6 ms·

The EU part cannot be owned by the US entity since the US government can compel the US mother company to have it's subsidiary hand over data. In fact this is h

by tyfon 5y ago

The EU part cannot be owned by the US entity since the US government can compel the US mother company to have it's subsidiary hand over data. In fact this is how most of the companies operate already to cheat on taxes. The way microsoft did it for a while here in Norway was to license azure cloud stuff to a sub operator (EVRY) that is completely insulated except for the licensing agreement.

augustl 5y ago
Hmm, that's interesting. I suppose more cloud providers could do something like that, for the benefit of customers and GDPR? E.g. Amazon already bills me through some Norwegian entity of some kind, to get VAT done right etc. If they had servers in Norway, I suppose it would have been possible to proxy everything - not just billing - in AWS Norway through this sub operator?
- waffleiron 5y ago
  To fall out of scope of the CLOUD act, the subsidiary needs to be independent and prevent any data access by its holding company. The holding company can in no way have "possession, custody or control", which are not well defined so that doesn't make it easier to assess if a subsidiary is out of scope. https://jnslp.com/wp-content/uploads/2020/05/Defining-the-Scope-of-Possession-Custody-or-Control.pdf https://jnslp.com/wp-content/uploads/2020/05/Defining-the-Sc...
  - judge2020 5y ago
    So is it likely the European Commission did this in an attempt to block US companies from offering internet services to the EU (or at least, internet services that handle user info)? It's pretty hard to make a profit or operate in the EU if you literally can't control that entity.
    - f-jin 5y ago
      > So is it likely the European Commission did this in an attempt to block US companies from offering internet services to the EU More like the European Commission did this in an attempt to protect European citizens from having their personal data exfiltrated against their will to the US on order of US law enforcement agencies.
    - waffleiron 5y ago
      Schrems II (and the Privacy Shield invalidation) has been in response to the aggressive data collection by the US government, and the extra-territorial nature of legislation used to achieve this. The US is able regain access to the EU market by repealing/changing CLOUD act and similar legislation, so I personally don't think this is (primarily) done to block US companies. However I am not the one implementing these rulings, so the best I can is speculate.
      - judge2020 5y ago
        It seems pretty hard to think the US will drop the legislation every 3-letter-agency had wished for over the decades before it became law. The only thing I can imagine that actually gets the law changed is if the EU heavily invests in prosecuting these cases, to the point that tons of US companies worry they'll lose access to the EU market (with non-negligible fines to back up the law).
    - tyfon 5y ago
      No, EU had an agreement with the US called Privacy shield that allowed US companies to process EU data. However this was struck down by US courts and that is what leaves us with this mess.
      - greenyoda 5y ago
        > However this was struck down by US courts and that is what leaves us with this mess. According to Wikipedia, it was struck down by the CJEU, not by a US court: "The EU-US Privacy Shield for data sharing was struck down by the European Court of Justice on the grounds it did not provide adequate protections to EU citizens on government snooping." https://en.wikipedia.org/wiki/EU%E2%80%93US_Privacy_Shield#Legal_challenge https://en.wikipedia.org/wiki/EU%E2%80%93US_Privacy_Shield#L...
    - closewith 5y ago
      If anything, it was a move to push US legislators to respect foreign privacy laws.
- deleted 5y ago
  [deleted]
mschuster91 5y ago
MS did the same in Germany with Deutsche Telekom as a partner, that shut down around 2018 [1]. [1]: https://nextcloud.com/blog/microsoft-and-telekom-no-longer-offer-cloud-storage-under-german-jurisdiction/ https://nextcloud.com/blog/microsoft-and-telekom-no-longer-o...
- Tijdreiziger 5y ago
  They still do in China: https://docs.microsoft.com/en-us/office365/servicedescriptions/office-365-platform-service-description/office-365-operated-by-21vianet https://docs.microsoft.com/en-us/office365/servicedescriptio...
deleted 5y ago
[deleted]
kergonath 5y ago
> The EU part cannot be owned by the US entity since the US government can compel the US mother company to have it's subsidiary hand over data. As it stands, the US part can be owned by a EU company. Or, probably more realistically, both EU and US parts could be owned by a mail box in the Caimans.
spiffytech 5y ago
> The EU part cannot be owned by the US entity since the US government can compel the US mother company to have it's subsidiary hand over data. Is this true for ownership by individuals too? If I, an American citizen & resident, owned and operated a company registered to a European nation to serve my European customers (with European hosting), does that make me compliant? Does an American solo founder have a path to compliance at all, or would I be required to collaborate with a completely separate workforce that has no ties to America?
- tyfon 5y ago
  If you are subject to the cloud act in the US then you are not compliant or in anyway can be compelled by the US to hand over data on EU citizens. As a private individual I suspect you would not have much to stand on if the NSA knocked on your door. Another way to be compliant is to not collect PII.
  - spiffytech 5y ago
    > Another way to be compliant is to not collect PII. The GDPR extends far beyond the US notion of PII. As I understand it, it covers basically all user-submitted or user-related data if it's possible for that data to be hypothetically tied to an individual in the EU (even if that can be done without your service holding traditional PII). > As a private individual I suspect you would not have much to stand on if the NSA knocked on your door. Yeah, a federal agent with a wrench can do anything they want to me (https://xkcd.com/538/ https://xkcd.com/538/), but I'm trying to figure out my options.
    - inetknght 5y ago
      > The GDPR extends far beyond the US notion of PII. That's a good thing. The US notion of PII is ridiculously naive.
      - jimmydorry 5y ago
        It includes IP address... the fundamental glue that makes routing to and from said servers possible. Good luck being able to resolve web requests without knowing where to send the response.

by tyfon 5y ago

augustl 5y ago

Hmm, that's interesting. I suppose more cloud providers could do something like that, for the benefit of customers and GDPR? E.g. Amazon already bills me through some Norwegian entity of some kind, to get VAT done right etc. If they had servers in Norway, I suppose it would have been possible to proxy everything - not just billing - in AWS Norway through this sub operator?

waffleiron 5y ago
To fall out of scope of the CLOUD act, the subsidiary needs to be independent and prevent any data access by its holding company. The holding company can in no way have "possession, custody or control", which are not well defined so that doesn't make it easier to assess if a subsidiary is out of scope. https://jnslp.com/wp-content/uploads/2020/05/Defining-the-Scope-of-Possession-Custody-or-Control.pdf https://jnslp.com/wp-content/uploads/2020/05/Defining-the-Sc...
- judge2020 5y ago
  So is it likely the European Commission did this in an attempt to block US companies from offering internet services to the EU (or at least, internet services that handle user info)? It's pretty hard to make a profit or operate in the EU if you literally can't control that entity.
  - f-jin 5y ago
    > So is it likely the European Commission did this in an attempt to block US companies from offering internet services to the EU More like the European Commission did this in an attempt to protect European citizens from having their personal data exfiltrated against their will to the US on order of US law enforcement agencies.
  - waffleiron 5y ago
    Schrems II (and the Privacy Shield invalidation) has been in response to the aggressive data collection by the US government, and the extra-territorial nature of legislation used to achieve this. The US is able regain access to the EU market by repealing/changing CLOUD act and similar legislation, so I personally don't think this is (primarily) done to block US companies. However I am not the one implementing these rulings, so the best I can is speculate.
    - judge2020 5y ago
      It seems pretty hard to think the US will drop the legislation every 3-letter-agency had wished for over the decades before it became law. The only thing I can imagine that actually gets the law changed is if the EU heavily invests in prosecuting these cases, to the point that tons of US companies worry they'll lose access to the EU market (with non-negligible fines to back up the law).
  - tyfon 5y ago
    No, EU had an agreement with the US called Privacy shield that allowed US companies to process EU data. However this was struck down by US courts and that is what leaves us with this mess.
    - greenyoda 5y ago
      > However this was struck down by US courts and that is what leaves us with this mess. According to Wikipedia, it was struck down by the CJEU, not by a US court: "The EU-US Privacy Shield for data sharing was struck down by the European Court of Justice on the grounds it did not provide adequate protections to EU citizens on government snooping." https://en.wikipedia.org/wiki/EU%E2%80%93US_Privacy_Shield#Legal_challenge https://en.wikipedia.org/wiki/EU%E2%80%93US_Privacy_Shield#L...
  - closewith 5y ago
    If anything, it was a move to push US legislators to respect foreign privacy laws.
deleted 5y ago
[deleted]

mschuster91 5y ago

MS did the same in Germany with Deutsche Telekom as a partner, that shut down around 2018 [1]. [1]: https://nextcloud.com/blog/microsoft-and-telekom-no-longer-offer-cloud-storage-under-german-jurisdiction/ https://nextcloud.com/blog/microsoft-and-telekom-no-longer-o...

Tijdreiziger 5y ago
They still do in China: https://docs.microsoft.com/en-us/office365/servicedescriptions/office-365-platform-service-description/office-365-operated-by-21vianet https://docs.microsoft.com/en-us/office365/servicedescriptio...

deleted 5y ago

[deleted]

kergonath 5y ago

> The EU part cannot be owned by the US entity since the US government can compel the US mother company to have it's subsidiary hand over data. As it stands, the US part can be owned by a EU company. Or, probably more realistically, both EU and US parts could be owned by a mail box in the Caimans.

spiffytech 5y ago

> The EU part cannot be owned by the US entity since the US government can compel the US mother company to have it's subsidiary hand over data. Is this true for ownership by individuals too? If I, an American citizen & resident, owned and operated a company registered to a European nation to serve my European customers (with European hosting), does that make me compliant? Does an American solo founder have a path to compliance at all, or would I be required to collaborate with a completely separate workforce that has no ties to America?

tyfon 5y ago
If you are subject to the cloud act in the US then you are not compliant or in anyway can be compelled by the US to hand over data on EU citizens. As a private individual I suspect you would not have much to stand on if the NSA knocked on your door. Another way to be compliant is to not collect PII.
- spiffytech 5y ago
  > Another way to be compliant is to not collect PII. The GDPR extends far beyond the US notion of PII. As I understand it, it covers basically all user-submitted or user-related data if it's possible for that data to be hypothetically tied to an individual in the EU (even if that can be done without your service holding traditional PII). > As a private individual I suspect you would not have much to stand on if the NSA knocked on your door. Yeah, a federal agent with a wrench can do anything they want to me (https://xkcd.com/538/ https://xkcd.com/538/), but I'm trying to figure out my options.
  - inetknght 5y ago
    > The GDPR extends far beyond the US notion of PII. That's a good thing. The US notion of PII is ridiculously naive.
    - jimmydorry 5y ago
      It includes IP address... the fundamental glue that makes routing to and from said servers possible. Good luck being able to resolve web requests without knowing where to send the response.