Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

The law about EU data having to be on the servers located in EU already exists.


Yup you already can specifically sequester your data to Microsoft's or Amazon's EU-only servers, and even smaller companies like 1Password offer to store your data on 1password.eu instead of 1password.com.

However there can be weirdness sometimes. I vaguely remember a case where Microsoft had to hand over EU data to a US law enforcement agency due to a court order, but giving that data would violate Irish law. I know there's a new variant of the EU-US Privacy Shield, but with the current US administration that could get ignored very easily.

Which raises the question: can for example Microsoft-the-US-entity in de jure sense cleave off Microsoft-the-EU-entity whilst still maintaining de facto connection between the two? If not, there are definitely big opportunities abound.


That's not the way.

What Microsoft might end up doing is following the China model, essentially giving control over their EU servers (probably only those in a special region) to an EU company, while still supplying the software and taking a (very large) cut of the profits.


https://www.s3ns.io/en

This is Google + Thales doing the 3rd party operator model, with the operator being a subsidiary of Thales and not Google.

(NB: I work for Google in the EU.)


Data residency is not data sovereignty.


You clearly did not read the original post. It says that

1. US companies hosting EU data on EU servers are more vulnerable to US Govt demand, not less.

2. US-EU Privacy Shield does not exist anymore.


I just don't know how this makes any meaningful difference towards the threat model of the US gov't becoming compromised if a US company still controls said servers and the CLOUD Act allows the US gov't to freely subpoena the contents of those servers. The companies involved will still do what the US says because they are forced to.

Like, the conversation will go, "Get us this data"; "EU law says we're not allowed to"; "We don't care, do it or we shut you down."


The EU courts agree with you:

https://nextcloud.com/blog/eu-court-withdraw-personal-data-o...

Any cloud provider that operates in the US and claims to offer data sovereignty is lying.


Doesn‘t matter thanks to the CloudAct.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: