Hacker News Reader

Comment by jeroenhd | Hacker News Reader

It's not just American companies, though; African, Australian, Canadian, Mexican and Russian companies have the exact same restrictions. The general rule is "privacy enforcement and protections must be as good or better than the EU's".

It's possible for a country to get certification from the EU that the privacy protections of said country are strong enough. When that happens (see the failed Privacy Shield and friends for an example), you can let companies from those countries process PII if there are significant protections built into the contract (say, a huge fine to you if they mess up and leak the data of your customers, as the EU cannot impose their own fines as easily).

From what I can tell, the contracts and DPAs most American cloud providers eagerly send you are good enough to satisfy this constraint if the companies weren't subject to American law.

View on HN

I see where you're coming from, but that's not quite true.

GDPR basically puts international transfers into two buckets: Adequacy Decision, and Other. Adequacy decision means the other country's laws are "good enough," and your obligations are literally just to put the words "Adequacy Decision" in your privacy policy somewhere.

Other means you need to take "additional safeguards" to ensure data privacy is protected. This is a bit of a bother, but eminently feasible. The "standard" way to do this is put additional terms in the contracts you sign with third parties (and only use third parties where you have signed contracts).

The situation with the United States is unique: the EU have ruled that no possible safeguards are good enough. US law enforcement's needs override any contract you can sign, so it is legally literally not possible for an American company to safeguard data. This makes data transfers to the US substantially more restricted than data transfers to any other third-party country.

I'm not aware of any other country outside of Europe that competes in the tech space and doesn't have laws similar to the CLOUD act. There's been a ruling on the conflict with American law, yes, but I doubt most other jurisdictions would pass the requirements.

Everybody wants full control over the data stored in their jurisdiction but nobody wants their citizens' data to leak to other governments.

"Via warrant or subpoena" You want American companies to ignore court orders. This isn't about privacy protections. You want EU data to be immune from court orders.

court orders the targeted persons have no legal recourse against. That's one of the key points that killed the recognition of US law as adequate: That you can be targeted by surveillance that has no effective legal oversight into if you are a valid target, and you have no legal recourse against this.

You're asking for legal protection that you don't force onto your own court system. Does your court system inform criminals they are being wiretapped during an active investigation?

That's not demanded of the US either.

What the EU wants is to permit for adequate privacy regulations so that American businesses can operate with the necessary privacy guarantees without breaking the law.

The USA would not accept their American companies to become subject to European subpoenas and courts, but does enforce these requirements when the situation is reversed. Obviously the EU doesn't like that.

Nobody wants American companies to break the law, the EU just wants American law to be better. America disagrees, and there's nothing wrong with that, but that obviously has an impact on the economic viability of the European market for American companies.

Reply on news.ycombinator.com