7 ms·

A lot of this seems to be coming due to US regulations that compel US registered companies to hand over data from subsidiaries in Europe markets if asked by US

by sfifs 5y ago

A lot of this seems to be coming due to US regulations that compel US registered companies to hand over data from subsidiaries in Europe markets if asked by US intelligence and law enforcement agencies. With these various data locality regulations, i wonder if a standard operating approach could be to split tech companies into 3 legal entities, a technology licensing company, a US registered operations company and a Europe registered operations company and hand the shares in all three companies to the current shareholders. This would insulate the Europe entity.

londons_explore 5y ago
I think a lot of the big tech companies are very reluctant to split their operations inside/outside europe. They gain big benefits by having a single pool of datacenters able to serve users from anywhere in the world. If they needed to guarantee that an EU user would always be served with a machine in the EU, I can imagine it would add at least 20% to their operating costs. They'd need more equipment both inside and outside the EU to handle failover, maintanance, etc. They'd also have more complexity slowing development down (they can no longer have small services 'mastered' in just one region). And there is substantial extra complexity in application design (what when a tweet from an EU user is retweeted by a US user, but then replied to by an EU user. Where will the text of the tweet be stored? How will deletion be handled?). For example, will HN have to have seperate databases for "comments by EU users" and "comments by US users"? And will they need a process to migrate your account from one to the other?
- KingOfCoders 5y ago
  "I think a lot of the big tech companies are very reluctant to split their operations" Yes but they are even more reluctant to lose all EU revenue.
- pmontra 5y ago
  It's not only "a machine in the EU" . It's a company in the EU totally separated from the main company in the US to be out of the reach of the US government and legal system. Maybe the EU company could license software and knowledge from the US one, to keep sending a steady flow of cash there. But it's going to have its own goals and it will want to go its way soon. A hard problem IMHO.
- toto444 5y ago
  When I hear arguments like this I always think about what it would be if we were to replace 'user data' with 'financial data'. "It would be so easy if companies could just pay their taxes in one country. Think of how much they could scale their finance department." The same applies for start ups : "book keeping is such a hassle for start ups, why impose that on them? All these financial regulations are really anti business".
- ClumsyPilot 5y ago
  "I can imagine it would add at least 20% to their operating costs." Why is everybody working on the assumption that all this data has to sit in the US? Keep it in a country with the strict-est possible privacy laws, say Switzerland, and noone would complain.
  - londons_explore 5y ago
    Plenty of US organisations couldn't use a cloud service that loudly proclaimed to store the data outside the USA.
  - jimbob45 5y ago
    Right now, the data sits where it “loses” the least amount of money (I.e. where it is most efficiently spaced). If we start arbitrarily forcing companies to move their data elsewhere, then they’ll incur serious costs without any real benefit. I’d almost rather just give a French company control over some section of the US warehouse if I’m Amazon.
  - rolisz 5y ago
    Hah, it's a myth that Switzerland is so privacy oriented. They have laws saying that the Swiss intelligence services can access all data, so it wouldn't help. And Switzerland is not part of the EU.
    - jeffbee 5y ago
      Both Swiss and German people seem completely deluded about the activities of their own governments and intelligence agencies.
      - zwaps 5y ago
        Why tho? Do you think German citizens have more privacy in Germany than in the US, where the US legislature clearly states that non US citizens have zero privacy rights whatsoever? I don't think it's delusion, I think it is literally correct.
      - 5y ago
mixedbit 5y ago
I'm not sure such split would require sub-companies to be public, they could likely be private, owned by a single publicly traded US company. Tech companies already have many subsidiaries in countries that they have offices in, for example employees in European countries are not employed by a US company, but a subsidiary which is not publicly traded.
- sfifs 5y ago
  They already have EU subsidiaries. The problem seems to be that US laws seem to be able to compel US based parent companies to hand over data from their overseas subsidiaries. If you make it a EU based public company and give control to your own shareholders, it's no longer a subsidiary and your shareholders are holding shares in a European company.
KingOfCoders 5y ago
The point is more nuanced: The problem is not the handing over (happens here too), but the fact EU citizens do not get informed this has happend and have no legal way to challenge this (especially concerning FISA/FISC). They have the opportunity to do so in the EU. Yes, this is what will happen with a setup of 3 entities, b/c FANG will not want to miss EU revenue.
- Spivak 5y ago
  Right but the solution is for there to be a treaty between the US and the EU that allows for this. Putting the burden on every foreign company to duplicate their infrastructure is stupid work to solve a human problem.
  - cuu508 5y ago
    > human problem Incompatible laws problem
  - bo1024 5y ago
    Or the US could adopt better privacy laws.
    - speed_spread 5y ago
      Mark one for another American conundrum: having so much distrust for "the man" while at the same time being completely oblivious to the amount of personal data being skimmed off their daily activities. But it's all to guarantee Freedom™ so it must be ok?
      - withinboredom 5y ago
        Much of the Constitution in the US was written by people who wanted corporations to do whatever they wanted and no government can intervene. You see a lot of this philosophy still living today in rulings and precedent.
    - Spivak 5y ago
tyfon 5y ago
The EU part cannot be owned by the US entity since the US government can compel the US mother company to have it's subsidiary hand over data. In fact this is how most of the companies operate already to cheat on taxes. The way microsoft did it for a while here in Norway was to license azure cloud stuff to a sub operator (EVRY) that is completely insulated except for the licensing agreement.
- augustl 5y ago
  Hmm, that's interesting. I suppose more cloud providers could do something like that, for the benefit of customers and GDPR? E.g. Amazon already bills me through some Norwegian entity of some kind, to get VAT done right etc. If they had servers in Norway, I suppose it would have been possible to proxy everything - not just billing - in AWS Norway through this sub operator?
  - waffleiron 5y ago
    To fall out of scope of the CLOUD act, the subsidiary needs to be independent and prevent any data access by its holding company. The holding company can in no way have "possession, custody or control", which are not well defined so that doesn't make it easier to assess if a subsidiary is out of scope. https://jnslp.com/wp-content/uploads/2020/05/Defining-the-Scope-of-Possession-Custody-or-Control.pdf https://jnslp.com/wp-content/uploads/2020/05/Defining-the-Sc...
    - judge2020 5y ago
      So is it likely the European Commission did this in an attempt to block US companies from offering internet services to the EU (or at least, internet services that handle user info)? It's pretty hard to make a profit or operate in the EU if you literally can't control that entity.
      - f-jin 5y ago
        > So is it likely the European Commission did this in an attempt to block US companies from offering internet services to the EU More like the European Commission did this in an attempt to protect European citizens from having their personal data exfiltrated against their will to the US on order of US law enforcement agencies.
bradly 5y ago
Google is already doing this in countries like China and South Korea.
ivoras 5y ago
It's not as clear cut. If someone is running a global web site and wants analytics, which of the 2 entities, or both, would he reference in HTML? Even if we're going to region-lock Europe to the European Analytics servers, analytics today often involves some computation done over the entire data set, including both US and the EU, done on the backend. Which backend would that be? The privacy aspect has become something of a "think of the children" reason for a sort of "Internet xenophobia", as well as creating huge barriers to entry for small companies which cannot comply.
- krageon 5y ago
  > barriers to entry It's easy to do things online as a company of any size, post-GDPR: Don't scrape user data. Done - no compliance required, because the law is not about you in that case.
shafyy 5y ago
Exactly, the CLOUD act is the one of the main problems here: https://en.wikipedia.org/wiki/CLOUD_Act https://en.wikipedia.org/wiki/CLOUD_Act
- lmkg 5y ago
  I've read most of the EU rulings and court cases on this topic. The CLOUD Act is basically the only US law that any of them mention or refer to. And let's be explicit here: The entire purpose of the CLOUD Act is to bypass EU data protection laws. The incident that led to the creation of this law is that Microsoft didn't hand data over to the FBI because the data was on a server in Ireland. This isn't an unintended consequence, this is what the law is supposed to do.
  - tzs 5y ago
    The point of the CLOUD Act was to say that if you are a company in the US you can't ignore an order to turn over a copy of data you control just because you happen to have stored that data with a third party storage provider that is not in the US. It doesn't matter that the third party storage provider is not under US jurisdiction because the US government isn't trying to compel the third party storage provider to do anything. They are trying to compel the US company to access its own documents that it stored with that third party, using the same mechanisms the US company normally uses when it wants to access its data. From the third party storage provider point of view there is no difference between the US company retrieving the data because it wants to do something with it itself or the US company retrieving the data because they are being compelled to by law enforcement. This is really just clarifying that the rules for electronic documents are not very different from the rules for physical documents. If I am in the US and own a document that a US court orders me to produce a copy of I'm not going to be able to get out of that by telling them that the document is in a filing cabinet in a storage unit I rent in Canada or Mexico. No, they are going to order me to either go get that document or have someone go get it for me and give it to the court. If it didn't work this way every US company that has any documents they think might get them in trouble if they are ever investigated would rent some storage space outside the US, physical space if the documents are on paper and cloud storage space if they are electronic, and store everything there. Boeing for instance would have all its information about the 737 MAX outside of the US. Tesla would have everything related to full self-driving outside the US. Everyone would keep HR records outside the US to make it harder for plaintiffs if the company is ever sued over alleged discrimination.

by sfifs 5y ago

londons_explore 5y ago

I think a lot of the big tech companies are very reluctant to split their operations inside/outside europe. They gain big benefits by having a single pool of datacenters able to serve users from anywhere in the world. If they needed to guarantee that an EU user would always be served with a machine in the EU, I can imagine it would add at least 20% to their operating costs. They'd need more equipment both inside and outside the EU to handle failover, maintanance, etc. They'd also have more complexity slowing development down (they can no longer have small services 'mastered' in just one region). And there is substantial extra complexity in application design (what when a tweet from an EU user is retweeted by a US user, but then replied to by an EU user. Where will the text of the tweet be stored? How will deletion be handled?). For example, will HN have to have seperate databases for "comments by EU users" and "comments by US users"? And will they need a process to migrate your account from one to the other?

KingOfCoders 5y ago
"I think a lot of the big tech companies are very reluctant to split their operations" Yes but they are even more reluctant to lose all EU revenue.
pmontra 5y ago
It's not only "a machine in the EU" . It's a company in the EU totally separated from the main company in the US to be out of the reach of the US government and legal system. Maybe the EU company could license software and knowledge from the US one, to keep sending a steady flow of cash there. But it's going to have its own goals and it will want to go its way soon. A hard problem IMHO.
toto444 5y ago
When I hear arguments like this I always think about what it would be if we were to replace 'user data' with 'financial data'. "It would be so easy if companies could just pay their taxes in one country. Think of how much they could scale their finance department." The same applies for start ups : "book keeping is such a hassle for start ups, why impose that on them? All these financial regulations are really anti business".
ClumsyPilot 5y ago
"I can imagine it would add at least 20% to their operating costs." Why is everybody working on the assumption that all this data has to sit in the US? Keep it in a country with the strict-est possible privacy laws, say Switzerland, and noone would complain.
- londons_explore 5y ago
  Plenty of US organisations couldn't use a cloud service that loudly proclaimed to store the data outside the USA.
- jimbob45 5y ago
  Right now, the data sits where it “loses” the least amount of money (I.e. where it is most efficiently spaced). If we start arbitrarily forcing companies to move their data elsewhere, then they’ll incur serious costs without any real benefit. I’d almost rather just give a French company control over some section of the US warehouse if I’m Amazon.
- rolisz 5y ago
  Hah, it's a myth that Switzerland is so privacy oriented. They have laws saying that the Swiss intelligence services can access all data, so it wouldn't help. And Switzerland is not part of the EU.
  - jeffbee 5y ago
    Both Swiss and German people seem completely deluded about the activities of their own governments and intelligence agencies.
    - zwaps 5y ago
      Why tho? Do you think German citizens have more privacy in Germany than in the US, where the US legislature clearly states that non US citizens have zero privacy rights whatsoever? I don't think it's delusion, I think it is literally correct.
    - 5y ago

mixedbit 5y ago

I'm not sure such split would require sub-companies to be public, they could likely be private, owned by a single publicly traded US company. Tech companies already have many subsidiaries in countries that they have offices in, for example employees in European countries are not employed by a US company, but a subsidiary which is not publicly traded.

sfifs 5y ago
They already have EU subsidiaries. The problem seems to be that US laws seem to be able to compel US based parent companies to hand over data from their overseas subsidiaries. If you make it a EU based public company and give control to your own shareholders, it's no longer a subsidiary and your shareholders are holding shares in a European company.

KingOfCoders 5y ago

The point is more nuanced: The problem is not the handing over (happens here too), but the fact EU citizens do not get informed this has happend and have no legal way to challenge this (especially concerning FISA/FISC). They have the opportunity to do so in the EU. Yes, this is what will happen with a setup of 3 entities, b/c FANG will not want to miss EU revenue.

Spivak 5y ago
Right but the solution is for there to be a treaty between the US and the EU that allows for this. Putting the burden on every foreign company to duplicate their infrastructure is stupid work to solve a human problem.
- cuu508 5y ago
  > human problem Incompatible laws problem
- bo1024 5y ago
  Or the US could adopt better privacy laws.
  - speed_spread 5y ago
    Mark one for another American conundrum: having so much distrust for "the man" while at the same time being completely oblivious to the amount of personal data being skimmed off their daily activities. But it's all to guarantee Freedom™ so it must be ok?
    - withinboredom 5y ago
      Much of the Constitution in the US was written by people who wanted corporations to do whatever they wanted and no government can intervene. You see a lot of this philosophy still living today in rulings and precedent.
  - Spivak 5y ago

tyfon 5y ago

The EU part cannot be owned by the US entity since the US government can compel the US mother company to have it's subsidiary hand over data. In fact this is how most of the companies operate already to cheat on taxes. The way microsoft did it for a while here in Norway was to license azure cloud stuff to a sub operator (EVRY) that is completely insulated except for the licensing agreement.

augustl 5y ago
Hmm, that's interesting. I suppose more cloud providers could do something like that, for the benefit of customers and GDPR? E.g. Amazon already bills me through some Norwegian entity of some kind, to get VAT done right etc. If they had servers in Norway, I suppose it would have been possible to proxy everything - not just billing - in AWS Norway through this sub operator?
- waffleiron 5y ago
  To fall out of scope of the CLOUD act, the subsidiary needs to be independent and prevent any data access by its holding company. The holding company can in no way have "possession, custody or control", which are not well defined so that doesn't make it easier to assess if a subsidiary is out of scope. https://jnslp.com/wp-content/uploads/2020/05/Defining-the-Scope-of-Possession-Custody-or-Control.pdf https://jnslp.com/wp-content/uploads/2020/05/Defining-the-Sc...
  - judge2020 5y ago
    So is it likely the European Commission did this in an attempt to block US companies from offering internet services to the EU (or at least, internet services that handle user info)? It's pretty hard to make a profit or operate in the EU if you literally can't control that entity.
    - f-jin 5y ago
      > So is it likely the European Commission did this in an attempt to block US companies from offering internet services to the EU More like the European Commission did this in an attempt to protect European citizens from having their personal data exfiltrated against their will to the US on order of US law enforcement agencies.

bradly 5y ago

Google is already doing this in countries like China and South Korea.

ivoras 5y ago

It's not as clear cut. If someone is running a global web site and wants analytics, which of the 2 entities, or both, would he reference in HTML? Even if we're going to region-lock Europe to the European Analytics servers, analytics today often involves some computation done over the entire data set, including both US and the EU, done on the backend. Which backend would that be? The privacy aspect has become something of a "think of the children" reason for a sort of "Internet xenophobia", as well as creating huge barriers to entry for small companies which cannot comply.

krageon 5y ago
> barriers to entry It's easy to do things online as a company of any size, post-GDPR: Don't scrape user data. Done - no compliance required, because the law is not about you in that case.

shafyy 5y ago

Exactly, the CLOUD act is the one of the main problems here: https://en.wikipedia.org/wiki/CLOUD_Act https://en.wikipedia.org/wiki/CLOUD_Act

lmkg 5y ago
I've read most of the EU rulings and court cases on this topic. The CLOUD Act is basically the only US law that any of them mention or refer to. And let's be explicit here: The entire purpose of the CLOUD Act is to bypass EU data protection laws. The incident that led to the creation of this law is that Microsoft didn't hand data over to the FBI because the data was on a server in Ireland. This isn't an unintended consequence, this is what the law is supposed to do.
- tzs 5y ago
  The point of the CLOUD Act was to say that if you are a company in the US you can't ignore an order to turn over a copy of data you control just because you happen to have stored that data with a third party storage provider that is not in the US. It doesn't matter that the third party storage provider is not under US jurisdiction because the US government isn't trying to compel the third party storage provider to do anything. They are trying to compel the US company to access its own documents that it stored with that third party, using the same mechanisms the US company normally uses when it wants to access its data. From the third party storage provider point of view there is no difference between the US company retrieving the data because it wants to do something with it itself or the US company retrieving the data because they are being compelled to by law enforcement. This is really just clarifying that the rules for electronic documents are not very different from the rules for physical documents. If I am in the US and own a document that a US court orders me to produce a copy of I'm not going to be able to get out of that by telling them that the document is in a filing cabinet in a storage unit I rent in Canada or Mexico. No, they are going to order me to either go get that document or have someone go get it for me and give it to the court. If it didn't work this way every US company that has any documents they think might get them in trouble if they are ever investigated would rent some storage space outside the US, physical space if the documents are on paper and cloud storage space if they are electronic, and store everything there. Boeing for instance would have all its information about the 737 MAX outside of the US. Tesla would have everything related to full self-driving outside the US. Everyone would keep HR records outside the US to make it harder for plaintiffs if the company is ever sued over alleged discrimination.