4 ms·

This is pretty significant, because in Germany many corporations do require their data being hosted on German soil and protected under German consumer protectio

This is pretty significant, because in Germany many corporations do require their data being hosted on German soil and protected under German consumer protection laws. As a result the Cloud provider market is currently split into three categories: German corporations (e.g. Telekom) promoting themselves as truly compliant, US corporations with German hosting (Microsoft and Oracle) that self-promote themselves as compliant and US corporations such as AWS and Google that are aggressively attacked by German Cloud providers as violating German consumer protection law. In the past I personally have lost customers in Germany because my services use App-engine and CloudSQL in Ireland. Thus, I hope Google follows with a German server for their cloud services.

_delirium 12y ago
I can see in-EU vs. out-of-EU making a legal distinction, but how is it possible for German consumer protection law to require servers actually in Germany, vs. say in Ireland or Denmark? That seems like it would violate EU treaties on freedom of trade and services within the common market, which usually prohibits both direct and indirect restrictions (e.g. Denmark can't ban EU food imports by imposing unique food-safety requirements). Or is that just a marketing position (people prefer German servers) rather than an actual legal position?
- julianpye 12y ago
  Basically Germany has their own set of consumer protection laws (Bundesdatenschutzgesetz) that are more stringent than the EU laws. There is an ongoing struggle if these laws should be regulated at EU level or at national level since some countries vastly differ in their attitudes in this space and common ground is difficult to establish. In my personal experience the 'requirement' of some companies that data must be hosted in Germany is their own internal policy rather than something that is prescribed by their reading of the law. However there have been some court rulings where servers hosted in Germany are applied additional restrictions over servers hosted in Ireland. A lot of this may also have to do with own interests. In the 80s and 90s every EU country wanted US silicon fabs in their underdeveloped regions. Now every country wants hosting farms.
  - rmc 12y ago
    There is an ongoing struggle if these laws should be regulated at EU level or at national level since some countries vastly differ in their attitudes in this space and common ground is difficult to establish. Oh dear god let it be at the EU level. The only way small EU countries full of semi-corrupt conservatives get decent consumer protection law is when it's an EU law.
    - ecesena 12y ago
      As far as I know it is already an EU law and, as with the vast majority of EU laws, each member state can decide to override with additional restrictions (usually under some limitations). In this specific case, I think Germany is the only exception, but to me it makes perfectly sense: sensitive personal data like medical records should not circulate outside the country. Even at EU level, how could Germany as a nation guarantee privacy if data is physically maintained in Ireland, where most of the US companies have offices just because of cheaper taxation...? As a country I would't promise that, and as a citizen I wouldn't trust such a promise (side note, I'm Italian so I have no gain/part into this).
      - gioele 12y ago
        > In this specific case, I think Germany is the only exception, but to me it makes perfectly sense: sensitive personal data like medical records should not circulate outside the country. Having a computer on German soil does not mean that 1) the packets themselves will not travel outside Germany (hint: AMS-IX); 2) people interested in the data contained in that computer will not read it, store it, use it outside Germany. From the technology point of view, country borders do not exist. (Unless you force a country-wide firewall). If sensitive data must be properly encrypted. Once it is encrypted you can store it everywhere you want.
        ecesena 12y ago
        I see your point, but the reality is different. Data stored is not data in transit. Both must be protected, but the attacker models are different. Unfortunately real-world (meaning, not theoretical) encryption is not perfect, thus the sole fact to encrypt is not sufficient to let you store any data wherever you want. At least not in Germany, and at least not from my pov. To remain in topic with this specific law, data in transit can exit Germany soil, provided that the recipient gives guarantees on its usage (including not store it). This kind of laws should be seen to regulate sensitive (user) data as managed by (big, multinational) organizations, that are thus required to enforce security for both stored and in transit data. I understand that this may seem silly, but without such laws the landscape would be way worse (consider, e.g., how many personal data are actually traded across the world for ads reasons).
- moby_click 12y ago
  IANAL, but last time I looked, german data protection law regarded the level offered by other states within the european economic area as adequate.
fidotron 12y ago
Indeed - although the Microsoft vs US gov nonsense regarding Ireland is really the US gov taking their own cloud businesses out and shooting them, because it makes no difference where the data is if the operating company is HQed in the US. That said, I wouldn't be so naive as to trust any government not to be attacking cloud providers, but it's important for companies making decisions to understand the jurisdictions their data will end up being regulated by.
- thrownaway2424 12y ago
  You'd also have to be pretty naive to think that the german intelligence apparatus isn't out there actively attacking and subverting cloud datacenters. Google formerly operated datacenters in Munich, Frankfurt, and Berlin, but they're all shut now. http://www.quora.com/How-many-data-centers-does-Google-have http://www.quora.com/How-many-data-centers-does-Google-have http://www.datacenterknowledge.com/archives/2012/05/15/google-data-center-faq/ http://www.datacenterknowledge.com/archives/2012/05/15/googl...
higherpurpose 12y ago
Hmm...what about this then? http://www.theguardian.com/technology/2014/sep/03/microsoft-contempty-court-judge-data-dispute http://www.theguardian.com/technology/2014/sep/03/microsoft-...
greglindahl 12y ago
In Germany, the individual states have different privacy laws, which are often stricter than the EU minimum. I'm looking forward to AWS being forced to open a datacenter in every German state.
- j_jochem 12y ago
  The Bundesdatenschutzgesetz (federal privacy law) is, as the name says, federal law. I have not heard of states imposing their own data privacy laws on businesses. It may however be true that the administrations of each state have slightly differing privacy requirements for their own systems.
  - greglindahl 12y ago
    My lawyer told me that individual German states have individual privacy laws. This was in reference to my company and the user data of German citizens.
  - queeerkopf 12y ago
    The german states have their own different data privacy laws, e.g. see http://byds.juris.de/byds/009_1.1_DSG_BY_1993_rahmen.html http://byds.juris.de/byds/009_1.1_DSG_BY_1993_rahmen.html for Bavaria. Those regulate how personal data has to be handled within the state and communal administrations. Those regulations concern private businesses in so far as administrative tasks are delegated to the corporate sector.
walshemj 12y ago
how does that work with eu trade free trade directives seems an out and out illegal protectionist measure
dvdkhlng 12y ago
Just putting the data on german soil does not seem to help at all, as long as these data are accessible to Amazon personnel located in the US. See this case about data located on Irish servers for example: http://www.theinquirer.net/inquirer/news/2349550/microsoft-hits-back-at-us-government-request-for-customer-data-held-in-ireland http://www.theinquirer.net/inquirer/news/2349550/microsoft-h...

_delirium 12y ago

I can see in-EU vs. out-of-EU making a legal distinction, but how is it possible for German consumer protection law to require servers actually in Germany, vs. say in Ireland or Denmark? That seems like it would violate EU treaties on freedom of trade and services within the common market, which usually prohibits both direct and indirect restrictions (e.g. Denmark can't ban EU food imports by imposing unique food-safety requirements). Or is that just a marketing position (people prefer German servers) rather than an actual legal position?

julianpye 12y ago
Basically Germany has their own set of consumer protection laws (Bundesdatenschutzgesetz) that are more stringent than the EU laws. There is an ongoing struggle if these laws should be regulated at EU level or at national level since some countries vastly differ in their attitudes in this space and common ground is difficult to establish. In my personal experience the 'requirement' of some companies that data must be hosted in Germany is their own internal policy rather than something that is prescribed by their reading of the law. However there have been some court rulings where servers hosted in Germany are applied additional restrictions over servers hosted in Ireland. A lot of this may also have to do with own interests. In the 80s and 90s every EU country wanted US silicon fabs in their underdeveloped regions. Now every country wants hosting farms.
- rmc 12y ago
  There is an ongoing struggle if these laws should be regulated at EU level or at national level since some countries vastly differ in their attitudes in this space and common ground is difficult to establish. Oh dear god let it be at the EU level. The only way small EU countries full of semi-corrupt conservatives get decent consumer protection law is when it's an EU law.
  - ecesena 12y ago
    As far as I know it is already an EU law and, as with the vast majority of EU laws, each member state can decide to override with additional restrictions (usually under some limitations). In this specific case, I think Germany is the only exception, but to me it makes perfectly sense: sensitive personal data like medical records should not circulate outside the country. Even at EU level, how could Germany as a nation guarantee privacy if data is physically maintained in Ireland, where most of the US companies have offices just because of cheaper taxation...? As a country I would't promise that, and as a citizen I wouldn't trust such a promise (side note, I'm Italian so I have no gain/part into this).
    - gioele 12y ago
      > In this specific case, I think Germany is the only exception, but to me it makes perfectly sense: sensitive personal data like medical records should not circulate outside the country. Having a computer on German soil does not mean that 1) the packets themselves will not travel outside Germany (hint: AMS-IX); 2) people interested in the data contained in that computer will not read it, store it, use it outside Germany. From the technology point of view, country borders do not exist. (Unless you force a country-wide firewall). If sensitive data must be properly encrypted. Once it is encrypted you can store it everywhere you want.
      - ecesena 12y ago
        I see your point, but the reality is different. Data stored is not data in transit. Both must be protected, but the attacker models are different. Unfortunately real-world (meaning, not theoretical) encryption is not perfect, thus the sole fact to encrypt is not sufficient to let you store any data wherever you want. At least not in Germany, and at least not from my pov. To remain in topic with this specific law, data in transit can exit Germany soil, provided that the recipient gives guarantees on its usage (including not store it). This kind of laws should be seen to regulate sensitive (user) data as managed by (big, multinational) organizations, that are thus required to enforce security for both stored and in transit data. I understand that this may seem silly, but without such laws the landscape would be way worse (consider, e.g., how many personal data are actually traded across the world for ads reasons).
moby_click 12y ago
IANAL, but last time I looked, german data protection law regarded the level offered by other states within the european economic area as adequate.

fidotron 12y ago

Indeed - although the Microsoft vs US gov nonsense regarding Ireland is really the US gov taking their own cloud businesses out and shooting them, because it makes no difference where the data is if the operating company is HQed in the US. That said, I wouldn't be so naive as to trust any government not to be attacking cloud providers, but it's important for companies making decisions to understand the jurisdictions their data will end up being regulated by.

thrownaway2424 12y ago
You'd also have to be pretty naive to think that the german intelligence apparatus isn't out there actively attacking and subverting cloud datacenters. Google formerly operated datacenters in Munich, Frankfurt, and Berlin, but they're all shut now. http://www.quora.com/How-many-data-centers-does-Google-have http://www.quora.com/How-many-data-centers-does-Google-have http://www.datacenterknowledge.com/archives/2012/05/15/google-data-center-faq/ http://www.datacenterknowledge.com/archives/2012/05/15/googl...

higherpurpose 12y ago

Hmm...what about this then? http://www.theguardian.com/technology/2014/sep/03/microsoft-contempty-court-judge-data-dispute http://www.theguardian.com/technology/2014/sep/03/microsoft-...

greglindahl 12y ago

In Germany, the individual states have different privacy laws, which are often stricter than the EU minimum. I'm looking forward to AWS being forced to open a datacenter in every German state.

j_jochem 12y ago
The Bundesdatenschutzgesetz (federal privacy law) is, as the name says, federal law. I have not heard of states imposing their own data privacy laws on businesses. It may however be true that the administrations of each state have slightly differing privacy requirements for their own systems.
- greglindahl 12y ago
  My lawyer told me that individual German states have individual privacy laws. This was in reference to my company and the user data of German citizens.
- queeerkopf 12y ago
  The german states have their own different data privacy laws, e.g. see http://byds.juris.de/byds/009_1.1_DSG_BY_1993_rahmen.html http://byds.juris.de/byds/009_1.1_DSG_BY_1993_rahmen.html for Bavaria. Those regulate how personal data has to be handled within the state and communal administrations. Those regulations concern private businesses in so far as administrative tasks are delegated to the corporate sector.

walshemj 12y ago

how does that work with eu trade free trade directives seems an out and out illegal protectionist measure

dvdkhlng 12y ago

Just putting the data on german soil does not seem to help at all, as long as these data are accessible to Amazon personnel located in the US. See this case about data located on Irish servers for example: http://www.theinquirer.net/inquirer/news/2349550/microsoft-hits-back-at-us-government-request-for-customer-data-held-in-ireland http://www.theinquirer.net/inquirer/news/2349550/microsoft-h...