Hacker News Reader

Comment by thrawn0r | Hacker News Reader

I don't believe that 3 letter agencies will care about the physical location of the user data. So storing the data in europe might not solve this issue.

View on HN

Well, with data residing in the USA, US three-letter agencies can just ask the data operators to give them the data. I'm sure the same is true of French three-letter agencies for data residing in France, or possibly even the whole EU.

BUT, it's much harder to US three-letter agencies to obtain access to data residing in France, or the other way around - that would require hacking, and that carries a much higher degree of difficulty and risk (not that I would ever imagine it doesn't still happen).

The GPDR is explicitly not about trying to get you protection from state-operated intelligence agencies, and in fact within the EU state agencies like that are explicitly exempt from it.

It would be if the EU had the legal powers to do so, however the EU's treaties reserve national security to the member states.

EU law does apply when national security concerns of non member states are engaged, though hence the Schrems cases succeeding (and why the UK in on shaky ground when it comes to equivalency decisions post-Brexit).

That's wrong, GDPR explicitly applies to government agencies, police, etc.

Eurpol is currently on trial for violating it, as was the German BND previously.

The GDPR doesn't apply to the police, at least not in their capacity as law enforcement.

But it does have sister legislation - the Law Enforcement Directive[0] - that does apply many of the same principals.

[0] https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A...

Maybe the GDPR issues would be resolved if countries would settle and agree how to do surveillance on their population... Obviously the gears of silicon valley turn faster than the gears of intelligence agencies.

Reply on news.ycombinator.com