Does this still apply if there are separate legal entities for US & EU operations? Take Hetzner as an example. They have a separate US company to deal with their US data center. Would their EU servers be vulnerable to the CLOUD Act?
Similar happened already with OVH Canada vs France.
> In an affidavit, Xavier Barriere, corporate counsel at OVH in Paris, describes the dramatic situation: If the important proponent of European data sovereignty were to comply with the Canadian order, those responsible in France would be committing a criminal offense. They face up to six months in prison and fines of up to 90,000 euros per violation. However, if OVH ignores the Canadian court, it faces contempt of court proceedings in Ontario, which can also lead to severe sanctions.
https://www.heise.de/en/news/Canadian-Court-OVHcloud-from-Fr...
And one comment here: https://news.ycombinator.com/item?id=46060903
What can you do about it? FDE? Can you keep the keys away from Hetzner? How much hacking would they need to do to get them? Can US government break SecureBoot?
Im just happy my business is not important enough
The only way to spin this as hetzner is to go public with this and make it a political point for geopolitics between the EU and the US, and take the loss /call the bluff on the US threat.
I don't think any of us have the total picture, but the bits that I do have are sufficient to worry me about the degree to which I am automatically breaking the NDAs I sign by using a computer, email, online data rooms and so on.
A difference could be that Germany might not have such blocking law as France. At least I have never heard of it.
If it had been the European one that was the subsidiary, then Canada could order the OVH parent company to order the subsidiary to do things.