7 ms·

It's been known for years - and hardly takes a lawyer to understand - that sending user data to US-owned companies is illegal according to GDPR. The US laws are

It's been known for years - and hardly takes a lawyer to understand - that sending user data to US-owned companies is illegal according to GDPR. The US laws are simply incompatible. Yet everyone (including government entities) have been dragging their feet on and on hoping for some divine intervention to help them continue using Google, Amazon and Microsoft. And those companies have kept the hopes high by incorrectly claiming to be GDPR compliant. It's been embarrassing to witnes how little willingness there's been shown towards protecting user data. Especially compared to the amount of whining over how difficult it is to comply. Hopefully these - very predictable - rulings will finally start to get the ball rolling.

mminer237 4y ago
I think it's because over 40% of EU business use the cloud[1] and 70% of those use AWS, Azure, or GCS.[2] Enforcing the law consistently would devastate tons of EU businesses as you would suddenly eliminate all of their tech infrastructure overnight with no real alternatives. [1]: https://ec.europa.eu/eurostat/statistics-explained/index.php?title=Cloud_computing_-_statistics_on_the_use_by_enterprises https://ec.europa.eu/eurostat/statistics-explained/index.php... [2]: https://www.fiercetelecom.com/platforms/european-cloud-providers-take-hit-from-aws-google-azure-says-synergy https://www.fiercetelecom.com/platforms/european-cloud-provi...
- jeppester 4y ago
  The businesses have had more than enough time to comply with the law. Now is the time to start enforcing the law enough to make them actually care.
  - macinjosh 4y ago
    Clearly, even the EU doesn’t care enough to enforce the law or they would have already. They’ve literally had years. What does it say about the credibility of the EU that it passes laws it doesn’t even enforce?
    - deleted 4y ago
      [deleted]
    - josefx 4y ago
      > They’ve literally had years. Almost exactly 2. The last agreement between the US and EU was nuked by Schrems II mid 2020. > What does it say about the credibility of the EU that it passes laws it doesn’t even enforce? Companies have already been successfully sued over it.
  - closewith 4y ago
    Most businesses affected by this would have gone bankrupt if they had pre-emptively complied. Compliance means being unable to effectively use any of the major online advertising services. So while you could theoretically migrate from US cloud services (although where to is the question. Hertzner for cloud compute? Open Office for Office 365?), there’s no search engine or social network controlled in a country with a data adequacy decision. That means effectively no online advertising. If a company followed that route while all their competitors did not, their demand generation would have plummeted and they'd be out-of-business.
    - tpxl 4y ago
      > That means effectively no online advertising. Wat. You can't sell out your users to google ads, that doesn't mean you can't advertise on google.
      - closewith 4y ago
        In practice, it does. It's impossible to use any of the major ad networks effectively without conversion tracking (which is what I'm assuming you're calling selling out? I disagree with that sentiment, given it amounts to sending a single pseudoanonymous ID with user consent). Edit: To be clear, most European enterprise companies would happily dump Google Analytics if not for Google Ads and the Search Console integration. Almost all will be already be using another tool for user analytics, but most online B2C companies are reliant on Google for demand generation, and Google Ads is only effective with conversion tracking.
        tpxl 4y ago
        Does conversion tracking require you to track your users (a la google analytics), or is it actually just a pseudo'anonymous' parameter when visiting a website (like referrer could be, if advertisers hadn't killed it). And even then, advertising without tracking worked just fine without internet.
        closewith 4y ago
  - fjfbsufhdvfy 4y ago
    It is not possible to comply with this law as a small or even fairly large business if it prevents you from using the only viable major cloud services which are required for the operation of your business. Do you want the EU to delete the rest of their already behind tech industry?
    - hansel_der 4y ago
      good point! it's far from 'required for the operation' it's just convenient. i.e. dumping waste enywhere is convenient and cheap, but if your business cannot survive otherwise, it's hard to argue for it's right to exist.
    - martin_a 4y ago
      Bullshit. Why would those cloud services be required to run a business? We're doing just fine without them, hosting fonts locally, using Matomo, saving data on servers from EU companies. Its's possible, although Google etc. will of course tell you otherwise.
      - fastest963 4y ago
        Do these EU hosting companies also have servers available in other continents like North America? Could you operate a sufficiently global website from these hosting companies? Do they have S3-style or Pub/Sub-style features or do you have to build those in-house or maintain something off-the-shelf? If you're a small website maybe you can get by but if you get large you'll probably find you don't have many other options.
        nephanth 4y ago
        Yes they do - https://www.ovhcloud.com/en/datacenters-ovhcloud/ https://www.ovhcloud.com/en/datacenters-ovhcloud/ - https://upcloud.com/about https://upcloud.com/about and others. The european cloud providers clearly don’t have as many features or market share as the GAFAM (they also tend to be more specialized), but contrary to what a lot of people here seem to believe, they have enough for most uses
- krageon 4y ago
  > devastate Not having AWS/Azure/GCS is not devastating. It's just a little bit different. Those platforms quite simply don't add many interesting features and the reason people use them in the EU is largely based on cargo-culting.
- theplumber 4y ago
  The cloud business is now a commodity.
oliwarner 4y ago
It was legal under the "Privacy Shield" until Schrems II, and is still legal under Standard Contractual Clauses with extra caveats for the US.
- shakamone 4y ago
  This answer is accurate but no one seems to realise it. Under standard contracts users waive their rights including privacy rights under GDPR. Their are no user agreements anymore, only contracts.
  - rtsil 4y ago
    The CNIL's page says that standard contracts do not offer adequate protections and as such are insufficient.
  - martin8412 4y ago
    No such thing. You can't sign away your rights. The end.
    - abigail95 4y ago
      If you're in the EU you don't have the right to give your IP address to a US company? Your own IP address? What's the point of having personal data if you aren't allowed to make decisions about it
      - martin8412 4y ago
        You can absolutely choose to share your data with an US company, but you can also withdraw consent five seconds later, making it illegal for them to further process the data. The point is, that it is your personal data, and only you get to say what can and can't be done with it. That right can't be signed away.
      - xalava 4y ago
        European laws have a different approach regarding most individual rights. They are socially defined and distinguished from ownership. Your body for instance is probably better protected in terms of chemical additives, healthcare and now pregnancy choices, but you can't easily sell body parts or be a surrogate.
Nursie 4y ago
I'm still annoyed that gov.uk, all the while being praised for great web design, happily recorded all interactions between UK citizens and UK government, and sent them off to google. And refused to engage on why that might be a bad idea, because hey, we find it useful, and Google pinky-swear they anonymise everything.
- closewith 4y ago
  Ireland uses Microsoft's Azure Active Directory to auth for the national digital ID system, MyGovID.
  - GekkePrutser 4y ago
    Ireland is a sucker for big tech interests though. Because so many of them use the country for tax avoidance they have a really big influence on politics. Like when the EU made Apple actually pay the small amount of tax they should have, Ireland jumped up to oppose. They were opposed to receiving a billion euros.

mminer237 4y ago

I think it's because over 40% of EU business use the cloud[1] and 70% of those use AWS, Azure, or GCS.[2] Enforcing the law consistently would devastate tons of EU businesses as you would suddenly eliminate all of their tech infrastructure overnight with no real alternatives. [1]: https://ec.europa.eu/eurostat/statistics-explained/index.php?title=Cloud_computing_-_statistics_on_the_use_by_enterprises https://ec.europa.eu/eurostat/statistics-explained/index.php... [2]: https://www.fiercetelecom.com/platforms/european-cloud-providers-take-hit-from-aws-google-azure-says-synergy https://www.fiercetelecom.com/platforms/european-cloud-provi...

jeppester 4y ago
The businesses have had more than enough time to comply with the law. Now is the time to start enforcing the law enough to make them actually care.
- macinjosh 4y ago
  Clearly, even the EU doesn’t care enough to enforce the law or they would have already. They’ve literally had years. What does it say about the credibility of the EU that it passes laws it doesn’t even enforce?
  - deleted 4y ago
    [deleted]
  - josefx 4y ago
    > They’ve literally had years. Almost exactly 2. The last agreement between the US and EU was nuked by Schrems II mid 2020. > What does it say about the credibility of the EU that it passes laws it doesn’t even enforce? Companies have already been successfully sued over it.
- closewith 4y ago
  Most businesses affected by this would have gone bankrupt if they had pre-emptively complied. Compliance means being unable to effectively use any of the major online advertising services. So while you could theoretically migrate from US cloud services (although where to is the question. Hertzner for cloud compute? Open Office for Office 365?), there’s no search engine or social network controlled in a country with a data adequacy decision. That means effectively no online advertising. If a company followed that route while all their competitors did not, their demand generation would have plummeted and they'd be out-of-business.
  - tpxl 4y ago
    > That means effectively no online advertising. Wat. You can't sell out your users to google ads, that doesn't mean you can't advertise on google.
    - closewith 4y ago
      In practice, it does. It's impossible to use any of the major ad networks effectively without conversion tracking (which is what I'm assuming you're calling selling out? I disagree with that sentiment, given it amounts to sending a single pseudoanonymous ID with user consent). Edit: To be clear, most European enterprise companies would happily dump Google Analytics if not for Google Ads and the Search Console integration. Almost all will be already be using another tool for user analytics, but most online B2C companies are reliant on Google for demand generation, and Google Ads is only effective with conversion tracking.
      - tpxl 4y ago
        Does conversion tracking require you to track your users (a la google analytics), or is it actually just a pseudo'anonymous' parameter when visiting a website (like referrer could be, if advertisers hadn't killed it). And even then, advertising without tracking worked just fine without internet.
        closewith 4y ago
- fjfbsufhdvfy 4y ago
  It is not possible to comply with this law as a small or even fairly large business if it prevents you from using the only viable major cloud services which are required for the operation of your business. Do you want the EU to delete the rest of their already behind tech industry?
  - hansel_der 4y ago
    good point! it's far from 'required for the operation' it's just convenient. i.e. dumping waste enywhere is convenient and cheap, but if your business cannot survive otherwise, it's hard to argue for it's right to exist.
  - martin_a 4y ago
    Bullshit. Why would those cloud services be required to run a business? We're doing just fine without them, hosting fonts locally, using Matomo, saving data on servers from EU companies. Its's possible, although Google etc. will of course tell you otherwise.
    - fastest963 4y ago
      Do these EU hosting companies also have servers available in other continents like North America? Could you operate a sufficiently global website from these hosting companies? Do they have S3-style or Pub/Sub-style features or do you have to build those in-house or maintain something off-the-shelf? If you're a small website maybe you can get by but if you get large you'll probably find you don't have many other options.
      - nephanth 4y ago
        Yes they do - https://www.ovhcloud.com/en/datacenters-ovhcloud/ https://www.ovhcloud.com/en/datacenters-ovhcloud/ - https://upcloud.com/about https://upcloud.com/about and others. The european cloud providers clearly don’t have as many features or market share as the GAFAM (they also tend to be more specialized), but contrary to what a lot of people here seem to believe, they have enough for most uses
krageon 4y ago
> devastate Not having AWS/Azure/GCS is not devastating. It's just a little bit different. Those platforms quite simply don't add many interesting features and the reason people use them in the EU is largely based on cargo-culting.
theplumber 4y ago
The cloud business is now a commodity.

oliwarner 4y ago

It was legal under the "Privacy Shield" until Schrems II, and is still legal under Standard Contractual Clauses with extra caveats for the US.

shakamone 4y ago
This answer is accurate but no one seems to realise it. Under standard contracts users waive their rights including privacy rights under GDPR. Their are no user agreements anymore, only contracts.
- rtsil 4y ago
  The CNIL's page says that standard contracts do not offer adequate protections and as such are insufficient.
- martin8412 4y ago
  No such thing. You can't sign away your rights. The end.
  - abigail95 4y ago
    If you're in the EU you don't have the right to give your IP address to a US company? Your own IP address? What's the point of having personal data if you aren't allowed to make decisions about it
    - martin8412 4y ago
      You can absolutely choose to share your data with an US company, but you can also withdraw consent five seconds later, making it illegal for them to further process the data. The point is, that it is your personal data, and only you get to say what can and can't be done with it. That right can't be signed away.
    - xalava 4y ago
      European laws have a different approach regarding most individual rights. They are socially defined and distinguished from ownership. Your body for instance is probably better protected in terms of chemical additives, healthcare and now pregnancy choices, but you can't easily sell body parts or be a surrogate.

Nursie 4y ago

I'm still annoyed that gov.uk, all the while being praised for great web design, happily recorded all interactions between UK citizens and UK government, and sent them off to google. And refused to engage on why that might be a bad idea, because hey, we find it useful, and Google pinky-swear they anonymise everything.

closewith 4y ago
Ireland uses Microsoft's Azure Active Directory to auth for the national digital ID system, MyGovID.
- GekkePrutser 4y ago
  Ireland is a sucker for big tech interests though. Because so many of them use the country for tax avoidance they have a really big influence on politics. Like when the EU made Apple actually pay the small amount of tax they should have, Ireland jumped up to oppose. They were opposed to receiving a billion euros.