Hacker News Reader

Comment by digitalengineer | Hacker News Reader

Some time ago Google gave EU admins the option to select a local regional (EU) server. This means the data is not send to the US. But! It’s still nog fully legal as the Google HQ (and thus the US government( can still access all the data.

View on HN

if anyone is curious about why that gives the govt. access:

https://en.wikipedia.org/wiki/CLOUD_Act

(God willing they repeal it, even if only for the international commerce implications...)

something I'm not getting here. If you buy a EU engineered IoT home appliance that has PII including, whether a user is presently inside their home, then every company I know operating in this market uses US based clouds (what other options are there LOL) to do things like digital twin or device shadows but by using a local availability zone.

So this is very different than GA, but depending on the threat-model can be worse. Also very similar metrics can be gathered from the data as from a GA cookie (are they eating, cooking, showering, watching TV).

CloudAct would (or should) in this case also apply here or what am I missing?

The watchdogs are extremely slow and have a huge backlog. You’re right that storing that data in the US or without transferring ownership to an EU subsidiary would not be legal.

You're not missing anything. A lot of companies just have no idea of the legal landscape, or simply ignore it in the name of convenience. That's because consumers are even more ignorant of their rights around technology and don't sue them. It will take a lot of civil litigation for this to change.

I am only aware of Hetzner. (German) The other day I was checking out there offerings and I was amazed at how easy it is to order a vm. And then it is live the next second. It is amazing.

Obviously they don’t have full range of services the big three have. But maybe just enough anyway.

They routinely refuse new accounts if something looks fishy (to them). They don't provide extra information or even accept payment in advance.

(what other options are there LOL)

It is a hot topic, here are a few: IONOS - https://cloud.ionos.com/ Onep Telekom Cloud - https://open-telekom-cloud.com/en

But if you want to do scale in Europe you have to go for OVH: https://www.ovhcloud.com/en/

> what other options are there LOL

This blogpost lists a few :

https://news.ycombinator.com/item?id=27393854

Also, even if no options were available, it's not like the law would care - the illegality of it has been advertised for years...

> every company I know operating in this market uses US based clouds (what other options are there LOL)

Alibaba has a sizeable cloud offering and has for years.

This will never be repealed. It was introduced to effectively enshrine a right US authorities have had since the PATRIOT Act was introduced 17 years prior, since that act had become politically contentious and was left to expire.

If anybody seriously thinks US authorities will quietly lose a key power after enjoying it for 21 years, I have a few bridges ready to be sold.

No one said "quietly" -- but there has to be some threshold of backlash that would knock it back. My guess is that European privacy law could combine with it to do enough impact to large American businesses that they'd use their political weight to do something, whether or not it were to improve matters from the perspective of privacy/sovereignty.

> (God willing they repeal it, even if only for the international commerce implications...)

It's hard to express how impossible this is. It is very very strongly in the state's interest to keep powers like this. We're more likely to get communism...

This then comes down to whether you think the US govt. these past few decades is better at self-perpetuating power or toadying up to the demands of capital. Cynicism vs. cynicism!

Presumably the Five Eyes alliance could also mean that servers in Australia, Canada, New Zealand, and the UK may also be unusable since they share intelligence information with the US.

Why is that not fully legal? Wouldn't the same law prevent Google USA from querying PII data from Google Italia?

Italian laws do not apply to Google USA.

Not generally, but they do apply to Google Italia, who would not legally be allowed to respond to requests from Google USA for European PII.

Yes, the Italian law that prohibits sending data abroad applies to Google Italia, but Google USA is submitted to the USA law, that says that the USA government can request any data from Google Italia and they are required to get it.

So the existence of Google USA makes Google Italia operation illegal.

...in USA.

Well, depends, fundamentally it's a paradox.

Either US company get's the data from the Italian one, making the Italian operation illegal in Italy

The US company doesn't get the data from the Italian one (despite ownership), making the US company illegal in the US.

I don't think anyone is under the illusion that the latter option is chosen when push comes to shove.

The Italian market doesn’t have to apply to Google USA either.

Companies can always choose to ignore a specific nation’s laws[1], they don’t still get access to that nations markets. At the borders the nation state is the one with the guns and firewalls

[1] unless you piss off a nation that can project global power, lol if you piss off China or America

First time I've heard of China projecting "global power". Are there cases of it happening?

Apple complying with Chinese laws, and providing Chinese government access to private data.

Google, Facebook etc. being blocked in China.

etc.

All over Africa, in a more heo political sense. Also along the new silk road all the way to Europe. Just to name two.

https://www.scmp.com/news/china/article/1714248/more-chinese....

Chinese and American police forces both operate abroad and like to flex their power. The NYPD was in a similar situation post 9/11 when they started trying to police nearby states and when they sent operatives to other countries even against their own federal government [1].

Russias also sent operatives overseas in some fairly public assassinations. It’s not really surprising that China does this, it appears to be the default operating procedure of powerful countries

[1] http://america.aljazeera.com/watch/shows/the-stream/the-stre...

https://www.wilsoncenter.org/article/china-the-arctic

https://thediplomat.com/2021/08/chinas-presence-in-africa-is...

https://www.cadtm.org/Chinese-geopolitics-continuities-infle...

But someone will have to foot the bill when their branch in Italy is fined by the government for violating Italian law

Oh yes they do. GA is part of a company that also sells services in Italy. They should follow the law if they want to keep earning that non-US Adwords money that allows GA to remain free.

If Google US can access the data, that means the US government by extension can also. This is exactly what GDPR doesn’t want happening. More details in this open letter by Max Schrems “ the Court has clearly held that US surveillance laws and practices violate Article 7, 8 and 47 of the Charter of Fundamental Rights” https://noyb.eu/en/open-letter-future-eu-us-data-transfers

Like Adobe, who uses tracking servers in the EU, but Data Processing happens in the US?

The article has the watchdog suggesting exactly that (the specific site has 90 days to use GA in a compliant way, no direct complaint against GA), so it seems from their point of view it's legal.

The title of this post and a lot of the comments are projecting what they want GDPR to be (all non european online entities banned from doing business in the EU) vs how its being enforced.

On the last point: how does that work with cloud computing providers, as all the big ones are US-based?

Reply on news.ycombinator.com