Hacker News Reader

Comment by yread | Hacker News Reader

Holy shit! I work in a medical setting and our institute was considering using Azure to offload some HPC. Azure promises to be the only cloud that has georedundancy but all within EU (AMS and DUB) protected by EU data laws. If this goes through we won't be touching it.

What is wrong with the US judges these days?

View on HN

EU laws apply to data on EU residents. You can't dump your US-originated data into an EU jurisdiction and use EU law as a legal shield. Most developed countries have reciprocity arrangements with each other about access to data for legal proceedings in cross-border litigation, eg courts in one country will recognize properly-issued warrants/subpoenas from another.

EDIT: I should have mentioned that the major international treaty about this is the Hague Convention (which also covers a bunch of other things). You can find all about the rules, which countries are signed up to it as regards evidence-sharing, and so on here: http://www.hcch.net/index_en.php?act=text.display&tid=23

It's my understanding that Microsoft's complaint is that the US Government isn't bothering going through the proper international channels setup through treaty arrangements in order to retrieve this data, and is instead relying entirely on domestic procedures.

Is that not the case here?

Yes, the government is arguing that going through Mutual Legal Assistance procedures would be too slow.

https://cdt.org/insight/microsoft-ireland-case-can-a-us-warr...

as opposed to a court case with multiple appeals?

I believe you're right, I'm just saying to the grandparent poster that storing your data in another jurisdiction didn't automatically put it off-limits to US litigants even before this ruling.

In this case if the user was using Azure and was putting EU data into their EU based cloud (owned by Microsoft) the US is arguing that it should still be able to get access to that data since it is owned by Microsoft, a US based entity.

So while I agree with your statement that it was already technically possible, it required various hoops... with the current court case it is much scarier since there is no going through international agreements to fetch the data.

The US is basically stating that if you are a US based company, even if you have subsidiaries that are technically registered as foreign companies you are still required to produce data those foreign companies hold.

I suppose I don't find this all that radical because it seems in line with corporate personhood. Suppose I'm a US citizen but I become embroiled in some dispute with the government; I might also hold an Irish passport but that isn't going to let me blow the matter off. It seems to me that if you enjoy the benefits of US corporate citizenship -access to wealthy and highly liquid markets, access to the US courts, and so on - then you shouldn't be able to disclaim your US citizenship by paying the very small needed to set up a foreign subsidiary and pretending it's wholly independent from you (even though it it has the same name, brand, etc. and you own all the shares of this notional subsidiary.

Let's face it, it's 'technically' a separate legal entity but nobody disputes that it's ultimately the same company, a local clone of the original if you will. MS certainly has the right to make their legal argument about the differences for as long as the courts will entertain it, but it seems like a bit of a bullshit argument to me.

I say 'seems' because I'm guessing a bit - unhelpfully, the news article doesn't cite the case in question, so I haven't looked up any of the filings to see what the matter is or study the particular arguments. I probably should, but I'm feeling a bit lazy about it :/

Except that in the case of Microsoft Ireland, even-though it may be a subsidiary, they are still a corporate entity outside of the United States. They have to abide by and follow Irish/EU laws.

Microsoft Ireland when it comes to US law should be considered a foreign entity, and thus the standard channels for requesting information from a foreign company should be used.

The US forcing Microsoft US to march into Microsoft Ireland and retrieve data unlawfully should be fought...

So, I can buy a country's bonds based on the laws of the country I choose to, but that doesn't apply to data?

Doesn't seem very straight to me. If a country chooses to comply that's different than forcing MS USA to hand over data from MS Ireland.

There aren't laws in the US that prohibit the storing or processing of sensitise medical information outside of the country?

Reply on news.ycombinator.com