4 ms·

That already happened. Cookiebot (Danish) was fined for using Akamai CDN. Note that it's not all CDNs, fonts, etc. It's ones that are subject to the CLOUD Act

by lmkg 5y ago

That already happened. Cookiebot (Danish) was fined for using Akamai CDN. Note that it's not all CDNs, fonts, etc. It's ones that are subject to the CLOUD Act in the United States. Non-American companies, or even US companies which are not subject to the CLOUD Act, might be OK.

jeroenhd 5y ago
It's not just American companies, though; African, Australian, Canadian, Mexican and Russian companies have the exact same restrictions. The general rule is "privacy enforcement and protections must be as good or better than the EU's". It's possible for a country to get certification from the EU that the privacy protections of said country are strong enough. When that happens (see the failed Privacy Shield and friends for an example), you can let companies from those countries process PII if there are significant protections built into the contract (say, a huge fine to you if they mess up and leak the data of your customers, as the EU cannot impose their own fines as easily). From what I can tell, the contracts and DPAs most American cloud providers eagerly send you are good enough to satisfy this constraint if the companies weren't subject to American law.
- lmkg 5y ago
  I see where you're coming from, but that's not quite true. GDPR basically puts international transfers into two buckets: Adequacy Decision, and Other. Adequacy decision means the other country's laws are "good enough," and your obligations are literally just to put the words "Adequacy Decision" in your privacy policy somewhere. Other means you need to take "additional safeguards" to ensure data privacy is protected. This is a bit of a bother, but eminently feasible. The "standard" way to do this is put additional terms in the contracts you sign with third parties (and only use third parties where you have signed contracts). The situation with the United States is unique: the EU have ruled that no possible safeguards are good enough. US law enforcement's needs override any contract you can sign, so it is legally literally not possible for an American company to safeguard data. This makes data transfers to the US substantially more restricted than data transfers to any other third-party country.
  - jeroenhd 5y ago
    I'm not aware of any other country outside of Europe that competes in the tech space and doesn't have laws similar to the CLOUD act. There's been a ruling on the conflict with American law, yes, but I doubt most other jurisdictions would pass the requirements. Everybody wants full control over the data stored in their jurisdiction but nobody wants their citizens' data to leak to other governments.
- viro 5y ago
  "Via warrant or subpoena" You want American companies to ignore court orders. This isn't about privacy protections. You want EU data to be immune from court orders.
  - detaro 5y ago
    court orders the targeted persons have no legal recourse against. That's one of the key points that killed the recognition of US law as adequate: That you can be targeted by surveillance that has no effective legal oversight into if you are a valid target, and you have no legal recourse against this.
    - viro 5y ago
      You're asking for legal protection that you don't force onto your own court system. Does your court system inform criminals they are being wiretapped during an active investigation?
      - detaro 5y ago
        That's not demanded of the US either.
  - jeroenhd 5y ago
    What the EU wants is to permit for adequate privacy regulations so that American businesses can operate with the necessary privacy guarantees without breaking the law. The USA would not accept their American companies to become subject to European subpoenas and courts, but does enforce these requirements when the situation is reversed. Obviously the EU doesn't like that. Nobody wants American companies to break the law, the EU just wants American law to be better. America disagrees, and there's nothing wrong with that, but that obviously has an impact on the economic viability of the European market for American companies.

by lmkg 5y ago

jeroenhd 5y ago

It's not just American companies, though; African, Australian, Canadian, Mexican and Russian companies have the exact same restrictions. The general rule is "privacy enforcement and protections must be as good or better than the EU's". It's possible for a country to get certification from the EU that the privacy protections of said country are strong enough. When that happens (see the failed Privacy Shield and friends for an example), you can let companies from those countries process PII if there are significant protections built into the contract (say, a huge fine to you if they mess up and leak the data of your customers, as the EU cannot impose their own fines as easily). From what I can tell, the contracts and DPAs most American cloud providers eagerly send you are good enough to satisfy this constraint if the companies weren't subject to American law.

lmkg 5y ago
I see where you're coming from, but that's not quite true. GDPR basically puts international transfers into two buckets: Adequacy Decision, and Other. Adequacy decision means the other country's laws are "good enough," and your obligations are literally just to put the words "Adequacy Decision" in your privacy policy somewhere. Other means you need to take "additional safeguards" to ensure data privacy is protected. This is a bit of a bother, but eminently feasible. The "standard" way to do this is put additional terms in the contracts you sign with third parties (and only use third parties where you have signed contracts). The situation with the United States is unique: the EU have ruled that no possible safeguards are good enough. US law enforcement's needs override any contract you can sign, so it is legally literally not possible for an American company to safeguard data. This makes data transfers to the US substantially more restricted than data transfers to any other third-party country.
- jeroenhd 5y ago
  I'm not aware of any other country outside of Europe that competes in the tech space and doesn't have laws similar to the CLOUD act. There's been a ruling on the conflict with American law, yes, but I doubt most other jurisdictions would pass the requirements. Everybody wants full control over the data stored in their jurisdiction but nobody wants their citizens' data to leak to other governments.
viro 5y ago
"Via warrant or subpoena" You want American companies to ignore court orders. This isn't about privacy protections. You want EU data to be immune from court orders.
- detaro 5y ago
  court orders the targeted persons have no legal recourse against. That's one of the key points that killed the recognition of US law as adequate: That you can be targeted by surveillance that has no effective legal oversight into if you are a valid target, and you have no legal recourse against this.
  - viro 5y ago
    You're asking for legal protection that you don't force onto your own court system. Does your court system inform criminals they are being wiretapped during an active investigation?
    - detaro 5y ago
      That's not demanded of the US either.
- jeroenhd 5y ago
  What the EU wants is to permit for adequate privacy regulations so that American businesses can operate with the necessary privacy guarantees without breaking the law. The USA would not accept their American companies to become subject to European subpoenas and courts, but does enforce these requirements when the situation is reversed. Obviously the EU doesn't like that. Nobody wants American companies to break the law, the EU just wants American law to be better. America disagrees, and there's nothing wrong with that, but that obviously has an impact on the economic viability of the European market for American companies.