Or would that still violate GDPR as Google as an American company can still be coerced to give access to data stored on their servers outside the US? But I can't imagine that to be the case, as it would effectively mean that any business where an American company stores user data is illegal.
> Where the controller or a processor established in the European Union is not able to take adequate additional measures to guarantee such protection, the controller or processor or, failing that, the competent supervisory authority, are required to suspend or end the transfer of personal data to the third country concerned.
It would seem as though any EU company that can be compelled to transfer data to the US would be found not to be able to take adequate measures to guarantee the protection of the data. I'm not familiar enough with the law in the US to understand whether the US authorities can compel an EU subsidiary of a US company to transfer data out of the EU, but if so...
They can. If I remember correctly Microsoft refused FBI request for some data that was stored in Ireland so the Cloud Act was created.
GP is wondering if no US employees had access to the data directly if US law would have Microsoft US order Microsoft Ireland (which is a wholly owned subsidiary) to transfer the data to the US.
It’s an interesting question. My non-lawyer take, even if they can force Microsoft US to make the request ultimately Microsoft Ireland is an Irish company operating under Irish law. If the data transfer to Microsoft US is illegal, they mustn’t do it.
A situation where this already happens is technology transfers. If information is export controlled (mostly military related), a foreign non-EU/non-NATO owner of a German company can ask and demand as much as they want, non of their employees will ever see that information.
There is the law, and then there is enforcement of the law, and the latter has not fully happened yet.
I work for a European company that is already being impacted by this ruling. Our first step is to replace Google Analytics, but I believe we are also looking through all cloud usage for any traces of PII.
I think this is a huge opportunity for European companies to get a foothold in the Analytics/Ads/Cloud/Office spaces. Perhaps also an opportunity for good open source alternatives, like Matomo Analytics, to get adopted.
Yes, because of CLOUD Act. If GA would create a deployable agent that proceses user data on your server before sending it in aggregate/anonymously to central GA, that would make it usable