Hacker News Reader

Comment by jpalomaki | Hacker News Reader

In modern cloud data is likely encrypted on disk and typically spread across servers. It’s not really feasible to access the data by physically taking control of the servers or disks.

Does the physical location really matter? If authorities need to access the data, they would anyways need a higher level access to it. In this sense it is more relevant who is controlling the data and where and under what jurisdiction that entity is located.

View on HN

It's not a matter of data being encrypted, it's about the US authorities being able to demand decrypted access to the data of EU citizens from Facebook.

Facebook is a US company. Even if the data was stored only in Europe, they'd likely cave to demands anyway.

That's the point, not if EU said so. FB needs to comply to EU laws to operate in EU.

So USA's CLOUD Act doesn't apply if EU says so?

It does apply in the EU and that's the point, if a US company can't engineer a legal or technical work around then they can't operate in the EU without breaking either US or EU laws.

If the US believes that it's in a strong enough position that these companies can remain competitive while ignoring either US or EU law (and dodging enforcement) then it's welcome to not make amendments to the CLOUD Act. Otherwise it can have US companies lose market share(or suffer EU enforcement actions) or employ diplomatic lines to neuter or work around the law.

You can of course note that the same issue will arise going the other way (EU company operating in the US) but the cost for the EU is obviously judged to be less than what's gained by protecting their citizens (or that it's at least a good drum to beat to trade for other considerations from the US).

it's not about where the data is stored, it's about Facebooks inability to guarantee the rights of EU citizens and their data as it's transferred to the US

And, although this is an educated guess, about US businesses paying for Facebook ad services targeting EU customers using the collected data in a way that GDPR would block in EU.

No, not really. This doesn't have anything to do with US companies using ad targeting services that don't comply with GDPR.

Schrems 2 is case primarily about US companies working with US authorities.

https://edpb.europa.eu/our-work-tools/our-documents/other/fr...

Oh, so basically that thing that dictates that US can ask any US-based company to disclose any data in its possession, and so to protect EU citizens, EU wants US-based companies to store EU data on EU servers.

If I also remember correctly from reading up on Tutanota, it gets so nuanced, that to the US authorities it is enough that a single US employee of a non-US company has access to such data to summon them to disclose it?

Either way, Facebook is in deep shit.

Reply on news.ycombinator.com