Google plans to move UK users' accounts outside EU jurisdiction | Hacker News Reader

Google plans to move UK users' accounts outside EU jurisdiction

reuters.com

185 pointsnsdfg80 comments

Previously posted and discussed here: https://news.ycombinator.com/item?id=22370405

Duplicate: https://news.ycombinator.com/item?id=22370405

I’m sorry, am I on Stack Exchange?

On Hacker News, the issue is that frontpage space is the scarcest resource that HN has (only 30 slots at a time). Since the site exists for intellectual curiosity, and curiosity withers under repetition, it's important not to have those slots taken up by stories that have had a significant recent discussion. (For example, the OP had a major thread yesterday.)

Reposts are allowed in the other cases. That is, if a story hasn't had significant attention yet, we don't treat a repost as a dupe. Similarly, if it has had a significant discussion but not recently, it's ok to resubmit it. That's because once enough time has gone by, the topic can gratify curiosity again. The cutoff is a year or so. This is in the FAQ: https://news.ycombinator.com/newsfaq.html.

It's okay to point out duplicates, it's just odd to see it done in such a spartan manner over here.

The optics of this might look bad, but I cannot really fault Google for this move (and I frequently fault Google).

They're facing a dilemma of regulatory uncertainty, and this move resolves this dilemma for them (at least, they seem to believe that).

Anyone who has ever dealt with powerful regulatory agencies will probably agree that this resolution is the right move for the company, a move important enough that eating some bad PR is probably totally worth it.

(The point about powerful regulatory agencies is not that it's hard to stay compliant; it's that the costs, overhead, bureaucracy etc. of demonstrating this compliance is immense, even if you are doing everything 100% right.)

Pro-Brexiteers have often cited stronger bilateral ties, such as those with the US, as an advantage of Brexit. And of course, post-Brexit, Britain will be ever more reliant on the willingness of countries such as the US to cut deals with them. As an independent negotiator in these new deals, Britain will have less power to push back over silly things like data privacy; and as a member of Five Eyes anyway, they're all too happy to have the US do their spying on their behalf, just like the US likes Britain spying on US citizens to the US Government's benefit.

The recent Huawei 5G drama does seem to go against the grain of this. After all, if the UK had less power to push back, then clearly nobody has told them.

not sure this is all due to self-agency. China has also threatened them over Huawei. the UK is really between a rock and a hard place

That sounds really interesting.

Would you mind sharing a resource to learn more about how the UK spies on US citizens?

https://en.wikipedia.org/wiki/UKUSA_Agreement

Although if you look at the actual text on the UKUSA agreement document HW 80/2 [1], rather than the short synopsis from Wikipedia, it says very clearly that the UKUSA agreement covers only sharing of "foreign communications" where footnote 3 on page explicitly excludes communications of both the UK and the USA.

1. https://discovery.nationalarchives.gov.uk/details/r/C1153691...

Optic Nerve was one of these things. Basically, GCHQ or NSA hacked Yahoo!, GCHQ used that to collect stills for every single webcam feed on the platform (this! was! back! when! Yahoo! was! still! relevant!), including a lot of intimate photos, so on. Lots of fun stuff there!

But that's a modern example. There are some pretty interesting ones. Here's a fun list of some celebrities that were the targets of a Five Eyes country and were spied on by multiple agencies as a result:

https://en.wikipedia.org/wiki/List_of_people_under_Five_Eyes...

The snowden leaks touch on it

It's not good for the users. Having less control over your privacy and your data is extremely unlikely to be better for the users. Probably less control and regulation is going to be better for Google.

Might be down to costs.

How much does hosting per account in Ireland compare to USA hosting?

Even if a few pennies/cents, at google's scale - that makes business sense and if they can, they will.

This has nothing to do with the actual location of the servers holding the data. Which would not be a single location anyway.

Actually it does play a factor, GDPR had it so the data on EU citizens had to be located within the EU. Now they have alternative options for the UK - then that aspect does as I initially outlined becomes key.

Hence the question of actual costs to Google in hosting in say Ireland (staffing, taxes, rates, utility costs, cooling....) compared with another location outside the EU that may very well have cheaper running costs due to many factors.

I hope that clears up why location is a factor now as it related to running costs and if they can save some money, well, they will.

More so if they suddenly free up capacity in a datacenter which has higher costs than some other locations outside the EU. All these details do very much, however small, stack up at the scale of users Google operates with and for the UK, several million is a large chunk of potential savings.

Seems very much a case of "Man we don't know what the rules are / will be and this seems like the best choice at the moment."

It is real. I just got an email about this from Google about my gmail account:

- Your service provider and data controller is now Google LLC: Because the UK is leaving the EU, we’ve updated our Terms so that a United States-based company, Google LLC, is now your service provider instead of Google Ireland Limited. Google LLC will also become the data controller responsible for your information and complying with applicable privacy laws. We’re making similar changes to the Terms of Service for YouTube, YouTube Paid Services and Google Play. These changes to our Terms and privacy policy don’t affect your privacy settings or the way that we treat your information (see the privacy policy [link redacted] for details). As a reminder, you can always visit your Google Account < https://myaccount.google.com > to review your privacy settings and manage how your data is used.

> These changes to our Terms and privacy policy don’t affect your privacy settings or the way that we treat your information.

This is such a blatant lie what the hell. The only reason for this move is specifically to treat your information in ways that are not legal now.

Not necessarily. They might treat information the same way but generate different paperwork or have different levels of risk from frivolous lawsuits.

This is not a lie if these changes do not do anything but later ones will.

Alternate interpretation: it doesn't affect the way they treat your information because they weren't going to follow GDPR anyway.

It seems very early to be making changes like this.

Google must really benefit somehow from the change, otherwise they could leave it until much later in the year, and see what (if any) changes Parliament makes to privacy and data protection law in the UK.

In what way is it early? UK left the European Union late last year. Since then there only is a temporary agreement in place, with a deadline later this year. Given the seemingly strength of the Prime Minister (see recent cabinet reshuffling) and his unwillingness to extend companies doing business in Britain have to prepare.

February 1st was officially the "first day" out.

It's a bit of a red-herring because the only thing that changed on Febuary 1st was that we're no longer having representation in the EU parliament, until the end of the year we're still following all the same laws and regulations.

And that assumes that the transition period is not extended. (Which it doesn't seem likely to be, frankly).

GDPR compliance is expensive; every account not in the regime saves Google costs.

In which way?

In no longer being able to use a customer's data as their own.

I can tell you that two FAANGs implement GDPR compliance for everyone because they didn’t want to risk getting a user’s EU status wrong.

Also probably having two different codebases to handle data compliance is probably not too easy to support.

That certainly has been how I've seen it play out. Which makes sense as easier to have one rule to fit all and if that rule is based upon the worst case of every countries data laws then you are somewhat more future proofed. After all, not many countries do laws than are demanding their citizens have less privacy - at least in the public sector remit of laws.

Which two, and do you have a source?

If I'd have to guess, the two that do less or no advertising and thus benefit less from your data...

(EDIT: That would indeed be Apple and Netflix, as hinted by another comment).

Pardon my cynicism if I think it's likely Apple and Netflix.

And they probably do that for everyone only because it doesn't eat into the main profit generators in their business models. Not many marketers paying Netflix to advertise their new natural soap line to targeted prospects I'd imagine.

One is Apple or Netflix and the other isn’t. I don’t feel comfortable sharing more specificity than that.

Linkedin for sure, I used to work there so I can vouch for it.

Linkedin isn't faang.

That's not a FAANG though.

FAANG is just a buzzword acronym, a hook to pull in investors.

LinkedIn is Microsoft, which should also be included given it's scale. It should be FAMANG.

I agree about the buzzword part, but the parent did specify two FAANGs. I'd think it would be interesting to hear which two since it's obviously not Google (as the article hints that they want to move data out of the EU).

Also, the FAANG expression didn't start around scale, if that was the case netflix wouldn't have been included as early as the expression was coined. The expression was about developer compensation. That seems to have changed recently(-ish) though and now the expression is more like "unicorn" instead of just the specific companies that make up the acronym.

But then does Microsoft implement GDPR globally, not just its LinkedIn subsidiary?

I wonder if that means that since they're moving their customers therefore revenue to the US, they will pay taxes there too, instead of Ireland.

Probably not though. Flags of convenience is the Google way.

I imagine a future where the workers are on the Irish side of the border but the servers are on the UK side of the border.

One still enjoys the tax advantages of the value being added on the Irish side, but also the relatively lax data requirements on the British side.

I am not pro or con anything, just pointing out the arb.

Britain already adopted GDPR-based data protection law. If anything, Brexit will tighten the situation by requiring the data of British to stay in Britain.

That certainly is an outcome. Equally does add more credence to the Google move as if the data was in the EU, then the potential to kick up a fuss and roll out laws to insist it is in the UK would play out faster than say that data in the USA.

Equally - I'd say costs may well play out more and what is the cost to host in Ireland compared to hosting in the USA?

Even when we are talking pennies/cents in difference - at the scale of Google - that soon adds up and if they can, they will.

Goals. I like our role models. I would have never independently perceived most of these opportunities and possibilities. Thank you Google and other multinationals, and the media for dissecting their expensive legal strategies.

Does anyknow what happens if I move out of the UK to rEU? Will my account now be considered to be an EU account or will it always be a UK one?

Thanks, Brexit!

I would imagine N.Irish users might end up being covered by GDPR -- British law also N.Irish people to declare themselves Irish under the GFA. N.Ireland could well end up with a special status post-Brexit where it's both in and out of the EU and in and out of the UK.

Given European data protection is much stronger than either British or American DP it would make sense to group N.Irish people this way rather than trying to deal with the exceptions.

> British law also N.Irish people to declare themselves Irish under the GFA

This by itself doesn't mean anything for GDPR—GDPR applies to EU residents (whether or not they are EU citizens), not EU citizens. Declaring yourself Irish doesn't make you fall under GDPR protection if you live outside the EU.

I am not sure if this entirely true. My understanding was it was both citizens and residents.

This link [0] seems to suggest otherwise.

[0]: https://www.hipaajournal.com/does-gdpr-apply-to-eu-citizens-...

GDPR applies to EU & EEA residents.

A fairly readable summary of the territorial scope of GDPR: https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_gui...

In fact, it's not even legal residency that matters. You must simply be present in the territory that the regulations apply to (EU+EEA). If you're not, then the protections don't apply to you, regardless of your citizenship.

> If you're not, then the protections don't apply to you, regardless of your citizenship.

Yes, unless the company is itself in the EU, in which case the GDPR always applies, even if you're not a citizen, resident or even visitor to the EU.

GDPR applies to EU citizens globally. It's just not enforced globally. The company will have to be large enough to have a presense (or future presense) in the EU for there to be an tangible impact.

>Declaring yourself Irish doesn't make you fall under GDPR protection if you live outside the EU.

I'm a DPO and this is absolutely incorrect.

Can you provide a source? All information I'm able to find says that it applies to EU & EEA residents, with no mention of citizenship being relevant.

Edited to add: https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_gui... (it's not even residency that is key - just being present in the EU+EEA)

Here is the official source -- you aren't exactly providing many sources yourself beyond repeating what you've "seen":

https://ec.europa.eu/info/law/law-topic/data-protection/refo...

That page has no reference to citizenship, and multiple to location. It contradicts what you claim it supports.

It took a while to find a primary source, but there is a good set of guidelines laying out how the regulations should be interpreted here: https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_gui...

They are very clear - the GDPR protections apply to those that are "in the Union", and the guidelines clarify that citizenship (and, in fact, legal residency) are irrelevant. One must simply be present in the territory that the regulation applies to (which is EU+EEA). Being a citizen of a EU country and being outside the union, the GDPR protections would not apply to you. Being a citizen of a third country and being inside the union, they would.

Uh... did you read the page you linked to? The word "citizen" does not appear anywhere on it, and it finishes with this pretty clear line:

> Provided your company doesn't specifically target its services at individuals in the EU, it is not subject to the rules of the GDPR.

(note in the EU - no mention of citizenship)

There's a big difference whether the company is in EU or not.

If your company is in EU, then according to Article 3.1 the GDPR applies to all your procesing of personal data, period - with no exceptions depending on citizenship. So if you're a DPO in a EU company, then that's what's true for you, you definitely have to apply GDPR protections to EU citizens (and also noncitizens) wherever they are.

If your company is not in EU, then according to Article 3.2. the GDPR applies only to people located in the EU - "This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union"; no qualification on citizenship, but a qualification based on location.

> GDPR applies to EU citizens globally. It's just not enforced globally.

Do American speed limits apply to American drivers in Europe? Or do the European speed limits apply?

Essentially you are absolutely incorrect. The EU has no legal jurisdiction outside of EU borders.

American tax laws (like the FACTA) do apply to Americans in Europe, for example. A sovereign entity has jurisdiction over anything it wants. The question is whether it can enforce it, but there are many tools for that, from simple treaties to sanctions to full-blown military invasions.

In any case, parent is in fact incorrect since the GDPR claims no such jurisdiction. It only applies to people in the EU, or to people whose personal data is processed by EU companies.

i think the stronger data protection would prevail for NI

I agree, like the California effect in the US. California is both the strictest and biggest car market and all the car manufactuers use California as the standard because it covers everyone else.

Why would that be necessary?

Because unless the UK and the EU reach a trade agreement by the end of the year, the provisions of the Withdrawal Agreement kick in and Northern Ireland becomes bound to EU regulation.

This is a long and complicated story, but essentially Brexit created the following problem: the UK now desires to have full control over its borders, and this means a hard border between the UK and the EU. But then there is also the Good Friday Agreement (GFA), which achieved peace between the unionists (Protestants who want NI to be part of the UK) and the nationalists (Catholics who want NI to be part of Ireland). Simplistically, the GFA guarantees a sort of double affiliation of NI, both to the UK and to Ireland. This means, among other things, no physical borders.

I don't completely understand what gives them the right to do so - legislation are still in place, GDPR & the rest are included.

Not sure why you are being down voted for this - we ratified GDPR under UK law, the UK Data Protection act of 2018 - until that law is repealed GPDR still applies under my understanding.

They might be simply preparing for that eventuality, and when the law changes they can quickly react. Apparently in the e-mail that the users got, they are claiming that nothing privacy wise will change, and that might indeed be true for now.

I think that also breaking the law might be easier. EU might not bother anymore penalizing them for a member that's already leaving, and UK alone will have very little force imposing penalties on an US corporation.

GDPR only applies to EU residents, doesn't it?

Yeah, the UK didn't fell out of the EU. There's a transition period that just started and right now, there's basically no change yet.

UK citzens are still EU residents for now, the UK hasn't actually left yet.

The EU disagrees: https://europa.eu/european-union/about-eu/countries_en#28mem....

The UK may still be following some of the EU's rules, but they have officially left the union.

The UK is planning to leave the EU, so Google is planning to treat UK accounts as not part of the EU. I don't see what is difficult to understand about this.

The word "now".

The UK is following EU rules and regulations at least until the end of the year. After that point, it can pick and choose, based on negotiations for trade agreements or whatever other reason pleases it.

Reply on news.ycombinator.com