Hacker News Reader

Comment by sudhirj | Hacker News Reader

I can't make out if these rules are specific to India. Doesn't the EU have the same data residency rules as well? Why are Mastercard and Amex struggling with this?

View on HN

The Indian rule seems to require all data be stored strictly inside India, without any of it being stored outside the country. The EU permits data to be transferred outside the EU under a number of circumstances: e.g. if the other country has equivalent data protection laws, if the non-EU company you're transferring the data to has promised to abide by the EU rules, stuff like that. Take this with a grain of salt, of course, because I'm not a lawyer, but that's how I understand it.

Actually the European courts struck down Privacy Shield. So any company transferring data to the US is doing it illegally. Plenty of active lawsuits against google. But as much as HN likes to bash google, people here are pretty submissive when one is asking for advice on legal options against these companies.

https://www.bbc.com/news/technology-53418898

As far as I know it's still possible to transfer data from the EU to the US under the GDPR if the companies involved have signed a ``standard contractual clause''[0] (the article says this was also a target of the Privacy Shield suit but the courts chose to continue to allow it).

[0] https://ec.europa.eu/info/law/law-topic/data-protection/inte...

Right, which Google[1], Amazon[2], and Microsoft[3] even offer to third parties on their cloud platforms. That ruling was mostly just a quibbling about the legal particulars, it didn’t change anything on the ground.

[1]: https://support.google.com/adspolicy/answer/10042247?hl=en [2]: https://aws.amazon.com/blogs/security/customer-update-aws-an... [3]: https://docs.microsoft.com/en-us/compliance/regulatory/offer...

> people here are pretty submissive when one is asking for advice on legal options against these companies.

I think to be fair to the HN community on this topic, most of us are not lawyers and shouldn't be providing legal advice. And maybe more importantly, at least in the US, the most rational advice starts with step one being "have at least $500M in a legal fund", which precludes most people from being able to effectively execute a suit against Google.

Does Indian controlled AJK and Ladakh qualify as "inside India"?

I can't imagine any servers being set up in AJK or Ladakh in the near future.

Indian controlled AJK is like two villages in Kargil.

Do they have control of the lands you mentioned at present? That's the only reality that counts to make it within the country.

Also, Ladakh is hardly a troubled area from within.

I suspect this is more a case of “unwilling” rather than “unable”. Slightly related, China recently passed a similar law:https://www.ropesgray.com/en/newsroom/alerts/2021/July/China...

It's not a non issue either. Several countries already use different systems that do not depend on US credit card companies anymore. Not because it is banned, but because it obviously is a suboptimal solution.

Reply on news.ycombinator.com