Hacker News Reader

Comment by jackgavigan | Hacker News Reader

> Microsoft said federal officials would have to get an order from an Irish court, because the emails were stored on servers in Dublin.

The feds are being hoisted on their own petard somewhat here, having long argued that a foreign person's data held on a US server is subject to US jurisdiction. The logical corrollary to that argument is that data held on an Irish server is subject to Irish jurisdiction.

It is standard practise for companies in Europe (e.g. the bank I'm consulting for right now) to ensure that, when they subscribe to cloud services, their data is held stored and processed in datacentres within the EU, so that it is subject to EU legislation and, hence, the EU's data protection laws.

View on HN

> It is standard practise for companies in Europe (e.g. the bank I'm consulting for right now) to ensure that, when they subscribe to cloud services, their data is held stored and processed in datacentres within the EU, so that it is subject to EU legislation and, hence, the EU's data protection laws.

Absolutely. EU Data Protection Laws are so enshrined, I would argue that they are part of the culture. In the UK it's part of the educational syllabus to learn about the Data Protection Act.

If American companies cannot adhere to the act, companies will walk away from those services. I see a lucrative market opening up for "private clouds" whereby the requirement is, is the data "safe" is it vulnerable to American jurisdiction?

Is there a business opportunity here to brag about 100% none American? I don't see that being conducive to a free, open, global economy. Least of all between two of the largest economies.

There is rule-of-law in the EU and warrants do get issued and executed. The rabid pursuit of this by the US can only be counter productive in my mind. For everyone.

Health services moving to digital working pay money to have software and services that respect privacy and that don't send data everywhere.

Oh come on. As if governments all over the EU weren't monitoring their people as best they can, just like the US does.

In theory, they might bicker a bit behind the scenes over who gets access to what data etc, but it's also in their self-interest to co-operate in their spying activities.

It's all about maintaining their rule over the masses, after all, and that's a goal they all share.

Absolutely.

And I'd like to strengthen the point you made even further. It's not just standard practice alone - it's the law. For example, from principle 8 of the data protection act:

Personal data shall not be transferred to a country or territory outside the European Economic Area unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.

In my experience (with retail and banks), this means either hosting the data in a place where the law is the same (the EEA or acceptable countries), putting data under contract (EU Model contract), or using an acceptable scheme (such as US safe harbour).

At the moment, companies get around it as you said, by putting into the contract that the hosting has to be in the EU. However, if the US government win this court case, a lot of UK businesses will legally have to reconsider their use of US cloud companies at all.

How does this work for data that has nothing to do with people in the EU?

For instance, suppose I only have US customers, and I have my data primarily in Amazon's cloud in the US West region. I want to have a backup someplace far away from US West.

Does the data protection act mean that I cannot use EU Ireland or EU Frankfurt for my backup, because if I ever had to restore from that backup I would be transferring it to a country or territory outside the EEA that does not ensure adequate protection?

> The feds are being hoisted on their own petard somewhat here, having long argued that a foreign person's data held on a US server is subject to US jurisdiction. The logical corrollary to that argument is that data held on an Irish server is subject to Irish jurisdiction.

Things can be subject to multiple jurisdictions simultaneously. That's one of the things that makes international commerce interesting.

While I would like to see the outcome as you describe it (both US business and government could use a splash of cold water from the EU data protection laws), I'm not so sure that's how it will play out. A common fallacy is to assume that the law and its implementation by government is logical, when in reality is full of contradictions, often on purpose.

The US has been throwing its weight around for a while now, so it wouldn't surprise me if it demands "special" treatment, even when it contradicts its past arguments. Without more evidence, I wouldn't rule out any possible outcome.

This whole revival of the Crypto Wars smells strange.

Reply on news.ycombinator.com