Hacker News Reader

Comment by freedomben | Hacker News Reader

That adds a fascinating wrinkle to it, what happens if the EU makes it illegal to share the data, and the US requires it? A company could find themselves in between a rock and a hard place, forced to violate the dictates of at least one powerful governmental force.

View on HN

a simpler solution could be to outsource the data to locally registered companies (Either, a subsidiary or a shell data owner). That way Microsoft can deny the data as they do not own it.

handling over the data ownership to a companny in EU is the way to go. This already happens between Deutsche Telekom and Microsoft with their Azure Cloud offer in Germany. Deutsche Telekom is the owner/supervisor of the Data and Microsoft has no acces to it.

Not that interesting, really.

Nobody forces Microsoft to exist in the EU, or to sell their software to EU citizens. They would simply be forced out of that market.

In theory that's what should happen, but the political realities guarantee it will not. Microsoft, Google, <every other major tech company>, <most other multinational companies>, are too politically powerful.

A workaround will be found, or one of the two sets of laws will be changed, or one of the two sets of laws will not be enforced.

Correct, but at the same time what happens to EU companies selling software services in the US? If the EU companies don't fork over data will they get restricted too? I'm not sure if isolating every jurisdiction into its own tech ecosystem is an achievable (let alone sustainable) direction. To a certain extent, Microsoft (and presumably others) are attempting to do this for their data[1] by hiring data trustees in other countries. Essentially, Microsoft still develops the technical services but hires another company, which does not have US presence, to hold that data and is subject to the (presumably stronger) privacy laws of the country it is located in.

I'm not sure how resilient this is to coercion by the US government. Maybe the US government could forbid Microsoft from doing business with the data trustee unless the the trustee gives up user data.

1. https://news.microsoft.com/europe/2015/11/11/45283/

EU companies (typically) don't have a nexus or operating presence in the US, therefore they can't be coerced to release requested data (unless the US Government is going to request three letter agencies to null route their traffic at internet exchanges [or take other adverse actions against their traffic]).

Your shell game you suggest will not withstand the scrutiny of an intelligent judge and an aggressive prosecutor.

Source: A lifetime ago, I was asked as a consultant to spec and site infrastructure out of the reach of the US government with the help of an international law attorney.

What's to keep the US government from fining companies or suspending their ability to do business until they give up user data? For example, London suspending Uber's ability to operate in the city.

While I'd agree that small-ish foreign companies can probably fly under the radar, I don't think any company that receives payments from US customers is immune to coercion from the US. If the US government can impede a company's ability to access US customers then that's an ability to compel a company to give up data.

Worth noting that Uber's licence to operate in the UK is issued to a UK registered company.

Reply on news.ycombinator.com