adding pexip.com to that list as well
- tremon 5y ago
  If FOSDEM, a pretty large but fully volunteer-run organization can host their own videos, why can't you?
  - BjoernKW 5y ago
    First, I'm not a large organization and I don't have volunteers who do my work for me for free. Secondly, hosting videos is not my core business. The shop around the corner doesn't run its own payment system either, after all. Finally, I don't need to host videos, I need a video conferencing software, which is something entirely different.
pessimizer 5y ago
Services in the EU with stricter ethical and privacy standards could pick up US business. I'd rather use almost anyone but google for everything, privately or professionally.
redm 5y ago
This could go a few ways. First, I'm sure Google will fight this and the fight will go on for some time. If they loose, Google could build EU data-centers and try to be GDPR compliant, which seems the most likely outcome. They could also pull out of the market, which seems less likely. If they pull out, I'm not sure that would be good for the EU market. People are suggesting that EU entities will spring up to fill the void, and thats probably true, but those services will almost certainly lag the benefits of the big US clouds. That may put EU entities at a competitive disadvantage.
- KptMarchewa 5y ago
  >Google could build EU data-centers and try to be GDPR compliant That doesn't matter, since US CLOUD Act allows US law enforcement to subpoena data even if they are stored in the EU. The only "way out" is to use cloud providers that have no presence in US.
  - malermeister 5y ago
    Basically create a new, completely independent EU entity.
    - KptMarchewa 5y ago
      Then what would Google gain from it? The whole point of subsidiaries is that they are not independent and push profits up to mother company.
      - malermeister 5y ago
        You could most likely set it up so the EU entity pays "licensing fees" or similar to the US entity without any formal ownership or control.
shafyy 5y ago
Does this also mean that e.g. EU business are not allowed to use Stripe or PayPal, since those are owned by US companies? Or, that it's not good enough anymore to use a EU hosting for Mixpanel or AWS or DigitalOcean?
- nostrebored 5y ago
  Austrian businesses I think, but yes
- floatingatoll 5y ago
  If you, a GDPR-bound business, are silently serving, embedding, or otherwise using resources served by US businesses without explicit opt-in approval, then you absolutely could be violating GDPR, specifically for example if the user’s IP becomes known to the US-operated resources. This would theoretically apply whether using AWS hosting (even in EU availability zones), Stripe or PayPal cart checkouts, or any other platform owned and/or operated by a US business or its subsidiaries. It isn’t relevant where those US-owned data or servers are hosted. This unfortunate situation could be corrected by the US signing a new treaty or other law that ensures that the US governments, law enforcement, and courts cannot compel US business to violate GDPR. (I am not your lawyer, this is not legal advice.)
  - shafyy 5y ago
    Thanks for explaining - that's how I also understood it, just wanted to make sure I didn't miss anything.
xg15 5y ago
Out of couriosity: Does the CLOUD act, FISA and whatever else also cover offshore subsidiaries? E.g. would a german Google GmbH still be subject to the CLOUD act if that legal entity has no relationship with the US? On the one hand, I can't imagine US surveillance leaving open such a glaring hole, on the other hand I wonder what basis US law could apply to companies of non-US countries.
- floatingatoll 5y ago
  In your scenario, is the theoretical Google GmbH a subsidiary of a US corporation?
  - xg15 5y ago
    I don't know much about the legal details, but I imagine it would have to be. After all, the purpose of the company would be to offer Google services in Germany - so I imagine, it would either be a subsidiary or a de-facto shell company. Good point though, that sort of answers my question already.
runako 5y ago
The website of the German federal tax office is not GDPR-compliant: https://twitter.com/jdvhouten/status/1488481039630704644 https://twitter.com/jdvhouten/status/1488481039630704644 Seems premature to sanction private businesses when EU governments have not yet been able to come fully into compliance. Perhaps the changeover is more difficult than anticipated? As others allude below, it might make sense for the relevant EU-based alternatives to come online/scale up.
- ChuckNorris89 5y ago
  >The website of the German federal tax office is not GDPR-compliant: The German government is, in general, a joke when it comes to websites and doing things online instead of fax/mail/paper.
- floatingatoll 5y ago
  That’s not how the GDPR is written. It may seem premature, but someone has to be first to be ruled against in order for the interpretation to come into being, same as the Supreme Court and any other interpretive judicial systems. That the private fine is essentially a token throwaway amount reflects that the court isn’t trying to throw the book at them; one can imagine the court will be much more upset about the government instance you highlight if it remains unaddressed.
zxienin 5y ago
Can it be explained, why “data is encrypted at rest using your own key” isn’t acceptable to regulator? Google might be compelled to hand data over, but data is encrypted and useless.
- pfg 5y ago
  There's no mention of encryption at rest using your own key. To quote the ruling: > If the second respondent (Google) subsequently refers to encryption technologies - such as the encryption of "data at rest" in the data centers - he must again be countered with recommendations 01/2020 of the EDSA. Namely, it states that a data importer (such as the Second Respondent) who is subject to 50 US Code § 1881a (“FISA 702”) has a direct obligation with regard to the imported data that is in his possession, custody or control to grant access to or release them. This obligation can expressly also apply to the cryptographic key without which the data cannot be read (ibid. margin no. 76). > As long as the second respondent has the opportunity to access data in the Plain text access, the technical measures taken cannot be regarded as effective in the sense of the above considerations. The last paragraph suggests true end-to-end encryption may be acceptable, but that's not how Google Analytics works.
  - zxienin 5y ago
    > but that's not how Google Analytics works Yes. I made the question, given the discussion is being treated as much wider, beyond GA. This also tells me, using own key can still be used by Google to operate as is (US company with EU owned entity and EU located DC)
- floatingatoll 5y ago
  As long as you proxy^ all requests to Google for that data through your own servers, and do not include X-Forwarded-For: <gdpr-protected-client-ip> or any other identifying details in the request you transmit to Google on their behalf, and your crypto implementation is deemed sound, then that would likely be found not to be a GDPR violation. This runs counter to the tendency of websites to offload the burden of "go fetch and evaluate XYZ" to the useragent, and requires a server under your control that is not under US jurisdiction^^ to host or proxy all internet traffic of any kind necessary to deliver the service. (I am not your lawyer, this is not legal advice.) ^ some services may ban you for proxying in this manner without a contract ^^ proxy must not be hosted by or operated within AWS, GCP, Heroku, or any other US-controlled services provider
floatingatoll 5y ago
If Google restructured into a franchise model, where each franchisee independently operates Google XY per country XY, then that would legally allow each Google XY to comply with GDPR while paying Google US a franchise fee. Technically, however, this is a nightmare to implement, since each Google XY would have a due diligence responsibility to audit all source code changes, and Google US would be required to issue a complete working set of product code to each independent franchisee, as otherwise they're just subsidiaries from a code standpoint, which when interpreted by a court would likely be found equivalent to being a full subsidiary rather than just a franchisee (as Google US would then retain the ability to collect GDPR-protected data in violation of GDPR).

138 points by endofreach 5y ago

taubek 5y ago

What would happen if Google would decide to host all of EU related data in EU? They would be 100% compliant?

john61 5y ago
No, because Google hast to comply with US law and has to transfer data to US officials.
- dbbk 5y ago
  Not if it's run through a European subsidiary surely
  - ToruiDev 5y ago
    They still do since they're a subsidiary/related. Microsoft tried to get around that by not hosting in the EU but having a european trustee do it for them. That got us the CLOUD act
  - floatingatoll 5y ago
    The rulings this past week specifically contradict this. Subsidiaries of US corporations are subject to illegal-under-GDPR data collection requests by US authorities, just as much as any other US corporation, as the subsidiary has no legal protections under US law from GDPR-illegal requests by its parent.
Deukhoofd 5y ago
It'd only be compliant if they would then also not allow US intelligence agencies to access the data at will. That would however break US law, specifically section 702 of the Foreign Intelligence Surveillance Act
deleted 5y ago
[deleted]

radicalbyte 5y ago

This is an excellent decision from the Austrian DPA: there is no good argument for exfiltrating data to a country with low-to-non-existent data-protection standards. It would be nice if the same logic applied to manufacturing and environmental legislation - it stops the race to the bottom.

nix23 5y ago
Also cloud-act, not the best idea to open up your crown-jewels to every single US-Secret-service....by default ;)
belter 5y ago
Will make no difference for what really matters... "BND helped NSA to spy on Austria, EU partners: report" https://www.aa.com.tr/en/world/bnd-helped-nsa-to-spy-on-austria-eu-partners-report/51623 https://www.aa.com.tr/en/world/bnd-helped-nsa-to-spy-on-aust... "Alleged NSA post in Austria becomes state affair" https://apnews.com/a3537677459e41b9ba4d21d8208dd28a https://apnews.com/a3537677459e41b9ba4d21d8208dd28a "UK, Dutch spy agencies curb intel flow to Austria over Russia ties: MP" https://www.reuters.com/article/us-austria-security-idUSKCN1RL2CM https://www.reuters.com/article/us-austria-security-idUSKCN1... "Vienna Is the New Havana Syndrome Hot Spot" https://www.newyorker.com/news/news-desk/vienna-is-the-new-havana-syndrome-hotspot https://www.newyorker.com/news/news-desk/vienna-is-the-new-h...
- Puts 5y ago
  At least it seems like the head of the Danish intelligence services is actually facing charges for helping the NSA spy on Swedish politicians: https://www.dw.com/en/danish-spy-chief-detained-over-highly-sensitive-leak/a-60379168 https://www.dw.com/en/danish-spy-chief-detained-over-highly-... But I think this more then anything shows why the US should not be regarded a country with adequate level of data protection. I would honestly just assume that they force Google to record every single meeting between heads of states or meetings with companies that work in telecom or weapon systems. Even the most boring meeting with officials in some small municipality can probably be valuable information about infrastructure and how it's going to be protected and these are maybe the most unsuspecting because they think "why would anybody care about the water distribution in our small city".

sirwitti 5y ago

This is already affecting websites and web apps. At least all of our customers are moving away from Google Analytics and many try to also get rid of other Google services like fonts and maps. I'm very interested to see what this changes in other european countries.

mrweasel 5y ago
We can't sell AWS consulting services to anyone right now, haven't been able to for over a year, almost two I think. Non of our clients trust Amazon right now. The claims from AWS is that it's fine to host EU data in AWS, but very few companies are willing to risk that.
- WrtCdEvrydy 5y ago
  I mean, they have EU datacenters... the issue with Google Analytics is that this data can be moved through other datacenters. This was one of the ways the NSA programs worked... just tap the google lines which were unencrypted and slurp the data as it moved from datacenter to datacenter.
  - BjoernKW 5y ago
    > I mean, they have EU datacenters That doesn't matter anymore. According to the relatively recent ECJ ruling mentioned in the article you're not allowed to transfer any PII to companies that are in any way affiliated with a US-based entity (e.g., by virtue of having a US-based parent company), which clearly is the case for Amazon and AWS. It doesn't stop there. According to some privacy experts, even a third party just having a US-based supplier might be construed as a customer of that third party being in violation of GDPR, at which point we'd basically have to cease all economic activity.
    - jtbayly 5y ago
      Go GDPR for the win! I like the goal of privacy, but I won't be sad to see the ridiculous GDPR law implode.

wbl 5y ago

EU based cloud services always could compete before. Now they will compete on the basis of being in the EU instead of being better.

DaiPlusPlus 5y ago
Nah, what happens is the US-based companies will just geo-wall the data and throw more money at their EU-based AWS and Azure regions.
- rini17 5y ago
  To me it reads as only walling the data off is insufficient. They will have to incorporate in Europe or in jurisdiction without FISA-like laws and completely split whole operation there.
  - 7steps2much 5y ago
    I believe that it would come down to this as well. The problem is both them being located in the US AND being a US company. Alternatively they could mirror an approach that Microsoft had with ther Office Online for a while, that is find a European company acting as "trustee" for the data, so that even if the NSA came knocking the US based company would not have any data on any of their infrastructure it could give them.
    - spaniard89277 5y ago
      But this is only viable for very large companies.
      - slig 5y ago
        One might think that all these extra regulations benefits only the giants and curbs any newcomers.
        5y ago

ReleaseCandidat 5y ago

That's again based on the work of Noyb and Max Schrems: In July 2020, the CJEU has issued its groundbreaking "Schrems II" ruling, holding that a transfer to US providers that fall under FISA 702 and EO 12.333 violate the rules on international data transfers in the GDPR. The CJEU consequently annulled the transfer deal "Privacy Shield", after annulling the previous deal "Safe Harbor" in 2015. While this sent shock waves through the tech industry, US providers and EU data exporters have largely ignored the case. Just like Microsoft, Facebook or Amazon, Google has relied on so-called "Standard Contract Clauses" to continue data transfers and calm its European business partners. Max Schrems, honorary chair of noyb.eu: "Instead of actually adapting services to be GDPR compliant, US companies have tried to simply add some text to their privacy policies and ignore the Court of Justice. Many EU companies have followed the lead instead of switching to legal options." https://noyb.eu/en/austrian-dsb-eu-us-data-transfers-google-analytics-illegal https://noyb.eu/en/austrian-dsb-eu-us-data-transfers-google-... https://noyb.eu/en/101-complaints-eu-us-transfers-filed https://noyb.eu/en/101-complaints-eu-us-transfers-filed https://noyb.eu/en/update-noybs-101-complaints-eu-us-data-transfers https://noyb.eu/en/update-noybs-101-complaints-eu-us-data-tr...

jacquesm 5y ago

If there is ever going to be an EU version of a GoFundMe for a statue for Schrems I'm in. It's one thing to have good privacy laws, it's quite another to get them enforced. As public service comes this a fantastic job for all of us.

rpadovani 5y ago
You should support Noyb then, the no-profit he works for! https://noyb.eu/en https://noyb.eu/en I am not affiliated, but I am a massive supporter of them and is one of the donations I am happier to give
- DavideNL 5y ago
  Agreed. Am a supporter too, as a matter of fact it's the only recurring donation payment i have...

zxienin 5y ago

The title sounds to a general impact ("..Paves the Way to EU-Based Cloud Services"). But on closer read, it seems to partially apply to SaaS/PaaS cloud services, which hold data outside EU. Google also provides IaaS/PaaS cloud offering based within EU as well [0]. [0]: https://cloud.google.com/about/locations#europe https://cloud.google.com/about/locations#europe

Kbelicius 5y ago
Considering that this ruling is based on schrems II case which concluded that FISA 702 and EO 12.333 are not compatible with GDPR it would seem that holding data within the EU is not a solution since FISA 702 and EO 12.333 are applicable to data held anywhere in the world by a US company.
- cdrx 5y ago
  That is my understanding too. The issue is as much about jurisdiction as the physical location of the hard drive that holds data.
- zxienin 5y ago
  Am not legally savvy on this to be educated on merits of what cited FISA/EO mean. I am curious as to what argument can find it acceptable to block US company, also when they place data within EU and can’t be compelled to handover to US law enforcement.
  - nisegami 5y ago
    >can’t be compelled to handover to US law enforcement Even if a US company holds their data in the EU, due to FISA 702, the CLOUD act and EO 12.333, they can still be compelled to hand over that data. So being a US company is a dealbreaker, regardless of where the data is stored.
    - zxienin 5y ago
      What if google uses EU based legal company? https://cloud.google.com/terms/google-entity https://cloud.google.com/terms/google-entity

iqanq 5y ago

All of this is similar to what China did back in the day. It helped foster an ecosystem for their own services, but of course they were (and are) of a lower quality.

litgab 5y ago
true, but to be fair: seems like it worked out pretty well for china...
- iqanq 5y ago
  It worked out pretty well for politicians and those who work in the tech sector. Worked out terribly for the rest of citizens.
  - trasz 5y ago
    [citation needed]
Kbelicius 5y ago
> All of this is similar to what China did back in the day. In what way is it similar, I'm not seeing it? When did China introduce something like GDPR and how did it help foster an ecosystem of their own services?
- iqanq 5y ago
  At first, western services were banned using laws similar to what some countries in the EU have (like how some tweets are unavailable in some European countries for disputing the holocaust, etc). Also: https://www.euronews.com/2022/01/26/germany-considers-banning-telegram-app-accused-of-facilitating-hate-speech https://www.euronews.com/2022/01/26/germany-considers-bannin... Now they have pushed something very similar to the GDPR. More info about these two things here: https://en.wikipedia.org/wiki/Internet_censorship_in_China#Legislative_basis https://en.wikipedia.org/wiki/Internet_censorship_in_China#L...

hestefisk 5y ago

Nice job. Now if EU could just export this to the rest of the world … that would be fantastic!

olivierduval 5y ago

Actually, there's an "easy" way out for Google & Co: set up a EU subsidiary and allow them to run autonomously. Il will be subject ONLY to EU laws, on EU servers... but with US technology... and money (ONLY and not datas) will flow back to the US ! As a side effect: Google.EU will be able to use the "full" power allowed by GDPR (european data & world data) as Google.WORLD will "only" be able to use world data excluding EU. But maybe Google.EU will be able to export "consolidated" (so anonymized) datas back to the US ? Same would be applicable for Apple, Amazon, MS & Co...

kazen44 5y ago
this would not work, as it would still fall under the FISA jurisdiction according to US law.
BjoernKW 5y ago
No, that wouldn't work either because that EU subsidiary would still be controlled by its US-based parent company.

viraptor 5y ago

The part in most curious about is not even the usual web services we talk about here, but who will be the new big pipe provider in the EU. Who can compete with CloudFlare / Fastly / Akamai / Maxcdn with the raw bandwidth of DDoS that they can sink in their network. Anyone apart from Gcore labs?

Deukhoofd 5y ago
OVH?
zinekeller 5y ago
I am not really sure, but I can at least list those that has a good chance (assuming that they weren't beaten over by a startup): European ISPs with Tier-1 capabilities: Sweden's Arelion (prev. Telia Carrier), Telecom Italia's Sparkle, T-Systems (part of Deustche Telekom), France's Orange, and the business and carrier division of Telefonica. Webhosting with demonstrated capabilities are another one: I can only name OVH to be frank. Iliad (dba Scaleway) has good European connections but not global, and Hetzner while a capable hoster is not that invested outside of Germany.
- viraptor 5y ago
  It would be interesting if the ISPs got into this game. Although it doesn't look like they're interested so far - at least not in the non-big-government-contract way. US telcos didn't get involved either at consumer CDN level. Hetzner has only a handful of locations - they'd have to massively scale up to be a viable CDN and add all the needed tech.
  - zinekeller 5y ago
    T-Systems did dab on a, uhm, complicated partnership (legally-speaking, it was otherwise a boring one) with Microsoft (https://docs.microsoft.com/en-us/azure/germany/germany-welcome https://docs.microsoft.com/en-us/azure/germany/germany-welco...).
- welterde 5y ago

the-dude 5y ago

I have read here on HN a comment which said the following : US companies will still be at an advantage as they can still mine their other customers and use this knowledge for their EU operations as well. EU based companies will not be allowed to mine US customers the same way.

IgorPartola 5y ago
Perhaps a business that doesn’t mine it’s customers data can find an advantage in that restriction. Plenty of successful businesses are built around the idea that you don’t need to sell out.
- the-dude 5y ago
  Plenty? Or a handful?
  - IgorPartola 5y ago
    Every restaurant, every taxi, every plumber you have ever interacted with did not make their money by selling your personal information. They did it by providing value in exchange for a fee. Google and Facebook are the exception to the rule. Sure in the category of free and very popular social networks and search engines this may be the norm, but that category consists of less than a dozen companies.
    - the-dude 5y ago
      > Every restaurant, every taxi, every plumber Sure, except they don't find an advantage in the restriction. They are not cloudy. A dark kitchen OTOH ...
      - IgorPartola 5y ago
        Proton Mail, GitLab, Pivotal Tracker, Dropbox, Square, ecobee, DuckDuckGo. All found ways to make money without selling your personal data.

Puts 5y ago

Whenever a company tries to sell you their GDPR compliance by stating data is "encrypted at rest" you should call bullshit. If the data is stored on servers that are online the data will never be at rest (until the day the servers are discarded) making this protective measure useless in the context of Schrems II. The EDPB Guidelines from November 2020 says: "where unencrypted personal data is technically necessary for the provision of the service by the processor, transport encryption and data-at-rest encryption even taken together, do not constitute a supplementary measure that ensures an essentially equivalent level of protection if the data importer is in possession of the cryptographic keys" https://edpb.europa.eu/sites/default/files/consultation/edpb_recommendations_202001_supplementarymeasurestransferstools_en.pdf https://edpb.europa.eu/sites/default/files/consultation/edpb...

mschuster91 5y ago
> Whenever a company tries to sell you their GDPR compliance by stating data is "encrypted at rest" you should call bullshit. "Encryption at rest" is part of any sensible GDPR compliance concept; the threat that is being defended against is theft or seizure of servers and in the case of portables like laptops and USB sticks also loss of them - without the keys or password, the data is useless.

larsnystrom 5y ago

So how does this apply to Gmail? If somebody sends an email to me, and I'm using Google Workspace, could they argue I'm sharing their personal information with Google then?

Puts 5y ago
Yes. If you have a Business plan for Workspace you can choose your data region to be in Europe (this is still not water tight but probably the best you can do if you want to use Google Workspace).
floatingatoll 5y ago
Yes, they could theoretically file a GDPR complaint. It is not certain that the courts would judge it a violation, but it’s quite likely, since their data is resting in servers owned (subsidiary-to) a US business.

thisisnotatest1 5y ago

closewith 5y ago
> It's amazing the amount of vitriol of some europeans (usually french and german) towards United States. Are you confusing holding US corporations to local standards with vitriol? > Regarding regulation, Google will just lock the data in the EU and keep doing business as usual. Isn't that the desired outcome?
owlmirror 5y ago
What do you mean with vitriol? The handling of personal data by the United States government is just an unsolved problem that has to be dealt with. How is Google going to lock the data in the EU, in a way that it can't be grabbed by the unbound US surveillance apparatus?
- nickpp 5y ago
  I am much more afraid of my data being grabbed by EU / my government surveillance apparatus.
  - owlmirror 5y ago
    Can't you be worried about both? In the EU you at least theoretically have legal recourse. But these issues go hand in hand, as surveillance data sharing programs like Five Eyes have shown.
    - thisisnotatest1 5y ago
      Politicians: The kings of deception, the GOATs at breaking the terms and conditions
zoobab 5y ago
"Google will just lock the data in the EU and keep doing business as usual." Personal data of EU citizens cannot be processed by american companies, full stop.

BjoernKW 5y ago

I keep hearing that claim, yet it is never backed up by any substantive evidence or actionable advice as to which of these apparently abundant exclusively EU-based services to use for solving a particular problem. Well, other than the usual Fathom and Plausible, that is. It might come as a surprise to some, but the web and software in general isn't just comprised of analytics. Just to try and prove myself wrong I searched for a GDPR-compliant EU-based video conferencing tool on that "developed in Europe" site linked to in the article. The only result I got was "api.video - Video APIs for building, scaling and operating on-demand and live streaming videos". So, because of GDPR I'm now supposed to code and run my own video conferencing service?

Deukhoofd 5y ago
Livestorm.co - Paris Wonder.me - Berlin whereby.com - Oslo (technically not EU, but close enough) That site is just lacking.
- Khalem 5y ago
  Adding pexip.com to that list as well
tremon 5y ago
If FOSDEM, a pretty large but fully volunteer-run organization can host their own videos, why can't you?
- BjoernKW 5y ago
  First, I'm not a large organization and I don't have volunteers who do my work for me for free. Secondly, hosting videos is not my core business. The shop around the corner doesn't run its own payment system either, after all. Finally, I don't need to host videos, I need a video conferencing software, which is something entirely different.

pessimizer 5y ago

Services in the EU with stricter ethical and privacy standards could pick up US business. I'd rather use almost anyone but google for everything, privately or professionally.

redm 5y ago

This could go a few ways. First, I'm sure Google will fight this and the fight will go on for some time. If they loose, Google could build EU data-centers and try to be GDPR compliant, which seems the most likely outcome. They could also pull out of the market, which seems less likely. If they pull out, I'm not sure that would be good for the EU market. People are suggesting that EU entities will spring up to fill the void, and thats probably true, but those services will almost certainly lag the benefits of the big US clouds. That may put EU entities at a competitive disadvantage.

KptMarchewa 5y ago
>Google could build EU data-centers and try to be GDPR compliant That doesn't matter, since US CLOUD Act allows US law enforcement to subpoena data even if they are stored in the EU. The only "way out" is to use cloud providers that have no presence in US.
- malermeister 5y ago
  Basically create a new, completely independent EU entity.
  - KptMarchewa 5y ago
    Then what would Google gain from it? The whole point of subsidiaries is that they are not independent and push profits up to mother company.
    - malermeister 5y ago
      You could most likely set it up so the EU entity pays "licensing fees" or similar to the US entity without any formal ownership or control.

shafyy 5y ago

Does this also mean that e.g. EU business are not allowed to use Stripe or PayPal, since those are owned by US companies? Or, that it's not good enough anymore to use a EU hosting for Mixpanel or AWS or DigitalOcean?

nostrebored 5y ago
Austrian businesses I think, but yes
floatingatoll 5y ago
If you, a GDPR-bound business, are silently serving, embedding, or otherwise using resources served by US businesses without explicit opt-in approval, then you absolutely could be violating GDPR, specifically for example if the user’s IP becomes known to the US-operated resources. This would theoretically apply whether using AWS hosting (even in EU availability zones), Stripe or PayPal cart checkouts, or any other platform owned and/or operated by a US business or its subsidiaries. It isn’t relevant where those US-owned data or servers are hosted. This unfortunate situation could be corrected by the US signing a new treaty or other law that ensures that the US governments, law enforcement, and courts cannot compel US business to violate GDPR. (I am not your lawyer, this is not legal advice.)
- shafyy 5y ago
  Thanks for explaining - that's how I also understood it, just wanted to make sure I didn't miss anything.

xg15 5y ago

Out of couriosity: Does the CLOUD act, FISA and whatever else also cover offshore subsidiaries? E.g. would a german Google GmbH still be subject to the CLOUD act if that legal entity has no relationship with the US? On the one hand, I can't imagine US surveillance leaving open such a glaring hole, on the other hand I wonder what basis US law could apply to companies of non-US countries.

floatingatoll 5y ago
In your scenario, is the theoretical Google GmbH a subsidiary of a US corporation?
- xg15 5y ago
  I don't know much about the legal details, but I imagine it would have to be. After all, the purpose of the company would be to offer Google services in Germany - so I imagine, it would either be a subsidiary or a de-facto shell company. Good point though, that sort of answers my question already.

runako 5y ago

The website of the German federal tax office is not GDPR-compliant: https://twitter.com/jdvhouten/status/1488481039630704644 https://twitter.com/jdvhouten/status/1488481039630704644 Seems premature to sanction private businesses when EU governments have not yet been able to come fully into compliance. Perhaps the changeover is more difficult than anticipated? As others allude below, it might make sense for the relevant EU-based alternatives to come online/scale up.

ChuckNorris89 5y ago
>The website of the German federal tax office is not GDPR-compliant: The German government is, in general, a joke when it comes to websites and doing things online instead of fax/mail/paper.
floatingatoll 5y ago
That’s not how the GDPR is written. It may seem premature, but someone has to be first to be ruled against in order for the interpretation to come into being, same as the Supreme Court and any other interpretive judicial systems. That the private fine is essentially a token throwaway amount reflects that the court isn’t trying to throw the book at them; one can imagine the court will be much more upset about the government instance you highlight if it remains unaddressed.

zxienin 5y ago

Can it be explained, why “data is encrypted at rest using your own key” isn’t acceptable to regulator? Google might be compelled to hand data over, but data is encrypted and useless.

pfg 5y ago
There's no mention of encryption at rest using your own key. To quote the ruling: > If the second respondent (Google) subsequently refers to encryption technologies - such as the encryption of "data at rest" in the data centers - he must again be countered with recommendations 01/2020 of the EDSA. Namely, it states that a data importer (such as the Second Respondent) who is subject to 50 US Code § 1881a (“FISA 702”) has a direct obligation with regard to the imported data that is in his possession, custody or control to grant access to or release them. This obligation can expressly also apply to the cryptographic key without which the data cannot be read (ibid. margin no. 76). > As long as the second respondent has the opportunity to access data in the Plain text access, the technical measures taken cannot be regarded as effective in the sense of the above considerations. The last paragraph suggests true end-to-end encryption may be acceptable, but that's not how Google Analytics works.
- zxienin 5y ago
  > but that's not how Google Analytics works Yes. I made the question, given the discussion is being treated as much wider, beyond GA. This also tells me, using own key can still be used by Google to operate as is (US company with EU owned entity and EU located DC)
floatingatoll 5y ago
As long as you proxy^ all requests to Google for that data through your own servers, and do not include X-Forwarded-For: <gdpr-protected-client-ip> or any other identifying details in the request you transmit to Google on their behalf, and your crypto implementation is deemed sound, then that would likely be found not to be a GDPR violation. This runs counter to the tendency of websites to offload the burden of "go fetch and evaluate XYZ" to the useragent, and requires a server under your control that is not under US jurisdiction^^ to host or proxy all internet traffic of any kind necessary to deliver the service. (I am not your lawyer, this is not legal advice.) ^ some services may ban you for proxying in this manner without a contract ^^ proxy must not be hosted by or operated within AWS, GCP, Heroku, or any other US-controlled services provider

floatingatoll 5y ago

If Google restructured into a franchise model, where each franchisee independently operates Google XY per country XY, then that would legally allow each Google XY to comply with GDPR while paying Google US a franchise fee. Technically, however, this is a nightmare to implement, since each Google XY would have a due diligence responsibility to audit all source code changes, and Google US would be required to issue a complete working set of product code to each independent franchisee, as otherwise they're just subsidiaries from a code standpoint, which when interpreted by a court would likely be found equivalent to being a full subsidiary rather than just a franchisee (as Google US would then retain the ability to collect GDPR-protected data in violation of GDPR).