3 ms·

To be clear, this is not about morality, but about following EU privacy rules. As far as those rules go, I must consider US courts to be hostile actors, and any

To be clear, this is not about morality, but about following EU privacy rules. As far as those rules go, I must consider US courts to be hostile actors, and any entity that would follow their rulings is a potential threat to me. I am liable if personal data pertaining to EU citizens is disseminated outside of the process set out in EU directives and local laws. This process does cover a local court compelling me or a local company to hand over something, and so in that case I will be in the clear. However, it does not cover the situation where I store my data on AWS and a non-EU court (US) compels Amazon to hand over the data, so in that case I will be liable for massive, potentially company-ending fines. People have still not adjusted their behavior to account for the changes in laws, but right now it is very inadvisable for any EU entity to store any personal data on any service provided by a non-EU entity.

abigail95 4y ago
This is bad advice. Think about how many EU jurisdiction entities use AWS. You think none of them are compliant? That's ridiculous. Since you're the one with the claim - explain exactly which laws and treaties make it illegal to use AWS.
- 7to2 4y ago
  Easy! Article 44 of the GPDR explicitly prohibits the transfer of private information outside the conditions of the regulation. The cloud act requires the transfer of the private information without consideration to anything but US laws. GP's advice is solid. Avoid US cloud services for handling any private data.
- chopin 4y ago
  The CLOUD act makes this illegal.
  - 908B64B197 4y ago
    At this point, I'm pretty convinced these Europeans legislations are about being as vague as possible so that they can target pretty much any entity they (the state) doesn't like with fines and legal threats. It all works because the public are made to believe these are good because they seem to go after some boogeymen (the evil foreign tech companies and the United-States).
    - jeroenhd 4y ago
      The United States have decided that they will not provide the same protections required by the EU when it comes to EU citizens' data. That's a choice the American government can and has made. The economic barrier is clearly worth the sovereignty and national security benefit of the government being able to demand data about foreigners without protections or recourse according to lawmakers and that's fair enough to me. The American CLOUD act grants certain agencies the right to demand data stored in European countries from American companies. This means American companies can either choose to comply with American law, providing said data, or with European law, refusing to provide the data without getting European courts involved. Refusing national security demands from the American government becomes very problematic real fast, especially when gag orders are involved, so companies and American citizens simply cannot be expected to comply with European law. This choice has the consequence that American companies cannot be trusted to process PII (which is very broad) in any legal sense. Whether or not those companies go evil doesn't matter, the problem lies with the legal protection implemented by the American government. I'd expect a CLOUD act equivalent from the EU (forcing companies with American offices to hand over the data of American citizens to secret European courts under the guise of national security) will be met with significant protest across the political spectrum. In fact, I would be disappointed if that wasn't protested. Surely Amazon, Microsoft and Google would be pressured to split off or shut down European operations if American citizens would suddenly become at risk of being spied on by foreign governments. If I were an American citizen, I'd certainly want politicians to do something about it!

abigail95 4y ago

This is bad advice. Think about how many EU jurisdiction entities use AWS. You think none of them are compliant? That's ridiculous. Since you're the one with the claim - explain exactly which laws and treaties make it illegal to use AWS.

7to2 4y ago
Easy! Article 44 of the GPDR explicitly prohibits the transfer of private information outside the conditions of the regulation. The cloud act requires the transfer of the private information without consideration to anything but US laws. GP's advice is solid. Avoid US cloud services for handling any private data.
chopin 4y ago
The CLOUD act makes this illegal.
- 908B64B197 4y ago
  At this point, I'm pretty convinced these Europeans legislations are about being as vague as possible so that they can target pretty much any entity they (the state) doesn't like with fines and legal threats. It all works because the public are made to believe these are good because they seem to go after some boogeymen (the evil foreign tech companies and the United-States).
  - jeroenhd 4y ago
    The United States have decided that they will not provide the same protections required by the EU when it comes to EU citizens' data. That's a choice the American government can and has made. The economic barrier is clearly worth the sovereignty and national security benefit of the government being able to demand data about foreigners without protections or recourse according to lawmakers and that's fair enough to me. The American CLOUD act grants certain agencies the right to demand data stored in European countries from American companies. This means American companies can either choose to comply with American law, providing said data, or with European law, refusing to provide the data without getting European courts involved. Refusing national security demands from the American government becomes very problematic real fast, especially when gag orders are involved, so companies and American citizens simply cannot be expected to comply with European law. This choice has the consequence that American companies cannot be trusted to process PII (which is very broad) in any legal sense. Whether or not those companies go evil doesn't matter, the problem lies with the legal protection implemented by the American government. I'd expect a CLOUD act equivalent from the EU (forcing companies with American offices to hand over the data of American citizens to secret European courts under the guise of national security) will be met with significant protest across the political spectrum. In fact, I would be disappointed if that wasn't protested. Surely Amazon, Microsoft and Google would be pressured to split off or shut down European operations if American citizens would suddenly become at risk of being spied on by foreign governments. If I were an American citizen, I'd certainly want politicians to do something about it!