Europe's highest court has rejected the 'safe harbor' agreement

http://uk.businessinsider.com/european-court-of-justice-safe-harbor-ruling-2015-10

by noplay • 11 years ago

563 297 11 years ago

uk.businessinsider.com

The full ruling is available here: http://www.politico.eu/wp-content/uploads/2015/10/schrems-ju...

These bit jumped out at me: >Furthermore, national security, public interest and law enforcement requirements of the United States prevail over the safe harbour scheme, so that United States undertakings are bound to disregard, without limitation, the protective rules laid down by that scheme where they conflict with such requirements. The United States safe harbour scheme thus enables interference, by United States public authorities, with the fundamental rights of persons, and the Commission decision does not refer either to the existence, in the United States, of rules intended to limit any such interference or to the existence of effective legal protection against the interference.

This judgment has the consequence that the Irish supervisory authority is required to examine Mr Schrems’ complaint with all due diligence and, at the conclusion of its investigation, is to decide whether, pursuant to the directive, transfer of the data of Facebook’s European subscribers to the United States should be suspended on the ground that that country does not afford an adequate level of protection of personal data.

My reading (not a legal expert) is that data residency is the important bit here. Which in my view is a small step but not sufficient.

armada651• 11 years ago

I think it means a lot more than just data residency. Without the safe harbor agreement you can no longer avoid EU privacy regulations by storing the data in the US.

This means that a lot of US companies are now exposed to EU privacy regulations where previously they only had to account for US privacy regulations.

The US privacy regulations are no longer considered compatible with the EU privacy regulations. That has much more impact than just data residency.

cm21872• 11 years ago

What I am curious about is how do we define "doing business in the EU"? If I am american, create a blog stored in the US, and allow users to register an account to comment on the blog, am I doing business in the EU if a EU person creates an account or are my visitors more akin to foreign tourists visiting a US shop in the US and therefore outside the reach of EU regulation?

In the financial sector, the extra-territoriality of US laws has been a problem for decades. Securities issued in the EU, by EU entities and marketed to EU investors end up having some language referring to which US regulation they fall under out of fear that a US person will end up buying it, and the US applying their laws and regulations.

throwaway77672• 11 years ago

The end of the article makes it sound like just adding a clause to the terms & conditions saying the user agrees to his data being stored in the US would be enough to bypass this. They just can't assume they have that right under safe harbour.

Hopefully they'll restrict that and require a higher threshold for consent than someone clicking "I agree" to 100 pages of dense legalese.

richmarr• 11 years ago

Without the safe harbor agreement you can no longer avoid EU privacy regulations by storing the data in the US.

Maybe I'm missing something here.

My understanding is that the Safe Harbour agreement wasn't a mechanism for US companies to avoid EU data protection regulations... it was a certification that they did comply with EU data protection (particularly in situations where that data was transmitted outside the EU).

Now it's gone, EU customer data held by US companies will be governed by national data protection laws instead, so may end up having to be stored within the EU.

The US privacy regulations are no longer considered compatible with the EU privacy regulations

I don't think they ever were, which is why the Safe Harbour needed to exist in the first place.

WhoBeI2• 11 years ago

US privacy regulations where not considered compatible with EU ones before the ruling either.

The agreement was that US companies sign a list with the US Dept. of Commerce that they considered themselves in compliance with EU regulations when handling EU citizen data and that would give legal immunity to them and their subsidiaries in the EU.

This ruling means that EU countries are now allowed to check if they are lying or not.

kuschku5• 11 years ago

This is going to be funny. Time to sue every website that includes Google Analytics today.

As, obviously, this ruling means no one – not even your website – may give out my data to US entities, including Google. So any type of tracking like that is now illegal.

IANAL.

lwyr• 11 years ago

That's the press release, which is a good summary, but not the actual judgment. The judgment is available at: http://curia.europa.eu/juris/documents.jsf?num=C-362/14

junto• 11 years ago

Did anyone else notice the following as a distinct bias?

  Max Schrems, an Austrian lawyer and privacy activist, has 
  done everything he can over the last several years to be a 
  thorn in Facebook’s side.

My alternative perspective:

  Max Schrems, an Austrian lawyer and privacy activist, has 
  done everything he can over the last several years to protect the
  rights of European citizens whose privacy has been abused and
  invaded by US firms.

axx2• 11 years ago

European citizen here, and as much as i welcome a step like this, it's also pretty interesting to see, what this means for smaller (online) businesses outside of europe.

Sure, you want to host customer data from europe in europe (latency-wise) anyways, but now that this will be more or less required it will be interesting to see how people will solve this. The good thing is, with "the cloud" you have a lot of option (locations) to choose from.

pjmlp• 11 years ago

Also European citzen here, I also appreciate the ruling.

It is already an interesting experience trying to explain to off-shore companies that they cannot just take our data like that.

Well they can in practice, but then better prepare some good explanations in case the company gets a security audit from the local government.

Niten3• 11 years ago

It's interesting to see the regional differences in this discussion, because that attitude is pretty foreign to the way I think about the Internet.

I know that if I use Yandex, at least some of my data is going to reside in Russia. If Dailymotion, France. I consider it up to me as a consumer to decide whether that's what I really want. I don't consider it my local government's job to force those companies to change their business models.

estefan6• 11 years ago

Yeah good luck setting up a startup now. If other countries follow Russia's suit, we'll soon end up having to somehow determine where a user is from (what if they're roaming, etc.?) so we can shard the datastore across multiple geographic locations. So obviously this = increased costs & complexity which will slow the speed of iteration :-(

Majestic121• 11 years ago

The easiness of setting up a startup should not be held in higher regard than people's right to privacy.

thibaut_barrere4• 11 years ago

I don't know why you are downvoted. This is going to become a real concern indeed: should I have one deployment per country of sale, ultimately, etc? This is getting tricky.

scrollaway4• 11 years ago

European privacy laws are very consumer-friendly and usually very reasonable. US companies should look at those laws as a guidebook on how to get your customer's privacy right in the US as well.

You build houses - think of it like fire safety rules. "What do you mean I have to keep track of all the fire safety rules for the country I build the houses in? Can't I just keep track of a set of rules of my choosing instead?" -- well, no, for one and even if you could, that'd be a bad idea. Almost universally, there's good reasons behind specific rules in the fire code. (And in the rarer cases the rules really are broken, that's a problem with the law, but not one that can't be fixed).

Unfortunately, most companies don't give a rat about their customers' privacy (we care deeply about it we swear). What really should happen instead is that US customers demand laws like the ones we have in Europe.

weland• 11 years ago

Yeah good luck setting up a startup now. If other countries follow Russia's suit, we'll soon end up having to somehow determine where a user is from (what if they're roaming, etc.?) so we can shard the datastore across multiple geographic locations.

Or just host everything in Europe.

Or lobby Congress to stop shitting all over privacy so that the US can be considered a safe harbour again.

deskamess• 11 years ago

Or you could work on starting a startup that helps to 'store stuff in their geographic region' as a service. And let all the other startups leverage your service.

k__• 11 years ago

As a European citizen, I appreciate the ruling, too.

It's sad to see how the judges of the courts are more on the side of the people than the politicians they elected...

jpgvm• 11 years ago

This is actually very common. Politicians have to care about getting re-elected, and that often means chasing after campaign contributions more so than it does actually being on the side of the people.

Judges usually have tenure, this makes a huge difference to someones impartiality.

cLeEOGPw• 11 years ago

What I see here is just a simple data center service which offers to store company data and ensures in complies with EU requirements for these countries. If each country has different laws that require data to store physically in that country's location, then it's just a matter of setting up at least one such data center in each country and provide storage for any company willing to do business. Then you can make service order in bundles with multiple countries and that's it.

lagadu5• 11 years ago

Pretty similar to what the big IaaS and PaaS like MS and Amazon already do with their regions.

weddpros12• 11 years ago

_with "the cloud" you have a lot of option (locations) to choose from_

Without replication between locations, you're stuck: replication IS data transfer.

With such a ruling, you can't implement an intercontinental social network anymore.

madez• 11 years ago

You can replicate within groups of datacenters which fall under the same privacy rules. Thats more than enough to run a centralized global social network, even though I'd love it for making it impossible.

rbehrends6• 11 years ago

European citizen here, and as much as i welcome a step like this, it's also pretty interesting to see, what this means for smaller (online) businesses outside of europe.

I'm not sure if it means anything for them. If a company does not have a business presence in the EU, it likely isn't subject to EU jurisdiction at all. This case happened because Facebook is a multinational company with a European subsidiary in Ireland and was sued before the Irish courts. Companies that may be affected by this are:

* Multinationals that exchange personal data between their US and their EU branches.

* Companies in the EU that are in a business relationship with companies in the US and as part of that business relationship send personal data to the US.

* Companies in the EU that avail themselves of US data centers and store personal data in those data centers.

rmc2• 11 years ago

was sued before the Irish courts

Actually they were sued before the European courts. Specially the European Court of Justice, which is in Luxembourg. I don't believe there was any case in the Irish courts.

lagadu5• 11 years ago

You're forgetting an important group:

Non-European companies that get paid for services rendered to EU citizens or countries.

If found to be violating laws, the ECJ can order banks to block payments made to those companies from within the EU, which harms their bottom lines between nothing and a lot.

hoorayimhelping• 11 years ago

This seems less about privacy and doing what's right for EU citizens and more about European countries enacting some kind of protection scheme to give American companies a disadvantage when doing business there.

onnoonno3• 11 years ago

In a more cynical light, maybe build up some 'value' that can then be 'traded' in a US/EU TTIP deal?

"Look, the EU is reasonable and wants to get rid of the cookie ruling and the high bar for startups on geographical server requirements - TTIP would allow all this to happen!"

SimplyUseless• 11 years ago

While this is a massive ruling, there are valid exceptions that allow companies who have agreed with their clients to transmit their data from EU to US while keeping data separation and with respect to the data protection law.

This is not a blanket-panic for all US/EU companies as the media are projecting.

chopin• 11 years ago

The difference to Safe Harbour is that the client can revoke their consent at any time. After that the data must be pulled off US servers.

If I ask Facebook to delete my data, they are absolutely bound by this. There is no legal way anymore to just hide the data from me.

lucaspiller• 11 years ago

Salesforce has put up a page for you to give them the permission to do exactly this.

http://www.salesforce.com/company/privacy/data-processing-ad...

What if I don't want my data going to the US though?

a_bonobo• 11 years ago

This is good, and a direct result of the Snowden revelations - without those, the US would still considered to be a safe harbor for your data. I'm hopeful that this will create the kick that the US needed, now that actual income (and high income, at that) is becoming threatened by the NSA. Of course this isn't the end to their data theft. They're likely to get the data from their Five Eyes European friends instead, but still - a good victory.

Amazing to see what one determined person can do!

rurban• 11 years ago

Sure. The next step would be to demand EU nations which violate the safe harbor EU rules be either thrown out of the EU (GB, but probably also Neitherlands, Sweden and Denmark), or fix their privacy laws. It cannot be that the GHCQ acts on behalf of the US on EU data and allows easy circumvention of basic privacy principles.

pjc5011• 11 years ago

Sadly, the data protection laws have always had "national security" exemptions.

M2Ys4U6• 11 years ago

The next step would be to demand EU nations which violate the safe harbor EU rules be either thrown out of the EU

There is no safe habor inside the EU because EU privacy law already applies there and the regular legal mechanisms apply.

walterbell2• 11 years ago

Meanwhile, TPP prohibits countries from having data sovereignty laws, http://www.zdnet.com/article/tpp-moves-toward-killing-off-go..., with similar prohibitions sought in TTIP and TISA, https://blog.ffii.org/a-license-to-spy-cross-border-data-flo...

"Governments in Australia, the United States, New Zealand, Canada, Singapore, Vietnam, Malaysia, Japan, Mexico, Peru, Brunei, and Chile will be unable to force companies from those countries to store government data in local datacentres ... governments will not only be prevented from mandating data sovereignty provision, they will also be unable to demand access to source code from companies incorporated in TPP territories."

toyg• 11 years ago

It's incredible how deep the ideological split is, on data protection and surveillance. On one side, you have lawyers saying "hey, this is a problem, this law says you can't do that, we have to find ways to make you comply"; and on the other you have business lobbies and security agencies saying "hey, this is a problem, we need to remove all laws".

PythonicAlpha2• 11 years ago

Of course, the business lobbies say that.

Restricting laws are always costly: Environment laws for example -- how costly it is, not to be able to pollute the air, the water, the people. Have filters, have restrictions, use of alternative fuels ... this all costs. And reduces the growth rates of our economies .... Better remove those laws and instead install strict intellectual property laws with unrestricted duration of protection.

That is, how (capitalistic) economy works: Put the costs of the business on the shoulder of many (the people of the country) and the benefits (the profits) on few people.

simonh5• 11 years ago

Maybe I'm reaching a bit too far, but we're mainly discussing this in the context of non-US resident's data being transferred to the US, without their say so, where the NSA then does whatever it likes with it. But surely this treaty goes both ways? Doesn't it also allow US citizen's data to be transferred to Vietnam etc, without the person's permission, under their legal framework and their government and commercial agencies get to do what they like with it according to their laws? And the US government is ok with that?

Unless I'm missing something, the US government (and NZ, and Australian, etc) just completely sold out their citizen's privacy to a whole bunch foreign nations including a communist dictatorship. Wow.

MichaelGG7• 11 years ago

I don't think so. What it is saying is that if a Vietnam-based cloud company sets up shop, the US cannot mandate that it keep US customer data on US servers. I can see why the US wants this: They want everyone's data in the US. What I cannot see is why anyone else would agree to this.

My guess is that what it really means is that such companies are allowed to operate. OK, fine. But no one is forced to use them. So the US might say "Nice service, Vietnam. But we won't buy it unless you put servers in the US." They aren't forcing anyone to do anything.

pjc5011• 11 years ago

This has never been illegal in the US, and in fact has been happening for a while. The US has no general privacy law, and the First Amendment is usually construed against privacy.

(There are some narrowly focused privacy laws like HIPAA)

https://www.fdic.gov/regulations/examinations/offshore/ :

"Few legal restrictions exist on financial service companies sending customer data to foreign countries. Financial institution customers may not opt out of these information transfers to nonaffiliated service providers if the transfer is for a purpose described in section 502(e) of the Gramm-Leach-Bliley Act (GLBA). For example, the opportunity to opt out does not apply where the information transfer is to: (1) service or process a financial product or service that the customer requested or authorized; or (2) maintain or service the customer's account."

codedokode5• 11 years ago

But surely this treaty goes both ways?

No it doesn't de facto because the biggest (by user count) internet services are based and operated from USA, e.g. Google, Apple, Microsoft, Ebay, Youtube, Twitter, Uber etc. And it probably will not change in the future. So keeping current situation is good for USA and bad for everyone else.

It is better to have local services so the money and personal data don't go overseas and help local economy. The current situation is obviously wrong. There are customs duties that protect local companies and there is nothing to protect them in the internet. So we have USA taking over this new market. This should be changed.

China is an example of a country that has their own search engine, blogging platforms, video sharing sites and most of people prefer them over USA based websites.

just completely sold out their citizen's privacy to a whole bunch foreign nations including a communist dictatorship.

No they did not because nobody uses services from those countries.

MichaelGG7• 11 years ago

"The 12 parties also agree not to require that TPP companies build datacenters to store data as a condition for operating in a TPP market, and, in addition, that source code of software is not required to be transferred or accessed."

Stated that way, it sounds far more reasonable. Source code, yeah of course. You don't want country X being able to demand country Y's company's source right?

And the data centre requirement also makes sense. You can't lock out online competitors on grounds that they aren't setting up local servers. But I don't see anything that mandates you must buy from such a service. If Mexico starts a cloud hosting company and refuses to run Canadian servers, Canada is under no obligation to buy such service. They just can't ban the service for not having Canada-based servers.

The article states that Russia's law requiring Russian personal info to be stored in Russia would be banned if Russia was in the TPP. But they don't state the language used there. It wouldn't be surprising if all other rules and regulations apply. It wouldn't make sense if, say, HIPAA didn't apply to foreign-country clouds under TPP. And if HIPAA applies, then why wouldn't other privacy regs?

rwmj• 11 years ago

Source code, yeah of course. You don't want country X being able to demand country Y's company's source right?

If it's a public safety matter, then yes I do actually.

venomsnake2• 11 years ago

Stated that way, it sounds far more reasonable. Source code, yeah of course. You don't want country X being able to demand country Y's company's source right?

I do. Company X is totally free to not operate. My citizens well being or my ability to oppress my own people - depending on the type of country, trumps Y's company rights to make profit from my people.

mtgx4• 11 years ago

TPP doesn't apply to EU, but TTIP and TISA do, and indeed they could also be used as a "backdoor" for the US to get the data anyway.

At the very least we may see that the TTIP Tribunal would override ECJ rulings (terrible idea for obvious reasons), but I'm hoping that if such an agreement is passed, the ECJ would also rule it invalid for not being in accordance with EU regulations and the fundamental charter of human rights.

pas• 11 years ago

Do we have some sources on this? And aren't the proposed Tribunal for ISDS arbitration (where companies can protest/appeal laws and court rulings that treat foreign companies on an unequal footing to domestic or other special status ones)?

kornakiewicz2• 11 years ago

Prohibition of storing behavioral data would be great next step.

Oletros11• 11 years ago

Why?

kornakiewicz2• 11 years ago

Because storing and processing data that about user who is unconscious that such are even collected is de facto spying?

neppo• 11 years ago

off topic, but why does the article use a picture of Mark Zuckerberg with lip stick photoshopped on?

blisterpeanuts• 11 years ago

I was going to ask the same question! Is it some kind of rendering incompatibility between this jpeg and most browsers, or just a really crappy photography touch-up job?

weddpros12• 11 years ago

Edit: I'm reacting to "Facebook and Twitter [...] could be forced to host European user data in Europe"

Border control with data is the worst idea ever.

Think of it: my Facebook friends lists has EU and US people in it. This list can't reside in EU or US. This webpage can't be served by either a EU or US web-server. By law. LOL

Plus I'm a EU citizen, and I can choose to give my data to whoever I want... no more. That's sad.

This ruling only shows the dismal tech knowledge of lawyers and lawmakers. It's impossible to implement Facebook with data spread between EU and US. Same for Tweeter and others. Say goodbye to social networks. Because of model denormalization, because of network latency and intercontinental bandwidth.

Some mention cloud zones, but they're only useful with replication, which IS data transfer.

OR... social networks will cheat. And one day, they'll be sued for cheating the impossible regulations (think VW...)

Oletros11• 11 years ago

You can't be more wrong in your claims

weddpros12• 11 years ago

Please tell me how. We can surely debate the technicalities.

pjc5011• 11 years ago

This webpage can't be served by either a EU or US web-server.

It's not bidirectional: you could keep it in the EU and serve it from there.

weddpros12• 11 years ago

you assume the US would be OK with hosting US data in Europe...

simonh5• 11 years ago

Think of it: my Facebook friends lists has EU and US people in it. This list can't reside in EU or US.

I think you're misunderstanding the ownership of the data, hence the down votes. If I as an EU citizen create a private friends list like this, that list belongs to me. If I live in the EU but create the list using a US service with servers in the US, there is no problem. US privacy laws apply. If I create the list using an EU service on EU hosted servers there is no problem, EU privacy laws apply. However in this second case if the internet service company wants to transfer the list from their EU servers to their US servers without my explicit permission, that's a problem.

estefan6• 11 years ago

I think the parent is getting at if you're in the EU and your data cannot be transferred to the US, and a friend in the US has data that cannot be transferred to the EU (if they were to follow suit) you wouldn't be able to create a list of friends in both localities because of the restriction to send data around, without incurring intercontinental latencies. Obviously the list itself could reside in either location, but the service provider would need to perform an intercontinental join each time you wanted to view the names of friends in your list.

weddpros12• 11 years ago

Imagine I'm in the EU, and Facebook wants to store my data in the EU. But I'm friend with US people. So I'm in their own friend list too, which is stored in the USA. So my data is needed in the USA too.

When I publish something in Europe, my friends needs to see it too in the USA. And you can't build a Facebook wall with intercontinental latencies. You need replication.

It's a social graph, and you can't split it between US and EU: data has to be replicated across borders (or face massive latency and bandwidth).

forrestthewoods• 11 years ago

"that list belongs to me."

Those words don't actually mean anything.

rbehrends6• 11 years ago

The judgment does not prevent you from storing personal data in the US per se. It only nullifies the blank check of the safe harbor provision. As far as I can tell, there's nothing preventing Facebook from obtaining consent from you using Model Contract Clauses or Binding Corporate Rules, for example. This is already normal for companies from countries that do not enjoy the benefits of a safe harbor provision, after all.

weddpros12• 11 years ago

If it's just a problem with Facebook's contract, all is well.

But the article says "Facebook and Twitter [...] could be forced to host European user data in Europe".

That's way more agressive than just a contract change and poses a threat of technical blocking problems.

mhandley• 11 years ago

I wonder if there are additional ramifications of this, even for European companies dealing with European customers. For example, what happens when personal data from a European datacentre to a European customer transits a US network on the way (such routing diversions are fairly common)? In the light of Snowden's revelations, this would seem incompatible with EU privacy regulations unless the data were encrypted. Of course personal data should always be encrypted, but where are the CAs located? Is a European company negligent if they don't use a European CA and do certificate pinning? Interesting times.

julianpye• 11 years ago

Does this effectively render any Parse or Firebase application (they only have US servers) that stores user information (e.g. email account) illegal in the EU?

kuschku5• 11 years ago

I am not a lawyer, so do not take this as legal advice, please consult a lawyer if you want actual advice.

This said: Probably yes. EU data laws are mostly about private information, for example private chat messages, etc.

If you only store email accounts, you might get around the laws, but if you store anything like payment information, communication between users, etc, you effectively now have to follow EU data laws, which mean: You can’t give any third party (not even your government or hoster) access, you can’t store it in countries where the government might just seize your data (like the US), etc.

rmc2• 11 years ago

Americans: This is time to get your government to change your laws if you still want to be the leader in the tech field.

sarciszewski• 11 years ago

Even if we adopted identical laws, the government would just ignore them. We're a nation of criminals.

IBM• 11 years ago

It's interesting that certain bloggers such as Dustin Curtis and Ben Thompson have claimed that Apple's privacy stance will ultimately hurt them because they'll be at a disadvantage to competitors, but it seems like they've shown some real foresight when you take this ruling into consideration.

Oletros11• 11 years ago

How this ruling affects differently Apple from Facebook or Google?

tomp4• 11 years ago

Apple's business isn't based on exploiting the user's data and shitting all over their users' privacy (as has been the case with Facebook in the past, and Google too to some extent), and they've taken explicit steps to safeguard their users' privacy (e.g. encryption, ad-blocking).

tdkl• 11 years ago

They make majority of their revenue from hardware, not services.

rogeryu2• 11 years ago

Apple is about hardware, not about data. They can more easily move European user accounts to Ireland. It will affect their business less.

MichaelGG7• 11 years ago

This sounds great! Though if the owning company is in the US, then the US views this as reason to be able to access customer data no matter where its stored. More fun to come mm?

Question: Why do companies HQ themselves in the US? Why not pick a friendlier country, then turn their US parts into a simple contractor that supplies software development and engineering resources? Then the US company would not have actual ownership of any data. Forcing them to reveal customer records would be the same as forcing an individual to steal data right?

lagadu5• 11 years ago

Because the bigger companies were established long ago, when the US had the much bigger market.

Nowadays that's not true but the US startup VC is a lot stronger in the US for a bunch of reasons, so new startups tend to be established there much more often (with the financial tech field being the exception I believe). If you're making a new company you're going to make it where you live just out of sheer convenience.

saalweachter2• 11 years ago

https://xkcd.com/1053/

Today you get to learn about: American Exceptionalism!

It is important to realize that, within the US, there is essentially a universal belief that the US is the best place to live, work, or be in the entire world. The debate is not so much whether the universe revolves around the United States, but which city exactly the axis passes through -- New York, DC, San Francisco, LA. It is very important that a universal axis has a commonly used two letter acronym, which is why not even a Chicagoan seriously believes the axis is through Chicago.

When the EU makes privacy complaints against US companies, the common perception -- even among US citizens who disapprove of domestic spying programs -- is that something is wrong with the EU. The idea that the EU could be right to hold a US corporation accountable to their laws never even occurs.

No American could ever conceive of establishing the HQ of a US corporation outside the US -- except maybe as part of a skeevy tax dodge. The US is the best place in the world to live, work, and run a business. Why would you want to go anywhere else? To be fair, most of the US companies that do establish some sort of off-shore setup are engaging in some sort of skeevy tax dodge.

MichaelGG7• 11 years ago

I mean I know a lot of "common" people believe that - I've lived in the US in the past. But I thought once a lot of money was on the line, reality or cynicism would set in.

RaleyField2• 11 years ago

No American could ever conceive of establishing the HQ of a US corporation outside the US

Maybe incorporation in US really is better, at least for US citizens. It's easier to deal with local courts than foreign courts. If your European subsidy runs afoul of some regulation in a major way then they probably can't take your assets from your US based parent company. Then US is arguably more business friendly in many ways.

AndrewKemendo3• 11 years ago

Why do companies HQ themselves in the US?

At least in the tech sector...because the U.S. currently has, by far, the most venture money [1] and the largest addressable market[2].

[1]http://pitchbook.com/pr_20150109_1.html [2]http://techcrunch.com/2011/12/23/flurry-largest-addressable-... (slightly old)

MichaelGG7• 11 years ago

But what stops them from a: switching HQ, or b: starting in another country? It's not like the US has serious currency export restrictions, right? And little stops a company overseas to do business in the US, right?

finnjohnsen2• 11 years ago

Perhaps it's time to p2p everything.

nabla9• 11 years ago

My reading of the judgment is that it just throws the decision back to the national courts to decide what constitutes safe harbor. Safe Harbour agreement between US and EU streamlined the process for getting access to EU data. Now it mus be decided in national level.

http://www.politico.eu/wp-content/uploads/2015/10/schrems-ju...

mtgx4• 11 years ago

Couldn't we get a better source than Business Insider?

asgard1024• 11 years ago

For example: http://www.theguardian.com/world/2015/oct/06/us-digital-data...

UserRights• 11 years ago

The "good" companies should relocate their business central away from USA and come to Europe!

Some big companies should finally stop talking and start acting, this is the only chance for a real change.

Cut the NSA-Brotherhood ties! These little Hitlers from all the affiliated "Clubs of Distopians" and the War-Industry completely destroyed the most important association of "USA == Freedom" in the world. Face it. Deal with it. Act accordingly.

For people interested in history: it might be interesting to look at the post-ww-2 de-Nazification process in germany to understand how hard it is to remove established circles of anti-democratic bureaucrats from power structures. This will take a very long time (if it happens at all).

The better immediate reaction would be to support progressive and freedom-oriented societies with your technical powers until "good old USA" is restored. Europe is not perfect, but what happens in USA nowadays is pure distopia, a very unhealthy development that will lead to a negative outcome for all of us.

Once people came to The USA because of suppression and lack of freedom in their home countries. Just a few generations later if you have the same sense and longing for freedom like these ancestors of you, it is now time to leave that continent as the suppressors followed your trails - come home to Europe and together we can build a better future!

makeitsuckless• 11 years ago

It's interesting how this is described as a potential "bureaucratic nightmare". Having to follow the law of the country your doing business in has been standard operating procedure for, well, basically all of human history.

Somehow the tech industry seems to think it should be exempt from that, even if it means being allowed to piss all over the basic civil rights of citizens of modern Western democracies.

Yes, this is a problem that needs to be solved given the reality modern cross-border online services. But it can't be solved by the corrupt political elite simply selling their citizens hard fought rights to corporations operating from countries that lack respect for such rights.

davidw• 11 years ago

What sucks about it is that the EU, rather than presenting one set of rules and regulations to follow, and, say, allowing you to host data within the EU to be compliant, seems to have kicked the question down to individual European countries, each of which might do something different.

And you wonder why it's tougher to do startups in Europe...

I'm pleased by what the ruling says about the NSA and the pressure it puts on the need for reform, but less than pleased about the practical implications.

M2Ys4U6• 11 years ago

Well the data protection principles are common across the EU - so there's only limited scope for national DPAs to disagree and there's always the opportunity to ask the ECJ for a ruling to clarify.

mtgx4• 11 years ago

The average consumer will not see any restrictions in daily use, but will hopefully soon be able to use online services without potentially being subject to mass surveillance
However, US companies that obviously aided US mass surveillance (e.g. Apple, Google, Facebook, Microsoft and Yahoo) may face serious legal consequences from this ruling when data protection authorities of 28 member states review their cooperation with US spy agencies.

Can't wait. This is going to be good.

http://www.europe-v-facebook.org/CJEU_IR.pdf

unfamiliar2• 11 years ago

That could be a bureaucratic nightmare: In theory, American companies with European customers could now end up trying to follow 20 or more different sets of national data privacy regulations.

Good. If you want to be a multinational company, then you should have to obey the laws of each country.

rogeryu2• 11 years ago

It's moderate punishment for abuse of power. And I don't mean here that Google or Faceboo is the abuser here - it's the American government.

coldcode• 11 years ago

Good. If you want to be a multinational company, then you should have to obey the laws of each country

Good luck with that. If the US mandates you do X and EU mandates you do !X.

unfamiliar2• 11 years ago

So, lets say for example that the US requires that you keep data on customers so that law enforcement can use it, but the EU requires that you don't so that privacy is protected.

Are you are suggesting that one of those laws should be changed to make it easier for multinational companies to operate, even though there was a good reason for the law in the first place? Because I would say that if the company absolutely has to keep customer data then they shouldn't operate in a country where that is illegal, and if they refuse to keep customer data then they shouldn't be operating in the country where it is required.

VikingCoder9• 11 years ago

No, this is terrible.

These countries are demanding we run our services in their countries. This is a money grab.

Note that these same countries expect the United States to act as World Police, and do not contribute as much money as they should. They want the US to know about attacks ahead of time. I wonder how the US could possibly know about attacks ahead of time?

I deplore mass surveillance. I really do. But I think wiretapping with a warrant is a necessary tool for fighting crime, and terror, and bad state actors.

There's a part of me that desperately hopes all major internet services just shut off Europe entirely. Welcome back to the Stone Age.

tljr• 11 years ago

"Note that these same countries expect the United States to act as World Police".

Nobody (except some Americans) want this.

"I deplore mass surveillance. I really do. But I think wiretapping with a warrant is a necessary tool for fighting crime, and terror, and bad state actors."

I hate X but Y is necessary (because I said so) so let's do X anyway.

"There's a part of me that desperately hopes all major internet services just shut off Europe entirely. Welcome back to the Stone Age."

If by stone age, you mean 2006, great.

the-dude2• 11 years ago

Note that these same countries expect the United States to act as World Police,

Why do you think that? And how about https://en.wikipedia.org/wiki/United_States_and_the_United_N...

I am actually appalled the Netherlands actually contributed to your shitty conflicts.

VikingCoder9• 11 years ago

Wow a billion dollars. That would pay for about 60 seconds of the war against the Taliban.

flatline• 11 years ago

The US finds out about attacks ahead of time the same way we always have: through intelligence operations, not data mining. I don't think anyone is saying that targeted, legal wire tapping is somehow off-limits now. I don't see how this would impact the ability of a company to assist the authorities in monitoring individuals' communications, either - it will, possibly, make it more difficult for the NSA to do a blanket gathering of foreign communications, which I believe is the point.

Large service providers like Google and Amazon can and will comply with the laws. It is possible that social media start-ups will be unable to operate across borders due to regulations, but this will hardly be a staggering setback to the European populace's ability to share photos of their food. I doubt there are any real implications for things like freedom of speech/expression: these types of services are already effectively illegal in places with heavily authoritarian governments.

VikingCoder9• 11 years ago

Congratulations. We just broke the INTERNET part of the internet.

Only large service providers will be able to comply with all of the laws. Why are we patting ourselves on the backs for this?

Niten3• 11 years ago

It is possible that social media start-ups will be unable to operate across borders due to regulations, but this will hardly be a staggering setback to the European populace's ability to share photos of their food.

There will be services that have not yet been invented. We cannot presume to know what they'll look like, but there's a big chance the startups that invent them will be harmed by this ruling. No, big services run by established players will not die, but that's hardly the point.

pjc5011• 11 years ago

Wiretapping with a warrant is not obstructed by this, of course: it might require a bit of crossborder co-operation to get an EU warrant for the data of an EU national, but it's still possible to tap a specific user for law enforcement purposes.

What's not legal is warantless universal wiretapping.

(Also, I don't want the US to be "world police"! Like US domestic police they are far too trigger-happy. And the US is one of the few countries not signed up to the International Criminal Court. Would you want a police without a court?)

VikingCoder9• 11 years ago

Crossborder co-operation? Great!

They hand over Roman Polanski, and we're off to a good start.

What's not legal is warantless universal wiretapping.

So punish the government of the United States - not the businesses.

Would you want a police without a court?

That's called "a military." And yes, I want a military. And since our enemies don't bother to dress up in bright-colored uniforms, and stand in a row in a field anymore, our military needs to be a lot more nimble. And since our international efforts (the UN) are often blocked by one or two security council members, I'm not impressed with the UN's ability to keep the peace.

jacquesm3• 11 years ago

This is a money grab.

No, it really isn't. It won't be effective but the judge here is not aiming for EU companies to earn more money.

There's a part of me that desperately hopes all major internet services just shut off Europe entirely. Welcome back to the Stone Age.

Economies have becomes so intertwined that shutting Europe 'off the internet' by any other party (presumably the US or the rest of the world) is no longer feasible. It will backfire tremendously on those doing the shutting off.

Besides that, you wouldn't really shut the internet down, merely split it. Even North Korea has internet access.

VikingCoder9• 11 years ago

Have you looked at prices for data centers in Europe versus the US? Or their incompetence?

Economies have becomes so intertwined that shutting Europe 'off the internet' by any other party

BS. Google shut off China. Independent companies are free to not do business anywhere the laws are stifling. I think it would be awesome if they did it all at once. Internet Blackout for Europe.

tobltobs• 11 years ago

World police? World arsonist would describe it better.

dang2• 11 years ago

We detached this comment from https://news.ycombinator.com/item?id=10337519 and marked it off-topic.

VikingCoder9• 11 years ago

I appreciate your efforts to make Hacker News great, but I think this action is heavy-handed.

The court's decision hurts the internet, hurts small companies on the internet, and hurts the ability of the United States to fight terrorism.

I may not have worded this opinion particularly well, but it's ridiculous that my comment cannot even be expressed.

karavelov• 11 years ago

This is just small victory. AFAIK, US government can still ask without a court order Facebook or MS or any other US company to handle them the data of/for european citizens that hosted in Europe.

M2Ys4U6• 11 years ago

That's one thing that the GDPR (General Data Protection Regulation)[0] which is in the legislative pipeline at the moment is looking to fix.

The proposals include being able to levy a fine up to €1,000,000 or up to 5% of the annual worldwide turnover (whichever is greater) if they fail to comply with EU data protection rules.

[0] https://en.wikipedia.org/wiki/General_Data_Protection_Regula....

jsudhams• 11 years ago

This is good and I see no reason why this cannot be done easily for most corps (except the ones who mine personal data). For why would you not have critical personal data in the specific country table/database that is in that specific country. If you do not provide the service in that country and some one signs up then inform that the data is not safe and give visible warning. Is that really difficult. I used to have DB library layer earlier where based employee location it will direct their data to that location.

mcintyre19942• 11 years ago

Are you allowed to breach these rules if you provide a visible warning?

jupp0r• 11 years ago

So this is what I think will happen: a lot of companies (maybe even the likes of facebook and google) will move out of europe and just serve everything from the US. There is not really an alternative to that, how could my EU-hosted facebook profile not be transferred to the US so my friends can see my book favourites?

jarek13• 11 years ago

Have you ever tried to do ad-selling on Google's scale without local sales offices?

JulianMorrison• 11 years ago

Good. Hopefully this puts pressure on the USA to rein in its out of control security state.

Aloisius2• 11 years ago

If I'm a US company that does business in the EU, is there any reason that personal information collection can't just happen through a US web server? That way it is the user who is transferring the data to the US, not the company.

Updating your name, birthday and other personal information would take an extra 100 ms in order to POST to the US, but it could then be replicated back out to the EU for reads if necessary for performance.

AlphaSite• 11 years ago

Wouldn't that be the case of you're paying for a service on us soil from out with the us. Instead of providing a service in a foreign country.

M2Ys4U6• 11 years ago

EU data protection covers collection, storage and processing of data.

pinaceae• 11 years ago

well, I guess LinkedIn is hosed. and AWS which does global replication. and and and.

this ruling ignores the decentralized nature of the internet.

worst case is Europe being shut off from any tech advances, while the Pacific region from Cali to China takes off.

protomyth2• 11 years ago

Its been asked by multiple people in the thread, but I'm not clear on the answer.

If I host a website that has user accounts in the US, and do not stop people from the EU from registering, do I, with no offices outside the US, need to do something different because of this ruling?

fauigerzigerk• 11 years ago

I'm not a lawyer, but I think that if you are a US resident or the company you run is incorporated in the US without any offices or hosting in the EU, then you are not bound by EU data protection law.

blazespin• 11 years ago

Another question is what if I have a friends list and someone from europe is on it? Does that mean all of my friends data has to be stored in europe?

codedokode5• 11 years ago

List of friends probably is not personal data. Personal data are things like real name, photo, phone number, address, credit card number.

scotty79• 11 years ago

You may just put in your T&C that nobody from EU can use the site. No one will read it. No one will obey it. But it should be enough for lawyers to chase each other's tails in any case.

protomyth2• 11 years ago

That seems to me to be a bit legally fragile, but sadly probably would work.

oliwarner• 11 years ago

This only applies if you have EU users submitting data to EU servers and then you want to move that data to another jurisdiction, namely the US.

If your user is submitting their own personal information to servers outside the EU, that's their lookout. That's what seems to apply to you. Carry on. Nothing to see here.

But if they're submitting to one of your nodes within the EU, they can consider that the data will continue to benefit from the protections being in the EU affords it. Moving it to the US without their permission does not abide the EU protections.

kentonv• 11 years ago

That's not what my lawyer says. Our servers are only in the US and we were instructed that if we were to accept European customers we needed to go through the Safe Harbor process.

rntz• 11 years ago

So wait - if Facebook, Google, etc. just made sure that every time an EU user submitted personal data, it was routed to US servers rather than EU ones, they would not be in violation of EU privacy law? What if they then send that data to the EU servers?

Then (from the company's perspective) I've accomplished the same ends, at a cost to the user (latency), and gone from illegal to legal.

That seems pretty ridiculous.

learnstats2• 11 years ago

You ought to obey EU data protection law for EU registered people.

This would perhaps include deleting data that customers ask you to delete, not storing personal data without direct permission, nor when you no longer need it to provide your service, etc.

WhoBeI2• 11 years ago

No.

This only comes into effect if the data is at any time stored within EU jurisdiction.

copsarebastards3• 11 years ago

This is good for everyone's privacy. By making it difficult for businesses to centralize the storage of US and European data, the European court has incentivized businesses to pressure the US government toward laws that respect our privacy better.

peter303• 11 years ago

The Euros are jelly they did not invent profitable Big Data. So they will be putting every roadblock possible against those who did.

icebraining5• 11 years ago

By retroactively passing a Directive? I'd take time travel over big data any day!

chaitanya• 11 years ago

So we are building a messaging product for organizations. I am wondering how this can impact us if an org that uses our product has employees in both EU and US (assuming that national regulators in EU go ahead and bar personal data transfer to US).

* Will we need to partition user data based on location, even if they are in the same organization?

* What happens when a user in EU sends a message to one in US? So right now the chat history for one-on-one conversation pairs is stored in one place, does this ruling mean that now we have to duplicate this chat history for both the users?

* Even worse, what if multiple EU and US users are part of the same chat group? Is there any way we can store the group's chat history in one place?

icebraining5• 11 years ago

Sure, store it all in the EU. The US has no equivalent legislation, after all.

srj• 11 years ago

How is it possible that people don't discuss the GCHQ in the same breath as the NSA? From news reports it seems they may as well be the same agency. Keeping data out of the US isn't enough, and it's dangerous for Europeans to think that their own governments are looking out for their privacy. They should be looking instead to make encryption ubiquitous. This may be limiting corporate data storage, but I don't think this impacts intelligence gathering for the US at all.

M2Ys4U6• 11 years ago

Well it's not just about the NSA - although that is what triggered the case that this judgement is from.

Even if the NSA (and GCHQ) wasn't collecting everything, US law still wouldn't provide enough protection to comply with EU privacy norms.

erikb• 11 years ago

Great success! They should try it the other way around. Looking for the set of things they can do that are correct in the European countries and then apply it to the US as well. If the biggest argument is to simplify ruling and management then this approach would be just as good as allowing US rules to overwrite European rules, right?

codedokode5• 11 years ago

Hosting data locally in EU doesn't solve privacy problem because the servers are still operated by USA companies that can (and obviously will) share the data with NSA. The solution is to create more local services so the data never leave the country. It is also better economy-wise so the money stay in the country too.

M2Ys4U6• 11 years ago

That's one thing that the GDPR (General Data Protection Regulation)[0] which is in the legislative pipeline at the moment is looking to fix.

The proposals include being able to levy a fine up to €1,000,000 or up to 5% of the annual worldwide turnover (whichever is greater) if they fail to comply with EU data protection rules.

[0] https://en.wikipedia.org/wiki/General_Data_Protection_Regula...

codedokode5• 11 years ago

Such violation would be extremely hard to prove if the data were exported to US via secure channels.

_of• 11 years ago

I wish the title was "EU's highest court". Europe != EU.

AndrewKemendo3• 11 years ago

While this is a win for individual privacy, it does truly make scaling web services significantly harder and more costly.

Being in compliance is fairly easy for large companies, but it's going to be a challenge for startups.

cmurf2• 11 years ago

I wonder if some companies have sufficiently complex operations globally, that they end up with mutually incompatible laws and would have to either stop doing business in a country or split itself in two to continue to operate?

Europe's highest court has rejected the 'safe harbor' agreement

Related Stories