7 ms·

The fundamental problem is that NSA, CIA, FBI.. can force American companies to hand over data (even if the data is saved in EU). I think it’s just a matter of

The fundamental problem is that NSA, CIA, FBI.. can force American companies to hand over data (even if the data is saved in EU). I think it’s just a matter of time before AWS, Google Cloud, Azure.. is illegal to use, as long as there is not an EU company that have 100% control of the environment and is not incentivized to follow the orders from their software “supplier”. The only fix it to remove all legal ground for American officials to get access to data about EU citizens.

mdhb 4y ago
You mean they can go to the DOJ and ask for a subpoena and then go argue to a court that somehow that Google Analytics data is critical to national security and then and only then can they compel a company to hand it over. You seem to be very confused about how this process works in reality.
- slackdog 4y ago
  I don't see how anything you said contradicts anything punnerud said. What is punnerud supposedly confused about?
  - mdhb 4y ago
    One has several layers of checks and balances in there from unrelated sections of government as a part of a legitimate function of any government in the world. The original post however implied that it was a sinister thing that could just be done on a whim which is objectively not at all how it works in reality.
    - slackdog 4y ago
      American checks and balances aren't relevant to the EU. The CLOUD Act requires that American companies turn over data stored in the EU without any involvement of EU due process and checks and balances, violating EU laws. The CLOUD Act effectively drafts all American companies into the American intelligence community. This is not acceptable to the EU. punnerud is not confused. Edit for response: > Which European countries aren’t able to compel a company to help them by providing data in a matter of national security? EU companies being so compelled by EU governments isn't relevant to the EU; which obviously supports that. > This idea that all American companies are somehow arm in arm with the USIC is a ridiculous notion that isn’t supported by facts. That is the purpose of the CLOUD Act. That's what it does. If Microsoft has a server in the EU with EU citizen data on it, the CLOUD Act requires Microsoft to hand over that data in violation of EU law if the US Government requests it. The fact that the US Government has checks and balances of its own is not relevant, the CLOUD Act still compels American companies operating in the EU to violate EU laws. > There is a reason why most American tech companies in particular make a point to repeatedly and very loudly proclaim [...] Their proclamations are irrelevant. US law requires them to violate EU law. As long as this is the case, the EU has no rational choice but to ban EU companies from giving EU data to American companies.
      - mdhb 4y ago
        Which European countries aren’t able to compel a company to help them by providing data in a matter of national security? This idea that all American companies are somehow arm in arm with the USIC is a ridiculous notion that isn’t supported by facts. There is a reason why most American tech companies in particular make a point to repeatedly and very loudly proclaim that they will not provide any assistance unless legally forced to do so with a subpoena. They understand that they have a global customer base and that outside the context of those checks and balances that it might be bad for business. In fact I would even argue that many of those same companies have a far stronger record of collaborating with China than the US. Apple is an example which repeatedly comes to mind here.
        Tuna-Fish 4y ago
        You do not understand the issue. European countries can compel me to share data, and in that case I can do it legally. However, under the current law if I share data to the US government without going through the process in my local courts, I am liable for massive fines. This is even true if I am not the entity sharing the data, but I merely placed it in the care of an US company. The problem is not that American companies are arm in arm with the government, it's that they are incorporated in a jurisdiction where the US courts have power, and because of my local laws, I must consider those courts to be a hostile actor.
    - bryanrasmussen 4y ago
      Ok but is this >You mean they can go to the DOJ and ask for a subpoena and then go argue to a court that somehow like - how much more difficult is this than getting a warrant? I mean this doesn't make it seem very difficult https://lorr.com/how-to-subpoena-documents-examples-process/ https://lorr.com/how-to-subpoena-documents-examples-process/ It's not having a trial or anything to get the data, it is a judge (or in the link, a court clerk?) signing off on the subpoena or am I confused as to how complicated and difficult and time consuming that actually is. Because getting a warrant is in my experience not like something that takes months and months where people argue and there is a likelihood that even if the warrant is granted that you can appeal to have it overturned, and it seems like a subpoena is no more difficult than getting a warrant and maybe easier. At any rate, aside from the fact that the American government has often been shown to take more data than needed in their searches of people - that is to say abuse the layers of checks and balances - the European government would of course worry about potential abuses and disallow on the better safe than sorry view of protecting its citizens. on edit: slackdog made a more relevant point than I did anyway.
908B64B197 4y ago
...And Europeans governments can't via the European subsidiaries of American companies in Europe?
- slackdog 4y ago
  The CLOUD Act allows the US government to compel a company to turn over their data even if that data is only stored in servers in a foreign country, with no due process in that country. It requires American companies to violate EU law. The only way the EU can protect themselves from the CLOUD Act is to forbid any EU data be stored with any US company. Maybe you could accomplish that with a wholly EU subsidiary of an American company that is able to refuse and block requests for that data from their American parent corporation, but the CLOUD Act would still require the American company to hand over that data because the EU subsidiary is owned by the American company. The only rational response from the EU is to ban EU companies from storing EU data with American companies.
  - abigail95 4y ago
    Please read the Schrems II case and the updated privacy protections being implemented literally right now.
    - punnerud 4y ago
      How can any protection be safe, as long as the US company have to comply? There is already a process now for Schrems III
    - jeroenhd 4y ago
      These protections aren't in place yet. They're not even finished at the moment. Until the time comes that the necessary protections are in place, one can assume American companies are off limits for the time being, as they have been for the past couple of years.
- Tuna-Fish 4y ago
  To be clear, this is not about morality, but about following EU privacy rules. As far as those rules go, I must consider US courts to be hostile actors, and any entity that would follow their rulings is a potential threat to me. I am liable if personal data pertaining to EU citizens is disseminated outside of the process set out in EU directives and local laws. This process does cover a local court compelling me or a local company to hand over something, and so in that case I will be in the clear. However, it does not cover the situation where I store my data on AWS and a non-EU court (US) compels Amazon to hand over the data, so in that case I will be liable for massive, potentially company-ending fines. People have still not adjusted their behavior to account for the changes in laws, but right now it is very inadvisable for any EU entity to store any personal data on any service provided by a non-EU entity.
tzs 4y ago
> The fundamental problem is that NSA, CIA, FBI.. can force American companies to hand over data (even if the data is saved in EU) How does this work when it goes the other way? Suppose a French company in Paris had some data and they stored that data in AWS in the us-east-1 region. A French police or intelligence agency gets a court order (or whatever is the French equivalent) asking the company to turn over a copy of that data. Can the company refuse (without getting in legal trouble) on the grounds that the data is not stored in France?
- bboygravity 4y ago
  This would work the other way around in practice (source: Snowden): the NSA would voluntarily give the data that the French want off of AWS in exchange for whatever data the NSA wants from within the French territory. The company wouldn't have to refuse anything, because they wouldn't even be aware that this is happening at all. All the company knows is that they host data on US servers. I mean this is what Snowden described many years ago, it's probably way worse, more legalized and even more automated now.
- punnerud 4y ago
  EU don’t have the same kind of laws that don’t obey other countries laws as I am familiar with. So a solution would also be to move headquarters for Microsoft, Apple, Meta… to EU So no, they would not get into trouble (if based in EU)
  - tzs 4y ago
    > EU don’t have the same kind of laws that don’t obey other countries laws as I am familiar with No other country's laws would be involved in the scenario I asked about. It does not violate any US law for a company that has stored data in US AWS to retrieve that data. The French authorities would be asking the French company to give them a copy of data that the French company controls and has legal access to. All the French company has to do to comply is make an API request to AWS, something they presumably routinely do. If merely storing documents outside of your own country, but still within your control (in the sense that you can retrieve them any time you need them by asking whoever/whatever is holding them for you in the other country), is sufficient to make it so your own country can no longer legally compel you to turn over copies of those documents I don't see how that would not lead to massive problems for that country. Wouldn't every company making consumer products, for example, store all documents produced during design and testing outside the country so in case safety issues arise later investigators can't get those documents to help build a negligence case against the company?
jeroenhd 4y ago
That is the reason exporting PII to American cloud providers is illegal, yes. That's exactly what the EU is now trying to work out. This includes concessions to give European citizens certain rights when it comes to American intelligence agencies and such. That's part of the reason why companies use Irish subsidiaries to bring a point of presence into the EU (without having to bother paying too much tax); directly dealing with the American companies would be blatantly illegal. The main reason American companies are barred from processing personal information for European consumers is that Europeans don't have the necessary rights under American law to safeguard their data. Through an executive order and other political tools, this is being changed. Once that's done, there's no legal reason why the USA can't receive a competency decision from the EU. Various DPAs are sceptical about the work being done on the American side exactly because of the way this is implemented (executive rather than legislative branch) and the possibility that existing laws will make effective protection impossible anyway. I personally wouldn't trust the country behind the Hague Invasion Act to protect the rights of foreign citizens.

mdhb 4y ago

You mean they can go to the DOJ and ask for a subpoena and then go argue to a court that somehow that Google Analytics data is critical to national security and then and only then can they compel a company to hand it over. You seem to be very confused about how this process works in reality.

slackdog 4y ago
I don't see how anything you said contradicts anything punnerud said. What is punnerud supposedly confused about?
- mdhb 4y ago
  One has several layers of checks and balances in there from unrelated sections of government as a part of a legitimate function of any government in the world. The original post however implied that it was a sinister thing that could just be done on a whim which is objectively not at all how it works in reality.
  - slackdog 4y ago
    American checks and balances aren't relevant to the EU. The CLOUD Act requires that American companies turn over data stored in the EU without any involvement of EU due process and checks and balances, violating EU laws. The CLOUD Act effectively drafts all American companies into the American intelligence community. This is not acceptable to the EU. punnerud is not confused. Edit for response: > Which European countries aren’t able to compel a company to help them by providing data in a matter of national security? EU companies being so compelled by EU governments isn't relevant to the EU; which obviously supports that. > This idea that all American companies are somehow arm in arm with the USIC is a ridiculous notion that isn’t supported by facts. That is the purpose of the CLOUD Act. That's what it does. If Microsoft has a server in the EU with EU citizen data on it, the CLOUD Act requires Microsoft to hand over that data in violation of EU law if the US Government requests it. The fact that the US Government has checks and balances of its own is not relevant, the CLOUD Act still compels American companies operating in the EU to violate EU laws. > There is a reason why most American tech companies in particular make a point to repeatedly and very loudly proclaim [...] Their proclamations are irrelevant. US law requires them to violate EU law. As long as this is the case, the EU has no rational choice but to ban EU companies from giving EU data to American companies.
    - mdhb 4y ago
      Which European countries aren’t able to compel a company to help them by providing data in a matter of national security? This idea that all American companies are somehow arm in arm with the USIC is a ridiculous notion that isn’t supported by facts. There is a reason why most American tech companies in particular make a point to repeatedly and very loudly proclaim that they will not provide any assistance unless legally forced to do so with a subpoena. They understand that they have a global customer base and that outside the context of those checks and balances that it might be bad for business. In fact I would even argue that many of those same companies have a far stronger record of collaborating with China than the US. Apple is an example which repeatedly comes to mind here.
      - Tuna-Fish 4y ago
        You do not understand the issue. European countries can compel me to share data, and in that case I can do it legally. However, under the current law if I share data to the US government without going through the process in my local courts, I am liable for massive fines. This is even true if I am not the entity sharing the data, but I merely placed it in the care of an US company. The problem is not that American companies are arm in arm with the government, it's that they are incorporated in a jurisdiction where the US courts have power, and because of my local laws, I must consider those courts to be a hostile actor.
  - bryanrasmussen 4y ago
    Ok but is this >You mean they can go to the DOJ and ask for a subpoena and then go argue to a court that somehow like - how much more difficult is this than getting a warrant? I mean this doesn't make it seem very difficult https://lorr.com/how-to-subpoena-documents-examples-process/ https://lorr.com/how-to-subpoena-documents-examples-process/ It's not having a trial or anything to get the data, it is a judge (or in the link, a court clerk?) signing off on the subpoena or am I confused as to how complicated and difficult and time consuming that actually is. Because getting a warrant is in my experience not like something that takes months and months where people argue and there is a likelihood that even if the warrant is granted that you can appeal to have it overturned, and it seems like a subpoena is no more difficult than getting a warrant and maybe easier. At any rate, aside from the fact that the American government has often been shown to take more data than needed in their searches of people - that is to say abuse the layers of checks and balances - the European government would of course worry about potential abuses and disallow on the better safe than sorry view of protecting its citizens. on edit: slackdog made a more relevant point than I did anyway.

908B64B197 4y ago

...And Europeans governments can't via the European subsidiaries of American companies in Europe?

slackdog 4y ago
The CLOUD Act allows the US government to compel a company to turn over their data even if that data is only stored in servers in a foreign country, with no due process in that country. It requires American companies to violate EU law. The only way the EU can protect themselves from the CLOUD Act is to forbid any EU data be stored with any US company. Maybe you could accomplish that with a wholly EU subsidiary of an American company that is able to refuse and block requests for that data from their American parent corporation, but the CLOUD Act would still require the American company to hand over that data because the EU subsidiary is owned by the American company. The only rational response from the EU is to ban EU companies from storing EU data with American companies.
- abigail95 4y ago
  Please read the Schrems II case and the updated privacy protections being implemented literally right now.
  - punnerud 4y ago
    How can any protection be safe, as long as the US company have to comply? There is already a process now for Schrems III
  - jeroenhd 4y ago
    These protections aren't in place yet. They're not even finished at the moment. Until the time comes that the necessary protections are in place, one can assume American companies are off limits for the time being, as they have been for the past couple of years.
Tuna-Fish 4y ago
To be clear, this is not about morality, but about following EU privacy rules. As far as those rules go, I must consider US courts to be hostile actors, and any entity that would follow their rulings is a potential threat to me. I am liable if personal data pertaining to EU citizens is disseminated outside of the process set out in EU directives and local laws. This process does cover a local court compelling me or a local company to hand over something, and so in that case I will be in the clear. However, it does not cover the situation where I store my data on AWS and a non-EU court (US) compels Amazon to hand over the data, so in that case I will be liable for massive, potentially company-ending fines. People have still not adjusted their behavior to account for the changes in laws, but right now it is very inadvisable for any EU entity to store any personal data on any service provided by a non-EU entity.

tzs 4y ago

> The fundamental problem is that NSA, CIA, FBI.. can force American companies to hand over data (even if the data is saved in EU) How does this work when it goes the other way? Suppose a French company in Paris had some data and they stored that data in AWS in the us-east-1 region. A French police or intelligence agency gets a court order (or whatever is the French equivalent) asking the company to turn over a copy of that data. Can the company refuse (without getting in legal trouble) on the grounds that the data is not stored in France?

bboygravity 4y ago
This would work the other way around in practice (source: Snowden): the NSA would voluntarily give the data that the French want off of AWS in exchange for whatever data the NSA wants from within the French territory. The company wouldn't have to refuse anything, because they wouldn't even be aware that this is happening at all. All the company knows is that they host data on US servers. I mean this is what Snowden described many years ago, it's probably way worse, more legalized and even more automated now.
punnerud 4y ago
EU don’t have the same kind of laws that don’t obey other countries laws as I am familiar with. So a solution would also be to move headquarters for Microsoft, Apple, Meta… to EU So no, they would not get into trouble (if based in EU)
- tzs 4y ago
  > EU don’t have the same kind of laws that don’t obey other countries laws as I am familiar with No other country's laws would be involved in the scenario I asked about. It does not violate any US law for a company that has stored data in US AWS to retrieve that data. The French authorities would be asking the French company to give them a copy of data that the French company controls and has legal access to. All the French company has to do to comply is make an API request to AWS, something they presumably routinely do. If merely storing documents outside of your own country, but still within your control (in the sense that you can retrieve them any time you need them by asking whoever/whatever is holding them for you in the other country), is sufficient to make it so your own country can no longer legally compel you to turn over copies of those documents I don't see how that would not lead to massive problems for that country. Wouldn't every company making consumer products, for example, store all documents produced during design and testing outside the country so in case safety issues arise later investigators can't get those documents to help build a negligence case against the company?

jeroenhd 4y ago

That is the reason exporting PII to American cloud providers is illegal, yes. That's exactly what the EU is now trying to work out. This includes concessions to give European citizens certain rights when it comes to American intelligence agencies and such. That's part of the reason why companies use Irish subsidiaries to bring a point of presence into the EU (without having to bother paying too much tax); directly dealing with the American companies would be blatantly illegal. The main reason American companies are barred from processing personal information for European consumers is that Europeans don't have the necessary rights under American law to safeguard their data. Through an executive order and other political tools, this is being changed. Once that's done, there's no legal reason why the USA can't receive a competency decision from the EU. Various DPAs are sceptical about the work being done on the American side exactly because of the way this is implemented (executive rather than legislative branch) and the possibility that existing laws will make effective protection impossible anyway. I personally wouldn't trust the country behind the Hague Invasion Act to protect the rights of foreign citizens.