8 ms·

All EU companies sending any PII to US-owned companies, regardless if the actual data stays in the EU or not, are in danger to be sued similarly to the author o

by shafyy 4y ago

All EU companies sending any PII to US-owned companies, regardless if the actual data stays in the EU or not, are in danger to be sued similarly to the author of this post. This is, among other laws, because of the US CLOUD act: > The CLOUD Act primarily amends the Stored Communications Act (SCA) of 1986 to allow federal law enforcement to compel U.S.-based technology companies via warrant or subpoena to provide requested data stored on servers regardless of whether the data are stored in the U.S. or on foreign soil. So, it's not a Shopify specific issue. https://en.wikipedia.org/wiki/CLOUD_Act https://en.wikipedia.org/wiki/CLOUD_Act

fxtentacle 4y ago
In theory, yes. In practice, the issue is that Shopify refuses to sign a data processing agreement: https://gdpr.eu/what-is-data-processing-agreement/ https://gdpr.eu/what-is-data-processing-agreement/
- canucklady 4y ago
  I know some of the team that worked on GDPR and CCPA compliance for Shopify and let's just say it is not surprising they're cutting corners.
- judge2020 4y ago
  DPAs do not protect against ramifications of the CLOUD act. See this thread (mainly the reply to it)[0]: SCC = standard contractual clauses, aka DPA/GDPR clauses that govern when and how data transferred to the US is used. > The ruling on Schrems II (the court case that struck down Privacy Shield) did not state that SCCs on their own would be sufficient. It said that SCCs + "additional safeguards" would be allowable. There have been several rulings already that SCCs on their own are not sufficient. > The "additional safeguards" must include a risk analysis of US access to EU residents' data. Every court case I've seen from Schrems II onward identifies the US CLOUD Act as the privacy risk to address. CNIL is basically ruling that you cannot transfer data to a US company subject to the CLOUD Act, and an SCC cannot deal with that. This still leaves open the possibility of using US services that are not subject to the CLOUD Act. This is consistent with all rulings to date. In summary, Schrems II + this ruling[1] mean that US corporations can't be involved with EU at all besides via licensing software to a completely independent EU corporation (which isn't a given either, though, since the US company could threaten withholding software updates/revoking the software license to pressure the EU corporation to hand over EU citizen data to US Law Enforcement - or otherwise implement a backdoor at the request of US Law Enforcement). 0: https://news.ycombinator.com/item?id=30286642 https://news.ycombinator.com/item?id=30286642 1: https://news.ycombinator.com/item?id=30284372 https://news.ycombinator.com/item?id=30284372
  - shafyy 4y ago
    Exactly, it wouldn't matter if Shopify signed those.
- duxup 4y ago
  If this is required I would think Cloudflare would have some ready agreement for everyone to sign / agree to wouldn't they? This is one of those EU rules where if it is so universal everyone should have thi right? But rather I'm not sure how widespread it is... is anyone doing it or are they all just waiting out the situation?
  - judge2020 4y ago
    Cloudflare themselves have a DPA in contract with their customers, however, it's unclear how/if this transfers from Shopify to shop owners. https://www.cloudflare.com/cloudflare-customer-dpa/ https://www.cloudflare.com/cloudflare-customer-dpa/
    - openplatypus 4y ago
      And using Cloudflare, which relies on SCCs it also GDPR no-no.
tmikaeld 4y ago
Does any one know if the Privacy Shield V2 will address this?
- lmkg 4y ago
  No one knows yet, because the successor to Privacy Shield is still currently more of an "agreement to do something" rather than an actual law. There is at least some movement in the right direction, which is to say the US is paying lip service to the notion updating domestic law to curtail law enforcement's access to data. But that hasn't actually happened yet.
  - nolok 4y ago
    The problem is that the US wants an agreement (saying data can be stored in the US as long as the US can't access it and EU privacy laws are applied to it), but the US also doesn't actually want to lose the right to warrant the data from US companies without respecting EU laws. The history of the situation is like this: - Privacy shield exists - EU users data are stored and owned by Microsoft Ireland - US goes against Microsoft with a warrant to acquire data stored by Microsoft Ireland - Microsoft US refuses, stating it's not Microsoft US data nor US citizens data but data from an entirely different company that's in Ireland, even though Microsoft US owns it, so US needs to go against Microsoft Ireland - Case goes all the way to the supreme court ( United States v. Microsoft Corp., 584 U.S. ___, 138 S. Ct. 1186 (2018) [1] ) - The US government really wants the access, but a lot of noise is being made from EU customers and government about it being in violation of the privacy shield, and that Microsoft losing this case would mean no more privacy shield since it would mean said shield isn't working, so US business are making noises too - After the hearing, but before the Supreme Court gives its answer, the CLOUD Act is passed almost hidden as part of budget bill, which says US can go against a US company to request data from foreign companies they own and they have to comply as if it was their data - The Supreme Court dismiss the case, the US government dismiss the original warrant, press releases are made saying they're not asking the data anymore and the SC dismissed the case so the privacy shield is working, and then the US government issue the exact same warrant but now under the CLOUD Act, which this time Microsoft US doesn't contest since the CLOUD Act says they have to provide the data from Microsoft Ireland - Microsoft Ireland data is provided to Microsoft US, which provide it to the US government, bypassing EU courts - EU is not fooled at all and ends the privacy shield -- EDIT see comments: after a court case forced them to admit it - The CLOUD Act allows provisions to negotiate on a country to country basis, probably so they can negotiate with each country behind doors until they each get their own "ok I cave" moment to avoid being excluded from US tech service. - GDPR enters the scene, making those privacy provision front and center and pushing them all the way to the EU. The whole negotiate with each country on its own goes away, you need a deal with the entire EU where each country doesn't risk being isolated if they say no, a EU country cannot say yes on its own as that would violate EU law. - Side note: the UK after leaving the EU has now already made such an agreement, meaning UK data handled by US companies are no longer protected by UK courts no matter where they're stored (sovereignty much ?) - US wants a privacy shield 2 with the EU, which I don't see how it can happen as long as the CLOUD Act exists unless EU companies are excluded from it, but the whole reason for the CLOUD Act to exists are EU companies, they could literally have named it "Bypass EU Law Act", because other jurisdiction don't care that much about their users data for some reason The issue the US has is that all the US tech companies providing tech services could become persona non grata from the EU market court case after court case like this one, since the US has decided neither storing the data in the EU nor setting up as a completely separate sub company puts the data out of its reach. Please note that the US never even tried to request Microsoft Ireland the data under the EU courts, like eg France did when asking Swiss court for swiss data from Proton Mail, their issue is really about them having all access on their own without having to ask anyone else, which is precisely what the EU refuses. The EU is fine with the US asking EU court for EU companies / users data and the court deciding on a case by case. [1] https://en.wikipedia.org/wiki/Microsoft_Corp._v._United_States https://en.wikipedia.org/wiki/Microsoft_Corp._v._United_Stat...
abrichr 4y ago
To clarify: Shopify is a Canadian company (edit: but as mentioned elsewhere in this thread: they send data to CloudFlare, CloudFront (Amazon) and Fastly, which are US companies.)
- yashap 4y ago
  But their CDN providers (CloudFlare, Amazon and Fastly) aren’t. That’s the claim made in the article, that using American owned CDNs makes your business illegal in Europe, even if no data processing or storage happens outside Europe. I find this hard to believe …
  - lmkg 4y ago
    The CLOUD Act gives US law enforcement access to the data, even if it's only stored in Europe. That's the problem, and the EU court is doing no more than recognizing that for the problem that it is.
    - shafyy 4y ago
      I think it's good that the EU is forcing the US to get their privacy laws in order.
      - dylan604 4y ago
        Forcing? More like strongly suggesting, but that feels too strong as well. "Hey Yanks! Would you mind getting your shite together? K? Thanks!" Which the US is quite like Fark Off, we do what we want! You're not the king of me!
      - scarface74 4y ago
        Tell that to the owner of the business.
      - Silverback_VII 4y ago
        who for goodness sake needs privacy to buy some coffee online? This is just bullshit and slows down innovation. Moreover It is a big hassle just like these cookie consent banners. Nothing shows better that European leaders are powerless than this sort of nitpicking over things of little importance.
tensor 4y ago
Also, since the EU considers an IP address to be PII, anyone in the EU is not even allowed to connect to any website owned by a US company, as the IP address is a necessary piece of data to make the most basic TCP/IP connection work. Basically, the EU has put up a legal firewall between the US and the EU. Somehow this hasn't been realized fully or openly talked about, the the implication of their law is very clear.
- vidarh 4y ago
  People in the EU can disclose their own PII to whomever they want, including far more sensitive details than IP addresses, so this isn't an issue. The limitations are on the parties capturing the data, not on the person whose data it is.
- johannes1234321 4y ago
  > anyone in the EU is not even allowed to connect to any website owned by a US These laws don't bind individual citizens, but companies offering services. One might however ask, whether EU ISPs are allowed to route to U.S. as that passes IP addresses to U.S. companies. Maybe if they implement NATing?
  - ksidudwbw 4y ago
    Just don't be creepy, that's all.
    - gameman144 4y ago
      "Don't be creepy" isn't the law as -written, and is super nebulous to comply with.
  - wizeman 4y ago
    > These laws don't bind individual citizens, but companies offering services. Right. EU companies whose websites are accessed by individual citizens and usually have assets stored by US companies, such as CDNs.
- 4y ago
oytis 4y ago
Does it also mean I can't use AWS in Europe?
- mminer237 4y ago
  AWS is owned by a US company subject to subpeonas, so yes, regardless of where you are, you are technically not allowed to receive EU PII (including residential IP addresses) without prior consent or unless it's necessary for the performance of a contract or to take steps requested by the Data Subject.
  - icedchai 4y ago
    Sounds like FUD to me. The Internet would cease to operate if you could not "receive" IP addresses. It is logging that is the "concern."
    - oytis 4y ago
      Well, apart from IP addresses. Say I am running a service in Europe, GDPR compliant etc. All the PII are in some database running on AWS, in one of the European regions of course. If what is said here about CLOUD act etc. is true, then it looks like I'm in a breach of GDPR in this scenario - which sounds afwul to me frankly.
    - cuu508 4y ago
      No, the processing of personal information is a concern too.
      - icedchai 4y ago
        No amount of legislation is going to stop IPs from being logged or processed. That's just "how it works." The only solution is to educate users and have them use a VPN.
- openplatypus 4y ago
  You cannot use AWS in Europe for processing Personal Data and remain GDPR compliant.
keewee7 4y ago
What is the difference between the CLOUD Act and the actual state of data protection in EU countries like Bulgaria, Romania, and Hungary? Why should I as a Danish entrepreneur trust a Hungarian hosting provider more than a US hosting provider?
- thargor90 4y ago
  You are allowed to trust the Hungarian hosting provider because they are legally bound to comply to GDPR. You are not allowed to trust the US provider, since there are US laws that are not GDPR compliant. It is not possible to provide a compliant hosting service under US jurisdiction.

by shafyy 4y ago

fxtentacle 4y ago

In theory, yes. In practice, the issue is that Shopify refuses to sign a data processing agreement: https://gdpr.eu/what-is-data-processing-agreement/ https://gdpr.eu/what-is-data-processing-agreement/

canucklady 4y ago
I know some of the team that worked on GDPR and CCPA compliance for Shopify and let's just say it is not surprising they're cutting corners.
judge2020 4y ago
DPAs do not protect against ramifications of the CLOUD act. See this thread (mainly the reply to it)[0]: SCC = standard contractual clauses, aka DPA/GDPR clauses that govern when and how data transferred to the US is used. > The ruling on Schrems II (the court case that struck down Privacy Shield) did not state that SCCs on their own would be sufficient. It said that SCCs + "additional safeguards" would be allowable. There have been several rulings already that SCCs on their own are not sufficient. > The "additional safeguards" must include a risk analysis of US access to EU residents' data. Every court case I've seen from Schrems II onward identifies the US CLOUD Act as the privacy risk to address. CNIL is basically ruling that you cannot transfer data to a US company subject to the CLOUD Act, and an SCC cannot deal with that. This still leaves open the possibility of using US services that are not subject to the CLOUD Act. This is consistent with all rulings to date. In summary, Schrems II + this ruling[1] mean that US corporations can't be involved with EU at all besides via licensing software to a completely independent EU corporation (which isn't a given either, though, since the US company could threaten withholding software updates/revoking the software license to pressure the EU corporation to hand over EU citizen data to US Law Enforcement - or otherwise implement a backdoor at the request of US Law Enforcement). 0: https://news.ycombinator.com/item?id=30286642 https://news.ycombinator.com/item?id=30286642 1: https://news.ycombinator.com/item?id=30284372 https://news.ycombinator.com/item?id=30284372
- shafyy 4y ago
  Exactly, it wouldn't matter if Shopify signed those.
duxup 4y ago
If this is required I would think Cloudflare would have some ready agreement for everyone to sign / agree to wouldn't they? This is one of those EU rules where if it is so universal everyone should have thi right? But rather I'm not sure how widespread it is... is anyone doing it or are they all just waiting out the situation?
- judge2020 4y ago
  Cloudflare themselves have a DPA in contract with their customers, however, it's unclear how/if this transfers from Shopify to shop owners. https://www.cloudflare.com/cloudflare-customer-dpa/ https://www.cloudflare.com/cloudflare-customer-dpa/
  - openplatypus 4y ago
    And using Cloudflare, which relies on SCCs it also GDPR no-no.

tmikaeld 4y ago

Does any one know if the Privacy Shield V2 will address this?

lmkg 4y ago
No one knows yet, because the successor to Privacy Shield is still currently more of an "agreement to do something" rather than an actual law. There is at least some movement in the right direction, which is to say the US is paying lip service to the notion updating domestic law to curtail law enforcement's access to data. But that hasn't actually happened yet.
- nolok 4y ago
  The problem is that the US wants an agreement (saying data can be stored in the US as long as the US can't access it and EU privacy laws are applied to it), but the US also doesn't actually want to lose the right to warrant the data from US companies without respecting EU laws. The history of the situation is like this: - Privacy shield exists - EU users data are stored and owned by Microsoft Ireland - US goes against Microsoft with a warrant to acquire data stored by Microsoft Ireland - Microsoft US refuses, stating it's not Microsoft US data nor US citizens data but data from an entirely different company that's in Ireland, even though Microsoft US owns it, so US needs to go against Microsoft Ireland - Case goes all the way to the supreme court ( United States v. Microsoft Corp., 584 U.S. ___, 138 S. Ct. 1186 (2018) [1] ) - The US government really wants the access, but a lot of noise is being made from EU customers and government about it being in violation of the privacy shield, and that Microsoft losing this case would mean no more privacy shield since it would mean said shield isn't working, so US business are making noises too - After the hearing, but before the Supreme Court gives its answer, the CLOUD Act is passed almost hidden as part of budget bill, which says US can go against a US company to request data from foreign companies they own and they have to comply as if it was their data - The Supreme Court dismiss the case, the US government dismiss the original warrant, press releases are made saying they're not asking the data anymore and the SC dismissed the case so the privacy shield is working, and then the US government issue the exact same warrant but now under the CLOUD Act, which this time Microsoft US doesn't contest since the CLOUD Act says they have to provide the data from Microsoft Ireland - Microsoft Ireland data is provided to Microsoft US, which provide it to the US government, bypassing EU courts - EU is not fooled at all and ends the privacy shield -- EDIT see comments: after a court case forced them to admit it - The CLOUD Act allows provisions to negotiate on a country to country basis, probably so they can negotiate with each country behind doors until they each get their own "ok I cave" moment to avoid being excluded from US tech service. - GDPR enters the scene, making those privacy provision front and center and pushing them all the way to the EU. The whole negotiate with each country on its own goes away, you need a deal with the entire EU where each country doesn't risk being isolated if they say no, a EU country cannot say yes on its own as that would violate EU law. - Side note: the UK after leaving the EU has now already made such an agreement, meaning UK data handled by US companies are no longer protected by UK courts no matter where they're stored (sovereignty much ?) - US wants a privacy shield 2 with the EU, which I don't see how it can happen as long as the CLOUD Act exists unless EU companies are excluded from it, but the whole reason for the CLOUD Act to exists are EU companies, they could literally have named it "Bypass EU Law Act", because other jurisdiction don't care that much about their users data for some reason The issue the US has is that all the US tech companies providing tech services could become persona non grata from the EU market court case after court case like this one, since the US has decided neither storing the data in the EU nor setting up as a completely separate sub company puts the data out of its reach. Please note that the US never even tried to request Microsoft Ireland the data under the EU courts, like eg France did when asking Swiss court for swiss data from Proton Mail, their issue is really about them having all access on their own without having to ask anyone else, which is precisely what the EU refuses. The EU is fine with the US asking EU court for EU companies / users data and the court deciding on a case by case. [1] https://en.wikipedia.org/wiki/Microsoft_Corp._v._United_States https://en.wikipedia.org/wiki/Microsoft_Corp._v._United_Stat...

abrichr 4y ago

To clarify: Shopify is a Canadian company (edit: but as mentioned elsewhere in this thread: they send data to CloudFlare, CloudFront (Amazon) and Fastly, which are US companies.)

yashap 4y ago
But their CDN providers (CloudFlare, Amazon and Fastly) aren’t. That’s the claim made in the article, that using American owned CDNs makes your business illegal in Europe, even if no data processing or storage happens outside Europe. I find this hard to believe …
- lmkg 4y ago
  The CLOUD Act gives US law enforcement access to the data, even if it's only stored in Europe. That's the problem, and the EU court is doing no more than recognizing that for the problem that it is.
  - shafyy 4y ago
    I think it's good that the EU is forcing the US to get their privacy laws in order.
    - dylan604 4y ago
      Forcing? More like strongly suggesting, but that feels too strong as well. "Hey Yanks! Would you mind getting your shite together? K? Thanks!" Which the US is quite like Fark Off, we do what we want! You're not the king of me!
    - scarface74 4y ago
      Tell that to the owner of the business.
    - Silverback_VII 4y ago
      who for goodness sake needs privacy to buy some coffee online? This is just bullshit and slows down innovation. Moreover It is a big hassle just like these cookie consent banners. Nothing shows better that European leaders are powerless than this sort of nitpicking over things of little importance.

tensor 4y ago

Also, since the EU considers an IP address to be PII, anyone in the EU is not even allowed to connect to any website owned by a US company, as the IP address is a necessary piece of data to make the most basic TCP/IP connection work. Basically, the EU has put up a legal firewall between the US and the EU. Somehow this hasn't been realized fully or openly talked about, the the implication of their law is very clear.

vidarh 4y ago
People in the EU can disclose their own PII to whomever they want, including far more sensitive details than IP addresses, so this isn't an issue. The limitations are on the parties capturing the data, not on the person whose data it is.
johannes1234321 4y ago
> anyone in the EU is not even allowed to connect to any website owned by a US These laws don't bind individual citizens, but companies offering services. One might however ask, whether EU ISPs are allowed to route to U.S. as that passes IP addresses to U.S. companies. Maybe if they implement NATing?
- ksidudwbw 4y ago
  Just don't be creepy, that's all.
  - gameman144 4y ago
    "Don't be creepy" isn't the law as -written, and is super nebulous to comply with.
- wizeman 4y ago
  > These laws don't bind individual citizens, but companies offering services. Right. EU companies whose websites are accessed by individual citizens and usually have assets stored by US companies, such as CDNs.
4y ago

oytis 4y ago

Does it also mean I can't use AWS in Europe?

mminer237 4y ago
AWS is owned by a US company subject to subpeonas, so yes, regardless of where you are, you are technically not allowed to receive EU PII (including residential IP addresses) without prior consent or unless it's necessary for the performance of a contract or to take steps requested by the Data Subject.
- icedchai 4y ago
  Sounds like FUD to me. The Internet would cease to operate if you could not "receive" IP addresses. It is logging that is the "concern."
  - oytis 4y ago
    Well, apart from IP addresses. Say I am running a service in Europe, GDPR compliant etc. All the PII are in some database running on AWS, in one of the European regions of course. If what is said here about CLOUD act etc. is true, then it looks like I'm in a breach of GDPR in this scenario - which sounds afwul to me frankly.
  - cuu508 4y ago
    No, the processing of personal information is a concern too.
    - icedchai 4y ago
      No amount of legislation is going to stop IPs from being logged or processed. That's just "how it works." The only solution is to educate users and have them use a VPN.
openplatypus 4y ago
You cannot use AWS in Europe for processing Personal Data and remain GDPR compliant.

keewee7 4y ago

What is the difference between the CLOUD Act and the actual state of data protection in EU countries like Bulgaria, Romania, and Hungary? Why should I as a Danish entrepreneur trust a Hungarian hosting provider more than a US hosting provider?

thargor90 4y ago
You are allowed to trust the Hungarian hosting provider because they are legally bound to comply to GDPR. You are not allowed to trust the US provider, since there are US laws that are not GDPR compliant. It is not possible to provide a compliant hosting service under US jurisdiction.