7 ms·
The US CLOUD Act means a EU customer cannot use a US cloud provider to host PII, even if the server itself is physically in the EU, because US law will still co
by fmajid 4y ago
The US CLOUD Act means a EU customer cannot use a US cloud provider to host PII, even if the server itself is physically in the EU, because US law will still compel the provider to yield the data to US authorities. The European Commission is trying to paper over the cracks with a fig leaf of judicial review, but it's only a matter of time until a Schrems III decision from the CJEU invalidates that polite fiction.
- LunaSea 4y agoThe amount of EU companies following this law is exactly 0.
- deleted 4y ago[deleted]
- exac 4y agoI know I've personally spent a large portion of my time updating systems to be compliant in the last few years, in North American companies.
- mro_name 4y agomight well have been yak shaving. If a company is under US jurisdiction it simply cannot comply to EU data protection.
- deleted 4y ago[deleted]
- mananaysiempre 4y ago... Are those North American companies prepared to willingly break EU laws then? Because in my (amateur) understanding it’s logically impossible to satisfy both CLOUD Act requirements and EU data protection ones (not just GDPR, but general due-process rights the CJEU considers required for privacy violations and US courts deny noncitizens).
- mike_d 4y agoYes. Whenever a US law and a foreign law conflict, the US law always wins when you are in the United States. Complying with US laws is also a perfectly valid defense if a European citizen or state ends up bringing action against you in a US court.
- LunaSea 4y agoEuropean states simply sue in their own territory or in front of the European Union Court of Justice.
- mike_d 4y agoYup. Which is basically a no-op. You need a court having jurisdiction over the defendant to have any relief. Even if you receive a financial judgement, international law does not put much weight in absentia cases.
- LunaSea 4y agoIf you have customers in the EU than the court has jurisdiction. If the company doesn't comply, fines will be directly taken from customer payments for example.
- mike_d 4y agoAgain - regardless of if a domestic court believes they have jurisdiction, any court case not brought in the venue of the defendant is effectively meaningless as you cannot be granted meaningful relief. If the destination bank account is outside the EU, they can't touch it without cooperation from the defendant countries courts - which requires you to file in the defendants venue. If an EU country unilaterally seized intra-bank remittance they would be cut off from the international banking system without hesitation. You seem to really be grasping at straws here, but the EU is not some all powerful entity that can enforce its laws outside its jurisdiction.
- speedgoose 4y agoIt’s not true. I know people who lost contracts because they were using Azure and the customer wanted to respect the law.
- LunaSea 4y agoI've talked with companies like that as well and they start with strict rules and end up allowing clouds because no solution is compliant anyway.
- speedgoose 4y agoI guess it works when you don't have any compliant competitor.
- LunaSea 4y agoThat is exactly the problem at hand. It's a combination of low to no enforcement, competitivity-killing laws and unrealistic efforts for said companies to take on.
- fmajid 4y agoHetzner or OVH would be compliant.
- LunaSea 4y agoThey are however far from service parity with AWS, Azure and GCP. I can't speak for Hetzner but OVH has also availability issues.
- di4na 4y agoYep. The real question is how long until we get one. Scaleway seems to go in the right direction but still a bit of work needed
- pjmlp 4y agoI can attest that there are a lot more than zero in Germany.
- LunaSea 4y agoI would be glad to be shown a company with AWS, Google Chrome, Google Search, Slack and all the usual suspects.
- huijzer 4y agoPlease tell the legal department of our uni. I’m stuck with a home-made Kubernetes cluster where I have to mail the admins for provisioning, SSL and domain management. Would love to switch to Fly or Render
- e12e 4y agoThis simply isn't true. At least not for EEC(Norway).
- LunaSea 4y agoI have never seen a company without Google Search, Google Chrome, AWS, Microsoft 360 and the lot. Which alternatives are they based on?
- fcantournet 4y agoThose would not contain PII from your users though, unless you have terrible policies about copying personal information in random Google Docs.
- xorcist 4y agoDefense and government is a huge sector. You can live very well off it. They are not going to skimp on the rules. A large part of banking won't, either.
- wbl 4y agoYou're assuming that the US doesn't respond to political pressure and come up with an agreement with the EC to enable the flows. The wiretap act already goes beyond the fourth amendment in protection.
- fmajid 4y agoThe problem is the European Commission is not applying political pressure because it rolls over for every fig leaf the US offers. It then takes Max Schrems to sue and several years before the CJEU overturns the "compromise". That said, the Biden administration's latest proposal might pass muster if the proposed redress mechanism were truly independent as part of the Judicial Branch of the United States as opposed to the current proposal which is still part of the Executive and thus conflicted in ruling against surveillance decisions of the Executive Branch and its agencies: https://www.whitehouse.gov/briefing-room/statements-releases/2022/03/25/fact-sheet-united-states-and-european-commission-announce-trans-atlantic-data-privacy-framework/ https://www.whitehouse.gov/briefing-room/statements-releases... https://noyb.eu/en/open-letter-future-eu-us-data-transfers https://noyb.eu/en/open-letter-future-eu-us-data-transfers That said, even US citizens don't enjoy meaningful protection against warrantless wiretapping that clearly violates the Fourth Amendment due to the deference the judiciary has given to the executive, so I am not optimistic.
- ec109685 4y agoAssuming best practices are followed, AWS would have have to crack into multiple systems to offer up data for EU residents from AWS machines in the EU. Is there any record of them being required to do so?
- alex_sf 4y agoNot exactly related to the OP, but: I think I speak for a large number of folks when I say that we don't care. The EU keeps passing all sorts of absurd laws that require dedicated auditors to comply with. It's just not going to happen. If they decide to actively enforce these things, they'll just isolate themselves from the rest of the world.
- ricardobeat 4y agoAs an EEUU resident, we also don't care. We can survive without youtube and instagram and the whole surveillance industry. Some of the laws place a heavy burden on giant tech companies, but for good reason.
- alex_sf 4y agoThey place a burden on everyone. A burden that's going to create a two-tier internet where service is immediately refused to EU citizens by every provider except the giant tech companies that can afford to comply.
- Timon3 4y agoWhy exactly is it seemingly so expensive not to sell your customer data?
- alex_sf 4y agoThat's not the issue. I don't want to see personal data sold either. It's all the little rules. There are hundreds of pages just in GDPR. You need a banner and explicit opt-in just to support login/logout functionality.
- Timon3 4y agoCan you explain why you believe this to be the case? Let's say you log the user in. Yes, you need consent to store a login cookie, but that doesn't mean you need "a banner and explicit opt-in". You only need explicit opt-in, which you can do by... putting a "remember me" box next to your login form[1]. Is that really so hard? [1] https://law.stackexchange.com/a/32157 https://law.stackexchange.com/a/32157
- o_m 4y agoI got burned by this. I spent a lot of time researching and planning for this, only to discover there is no demand for solving this problem (yet?).
- PeterisP 4y agoI haven't put much thought in this, but is a Frankfurt data center provided by Amazon Web Services EMEA SARL (a Luxembourg-based company) considered a US cloud provider or a EU one? I mean, being wholly owned by a foreign owner doesn't generally change your jurisdiction, and employees of that wholly owned subsidiary (including its directors) are not required to obey USA laws or court orders but are required to comply with EU legislation.
- KSteffensen 4y agoMy understanding is that the distinction hinges on whether the data is available to a US based employee. Can the NSA show up at a US address and tell the people there to hand over the data? Can this data transfer happen without an EU based person taking some action? If the answer to both questions is yes, the data handling is not compliant. Of course, IANAL, do your own research, etc.