Hacker News Reader

Comment by VisitorAnalyt | Hacker News Reader

Big tech - and Meta's approach to user data security - has long felt too powerful for Europe's data protection authorities to control. Given this, Norway's success is showing other European countries the way, and this points to a significant improvement in EU citizen personal data protection in the coming years.

View on HN

> EU citizen personal data protection

Sadly, there is no personal data protection. EU has recently agreed to allow data transfer to US [1]

[1] https://arstechnica.com/tech-policy/2023/07/big-tech-can-tra...

That's now the EU's third attempt to allow data transfer to the US. Fundamentally not much has changed, so hopefully we'll see Schrems III.

Could someone provide insights into the implications of a hypothetical Schrems III for EU-based SaaS companies that host their servers in the US, particularly those containing Personally Identifiable Information (PII) like email addresses? Essentially, would Schrems III mean that we'd need to immediately move our servers to EU soil, or risk fines?

Whether your servers are in the US or not, if you do business in the EU, EU rules apply. It might be that you will legally not be able to offer your services in the EU, if you have servers in the US, because those can the accessed by US authorities at any time, without you even learning about it. It is probably safer to have servers in the EU, if you want to do business in the EU. Servers in the EU not provided by any US hoster, since that hoster is vulnerable to being ordered in the US to transfer data from EU to the US.

Worth nothing that Norway is not in the EU yet, though the statement remains true.

They are half-way in the EU, though ;) Most EU regulations apply IIRC.

In fact Norway has typically been faster to apply EU regulations as part of its EEA membership than most actual EU countries....

What has less value than pocket change? Because that's what this fine is to Meta or Big Tech in general. And how exactly is Norway pointing the way when other EU states such as Italy, Ireland, France etc have imposed similar fines to Alphabet and/or Meta in the past?

Is it actually changing anything though, or are Meta just paying the fine and continuing their merry way?

Reply on news.ycombinator.com