But on closer read, it seems to partially apply to SaaS/PaaS cloud services, which hold data outside EU.
Google also provides IaaS/PaaS cloud offering based within EU as well [0].
But on closer read, it seems to partially apply to SaaS/PaaS cloud services, which hold data outside EU.
Google also provides IaaS/PaaS cloud offering based within EU as well [0].
I am curious as to what argument can find it acceptable to block US company, also when they place data within EU and can’t be compelled to handover to US law enforcement.
Even if a US company holds their data in the EU, due to FISA 702, the CLOUD act and EO 12.333, they can still be compelled to hand over that data. So being a US company is a dealbreaker, regardless of where the data is stored.
Alphabet (US) -> Google (US) -> Google (EU)
Under such a structure, Google (EU) is not GDPR-compliant, and will need to drop all upstream inheritance of (US) to comply with this ruling.
I am not your lawyer, this is not legal advice.