Hacker News Reader

Comment by m12k | Hacker News Reader

It's lucky for tech companies with EU customers that a ruling has only been made regarding a low-hanging fruit like Google Analytics that is relatively easy to replace. Exactly the same reasoning can be used to essentially ban the use of e.g AWS, Google Cloud, Azure, Stripe and any other US infrastructure provider within the EU (they would only be legal to use as long as no personal information is ever stored on any of their servers, which in practice renders them useless).

I think there's a lot of companies hoping that the next "data transfer framework" negotiated between the EU and US lands before another EU court ruling triggers "infrastructuregeddon" - and that the new framework actually holds up in court, so we don't need to go through all this again.

Edit: Could the people downvoting maybe add a comment too? Is my comment factually incorrect or not adding to the discussion?

View on HN

> they would only be legal to use as long as no personal information is ever stored on any of their servers, which in practice renders them useless

Or if their servers are physically located under the country's jurisdiction.

That's not enough if employees under US jurisdiction have access to the servers. Or indeed, if employees under US jurisdiction can order that they be given access. So it boils down to the organization structure, who has final say, and which jurisdiction that person is under - which renders even European daughter companies moot.

> That's not enough if

Oh, it's enough. If a server is in your jurisdiction, you just mandate that there is to be no foreign access to any data concerning your citizens. Just like that.

The international network we know and love will one day be fractured into many regional networks as governments seek to impose their laws on it. This is inevitable.

Hello AWS China regions. Both of them are completely independent from AWS.

I, OTOH, hope "infrastructuregeddon" happens before they render the GDPR useless due to the combination of a new framework + the CLOUD Act.

The privacy of individuals is more important than profit.

> render the GDPR useless

I was under the impression GDPR has been useless since day 1.

> The privacy of individuals is more important than profit.

depends on what you mean by "privacy".

> I was under the impression GDPR has been useless since day 1.

Most laws are. Local regulations need to come into place, which takes time. Monitoring, auditing and enforcement takes even longer.

We're slowly seeing countries fining companies for violations. We're slowly seeing countries issuing advisories. We're slowly seeing countries putting it into action.

People thinking the world would change with GDPR day 1 have no idea how the world really works.

> depends on what you mean by "privacy".

https://www.merriam-webster.com/dictionary/privacy

Reply on news.ycombinator.com