6 ms·

Basically Germany has their own set of consumer protection laws (Bundesdatenschutzgesetz) that are more stringent than the EU laws. There is an ongoing struggle

Basically Germany has their own set of consumer protection laws (Bundesdatenschutzgesetz) that are more stringent than the EU laws. There is an ongoing struggle if these laws should be regulated at EU level or at national level since some countries vastly differ in their attitudes in this space and common ground is difficult to establish. In my personal experience the 'requirement' of some companies that data must be hosted in Germany is their own internal policy rather than something that is prescribed by their reading of the law. However there have been some court rulings where servers hosted in Germany are applied additional restrictions over servers hosted in Ireland. A lot of this may also have to do with own interests. In the 80s and 90s every EU country wanted US silicon fabs in their underdeveloped regions. Now every country wants hosting farms.

rmc 12y ago
There is an ongoing struggle if these laws should be regulated at EU level or at national level since some countries vastly differ in their attitudes in this space and common ground is difficult to establish. Oh dear god let it be at the EU level. The only way small EU countries full of semi-corrupt conservatives get decent consumer protection law is when it's an EU law.
- ecesena 12y ago
  As far as I know it is already an EU law and, as with the vast majority of EU laws, each member state can decide to override with additional restrictions (usually under some limitations). In this specific case, I think Germany is the only exception, but to me it makes perfectly sense: sensitive personal data like medical records should not circulate outside the country. Even at EU level, how could Germany as a nation guarantee privacy if data is physically maintained in Ireland, where most of the US companies have offices just because of cheaper taxation...? As a country I would't promise that, and as a citizen I wouldn't trust such a promise (side note, I'm Italian so I have no gain/part into this).
  - gioele 12y ago
    > In this specific case, I think Germany is the only exception, but to me it makes perfectly sense: sensitive personal data like medical records should not circulate outside the country. Having a computer on German soil does not mean that 1) the packets themselves will not travel outside Germany (hint: AMS-IX); 2) people interested in the data contained in that computer will not read it, store it, use it outside Germany. From the technology point of view, country borders do not exist. (Unless you force a country-wide firewall). If sensitive data must be properly encrypted. Once it is encrypted you can store it everywhere you want.
    - ecesena 12y ago
      I see your point, but the reality is different. Data stored is not data in transit. Both must be protected, but the attacker models are different. Unfortunately real-world (meaning, not theoretical) encryption is not perfect, thus the sole fact to encrypt is not sufficient to let you store any data wherever you want. At least not in Germany, and at least not from my pov. To remain in topic with this specific law, data in transit can exit Germany soil, provided that the recipient gives guarantees on its usage (including not store it). This kind of laws should be seen to regulate sensitive (user) data as managed by (big, multinational) organizations, that are thus required to enforce security for both stored and in transit data. I understand that this may seem silly, but without such laws the landscape would be way worse (consider, e.g., how many personal data are actually traded across the world for ads reasons).
    - tw04 12y ago
      That's not the point. The point is, how is the US government going to bring a case against a German company based on data they illegally intercepted sniffing traffic? If the data were on US soil, they could simply seize the computers once they knew there was offending data on them, and claim it was through an "anonymous tip" that they caught wind of the illegal activity. If the data is on German soil, they can pound sand.
  - rmc 12y ago
    As far as I know it is already an EU law and, as with the vast majority of EU laws, each member state can decide to override with additional restrictions (usually under some limitations). Yes, but they usually have minimums. Like "Employees must get at least X weeks paid holiday", or "Customers must have a right to return something within at least X days". In countries where X was 0, or there was lots of exceptions, a minimum brings those laws forward.
- mkohlmyr 12y ago
  Speaking as someone who grew up in Sweden I have a hard time believing the EU government is "less corrupt" than ours. Removing the ability to legislate (on anything) effectively forces every country to a lowest common denominator (that can be voted through) of legislation. Then again I tend to be biased against centralisation of power so maybe don't listen to me when it comes to the EU.
  - freshflowers 12y ago
    Not a big fan of the EU or centralisation either, but when it comes to matters of privacy and standing up to US interests, I'll take the EU over Sweden's recent track record.
  - morsch 12y ago
    When it's just about minimum standards, nothing's stopping your legislative to vote for stricter policies -- right? Although I'm often worried that national legislators will point to implementations of the EU minimum standard as being enough and/or more stricter laws being a competitive hindrance.
- bdunbar 12y ago
  > small EU countries full of semi-corrupt conservatives Which ones would those be? From an American perspective, they all look like they're full of semi-corrupt liberals ..
  - javra 12y ago
    > they all look like they're full of semi-corrupt liberals What? Sweden and Finland and the Baltic states?
    - bdunbar 12y ago
      That was my question to OP.
  - chrisdevereux 12y ago
    Despite what Fox News may have told you, "Europe" is not coextensive with "France"
    - bdunbar 12y ago
      I watch Fox News more often than CNN. Which is 'never'. But good try with the stereotyping and the assuming.
- vidarh 12y ago
  I'm in the UK, and the only thing holding both the Conservatives and Labour back from using 1984 as a manual is the EU (the Lib Dems may act as a little bit of a brake, but realistically they'll get gutted in the next election)... The prospect of the UK leaving the EU terrifies me.

rmc 12y ago

There is an ongoing struggle if these laws should be regulated at EU level or at national level since some countries vastly differ in their attitudes in this space and common ground is difficult to establish. Oh dear god let it be at the EU level. The only way small EU countries full of semi-corrupt conservatives get decent consumer protection law is when it's an EU law.

ecesena 12y ago
As far as I know it is already an EU law and, as with the vast majority of EU laws, each member state can decide to override with additional restrictions (usually under some limitations). In this specific case, I think Germany is the only exception, but to me it makes perfectly sense: sensitive personal data like medical records should not circulate outside the country. Even at EU level, how could Germany as a nation guarantee privacy if data is physically maintained in Ireland, where most of the US companies have offices just because of cheaper taxation...? As a country I would't promise that, and as a citizen I wouldn't trust such a promise (side note, I'm Italian so I have no gain/part into this).
- gioele 12y ago
  > In this specific case, I think Germany is the only exception, but to me it makes perfectly sense: sensitive personal data like medical records should not circulate outside the country. Having a computer on German soil does not mean that 1) the packets themselves will not travel outside Germany (hint: AMS-IX); 2) people interested in the data contained in that computer will not read it, store it, use it outside Germany. From the technology point of view, country borders do not exist. (Unless you force a country-wide firewall). If sensitive data must be properly encrypted. Once it is encrypted you can store it everywhere you want.
  - ecesena 12y ago
    I see your point, but the reality is different. Data stored is not data in transit. Both must be protected, but the attacker models are different. Unfortunately real-world (meaning, not theoretical) encryption is not perfect, thus the sole fact to encrypt is not sufficient to let you store any data wherever you want. At least not in Germany, and at least not from my pov. To remain in topic with this specific law, data in transit can exit Germany soil, provided that the recipient gives guarantees on its usage (including not store it). This kind of laws should be seen to regulate sensitive (user) data as managed by (big, multinational) organizations, that are thus required to enforce security for both stored and in transit data. I understand that this may seem silly, but without such laws the landscape would be way worse (consider, e.g., how many personal data are actually traded across the world for ads reasons).
  - tw04 12y ago
    That's not the point. The point is, how is the US government going to bring a case against a German company based on data they illegally intercepted sniffing traffic? If the data were on US soil, they could simply seize the computers once they knew there was offending data on them, and claim it was through an "anonymous tip" that they caught wind of the illegal activity. If the data is on German soil, they can pound sand.
- rmc 12y ago
  As far as I know it is already an EU law and, as with the vast majority of EU laws, each member state can decide to override with additional restrictions (usually under some limitations). Yes, but they usually have minimums. Like "Employees must get at least X weeks paid holiday", or "Customers must have a right to return something within at least X days". In countries where X was 0, or there was lots of exceptions, a minimum brings those laws forward.
mkohlmyr 12y ago
Speaking as someone who grew up in Sweden I have a hard time believing the EU government is "less corrupt" than ours. Removing the ability to legislate (on anything) effectively forces every country to a lowest common denominator (that can be voted through) of legislation. Then again I tend to be biased against centralisation of power so maybe don't listen to me when it comes to the EU.
- freshflowers 12y ago
  Not a big fan of the EU or centralisation either, but when it comes to matters of privacy and standing up to US interests, I'll take the EU over Sweden's recent track record.
- morsch 12y ago
  When it's just about minimum standards, nothing's stopping your legislative to vote for stricter policies -- right? Although I'm often worried that national legislators will point to implementations of the EU minimum standard as being enough and/or more stricter laws being a competitive hindrance.
bdunbar 12y ago
> small EU countries full of semi-corrupt conservatives Which ones would those be? From an American perspective, they all look like they're full of semi-corrupt liberals ..
- javra 12y ago
  > they all look like they're full of semi-corrupt liberals What? Sweden and Finland and the Baltic states?
  - bdunbar 12y ago
    That was my question to OP.
- chrisdevereux 12y ago
  Despite what Fox News may have told you, "Europe" is not coextensive with "France"
  - bdunbar 12y ago
    I watch Fox News more often than CNN. Which is 'never'. But good try with the stereotyping and the assuming.
vidarh 12y ago
I'm in the UK, and the only thing holding both the Conservatives and Labour back from using 1984 as a manual is the EU (the Lib Dems may act as a little bit of a brake, but realistically they'll get gutted in the next election)... The prospect of the UK leaving the EU terrifies me.