4 ms·

...And Europeans governments can't via the European subsidiaries of American companies in Europe?

slackdog 4y ago
The CLOUD Act allows the US government to compel a company to turn over their data even if that data is only stored in servers in a foreign country, with no due process in that country. It requires American companies to violate EU law. The only way the EU can protect themselves from the CLOUD Act is to forbid any EU data be stored with any US company. Maybe you could accomplish that with a wholly EU subsidiary of an American company that is able to refuse and block requests for that data from their American parent corporation, but the CLOUD Act would still require the American company to hand over that data because the EU subsidiary is owned by the American company. The only rational response from the EU is to ban EU companies from storing EU data with American companies.
- abigail95 4y ago
  Please read the Schrems II case and the updated privacy protections being implemented literally right now.
  - punnerud 4y ago
    How can any protection be safe, as long as the US company have to comply? There is already a process now for Schrems III
  - jeroenhd 4y ago
    These protections aren't in place yet. They're not even finished at the moment. Until the time comes that the necessary protections are in place, one can assume American companies are off limits for the time being, as they have been for the past couple of years.
Tuna-Fish 4y ago
To be clear, this is not about morality, but about following EU privacy rules. As far as those rules go, I must consider US courts to be hostile actors, and any entity that would follow their rulings is a potential threat to me. I am liable if personal data pertaining to EU citizens is disseminated outside of the process set out in EU directives and local laws. This process does cover a local court compelling me or a local company to hand over something, and so in that case I will be in the clear. However, it does not cover the situation where I store my data on AWS and a non-EU court (US) compels Amazon to hand over the data, so in that case I will be liable for massive, potentially company-ending fines. People have still not adjusted their behavior to account for the changes in laws, but right now it is very inadvisable for any EU entity to store any personal data on any service provided by a non-EU entity.
- abigail95 4y ago
  This is bad advice. Think about how many EU jurisdiction entities use AWS. You think none of them are compliant? That's ridiculous. Since you're the one with the claim - explain exactly which laws and treaties make it illegal to use AWS.
  - 7to2 4y ago
    Easy! Article 44 of the GPDR explicitly prohibits the transfer of private information outside the conditions of the regulation. The cloud act requires the transfer of the private information without consideration to anything but US laws. GP's advice is solid. Avoid US cloud services for handling any private data.
  - chopin 4y ago
    The CLOUD act makes this illegal.
    - 908B64B197 4y ago
      At this point, I'm pretty convinced these Europeans legislations are about being as vague as possible so that they can target pretty much any entity they (the state) doesn't like with fines and legal threats. It all works because the public are made to believe these are good because they seem to go after some boogeymen (the evil foreign tech companies and the United-States).

The CLOUD Act allows the US government to compel a company to turn over their data even if that data is only stored in servers in a foreign country, with no due process in that country. It requires American companies to violate EU law. The only way the EU can protect themselves from the CLOUD Act is to forbid any EU data be stored with any US company. Maybe you could accomplish that with a wholly EU subsidiary of an American company that is able to refuse and block requests for that data from their American parent corporation, but the CLOUD Act would still require the American company to hand over that data because the EU subsidiary is owned by the American company. The only rational response from the EU is to ban EU companies from storing EU data with American companies.

abigail95 4y ago
Please read the Schrems II case and the updated privacy protections being implemented literally right now.
- punnerud 4y ago
  How can any protection be safe, as long as the US company have to comply? There is already a process now for Schrems III
- jeroenhd 4y ago
  These protections aren't in place yet. They're not even finished at the moment. Until the time comes that the necessary protections are in place, one can assume American companies are off limits for the time being, as they have been for the past couple of years.

Tuna-Fish 4y ago

To be clear, this is not about morality, but about following EU privacy rules. As far as those rules go, I must consider US courts to be hostile actors, and any entity that would follow their rulings is a potential threat to me. I am liable if personal data pertaining to EU citizens is disseminated outside of the process set out in EU directives and local laws. This process does cover a local court compelling me or a local company to hand over something, and so in that case I will be in the clear. However, it does not cover the situation where I store my data on AWS and a non-EU court (US) compels Amazon to hand over the data, so in that case I will be liable for massive, potentially company-ending fines. People have still not adjusted their behavior to account for the changes in laws, but right now it is very inadvisable for any EU entity to store any personal data on any service provided by a non-EU entity.

abigail95 4y ago
This is bad advice. Think about how many EU jurisdiction entities use AWS. You think none of them are compliant? That's ridiculous. Since you're the one with the claim - explain exactly which laws and treaties make it illegal to use AWS.
- 7to2 4y ago
  Easy! Article 44 of the GPDR explicitly prohibits the transfer of private information outside the conditions of the regulation. The cloud act requires the transfer of the private information without consideration to anything but US laws. GP's advice is solid. Avoid US cloud services for handling any private data.
- chopin 4y ago
  The CLOUD act makes this illegal.
  - 908B64B197 4y ago
    At this point, I'm pretty convinced these Europeans legislations are about being as vague as possible so that they can target pretty much any entity they (the state) doesn't like with fines and legal threats. It all works because the public are made to believe these are good because they seem to go after some boogeymen (the evil foreign tech companies and the United-States).