Hacker News Reader

Comment by sveme | Hacker News Reader

This should be of interest to all American startups: if the court agrees with this assessment, you will have to store European user data on European servers and cannot transfer these to the US. Probably not even for data analysis. AWS and others will likely set up something quickly, but you'll still have to keep that in mind when trying to establish a presence in the EU.

So ultimately the NSA will have broken up the internet into separate regional entities.

Disclaimer: Not a lawyer, never wanted to be one.

View on HN

It's not just that, EU startups who currently depend on US-based services are going to be in quite a bit of trouble unless they got consent from their users to put their data in the US.

Many people in Europe warned about this before. It's not like it was unannounced.

They warned about cookie alerts as well but now we got "this site uses cookies" everywhere

And the alerts are naturally extra annoying if you don't actually use cookies, since the acceptance status isn't saved and you'll see the warning again and again.

And the law doesn’t even mandate popups like they are used – the law was intended to avoid sites using cookies for tracking. Not for personal settings.

As a user, that sounds pretty awesome. Of course in practice it will probably mean that they will throw this in the "privacy" policy, where they also enumerate all the ways in which they can track you and share your information.

"By the way, we're also sending this data to US government-accessible servers. By reading or not reading this you hereby consent to us doing that. Oh - and did we mention how much we care about your privacy and security? We just wanted to make sure you got that."

Hopefully the EU will also mandate some kind of real (but usable) consent mechanism to this sort of stuff, that's unlike the whole cookie story.

Yeah, "I hereby refuse to use any American social networks" is going to be a popular phrase among EU teenagers.

The problem with EULAs is not just that we don't read them, it's also that in order to live a normal life you have to agree to all kinds of EULAs whether you want to or not. Consent is always given.

Consent isn't always consent.

In medical industry, there is the idea of "informed consent", which attempts to make sure both parties are aware of the consent given. (Mainly in regards to treatments.)

EULA's, at least in Spain, are not contracts

An "agreement" is not a contract? How committing are EULAs then?

EULAs are pretty powerless. You can’t write anything in there that wasn’t in the ad either. Otherwise it becomes invalid.

As a German law professor phrased it "I never read the fine print. It's either fair or invalid"

At least in Germany it's not possible to override laws by writing something different in a privacy policy or EULA. Even EULAs are mostly invalid. I guess it's the same in most European countries.

Once something becomes a "consumer" contract then a lot of extra legal protections kick in (at least here in the UK) e.g.

https://www.citizensadvice.org.uk/consumer/protection-for-th...

Yeah, as a German law professor once told me: "I never read the fine print. It's either fair or invalid".

AWS and others will likely set up something quickly, but you'll still have to keep that in mind when trying to establish a presence in the EU.

AWS already has two datacenters in Europe (Ireland and Germany). Wouldn't it be enough to use those data centers for European users?

US companies would simply not be able to work with that data e.g. via a browser while sitting in the US to perform any form of data analysis, customer support and what not.

They would require a local presence, local staffing.

So then the cynic in me sees this as more of an economic move than a privacy protection mechanism.

Edit. fixed typo.

> "Probably not even for data analysis."

Especially for data analysis (and not limited to it).

Am I transferring data to the US when pasting it in Google Spreadsheets?

Yes.

Reply on news.ycombinator.com