US Supreme Court Just Blew Up EU-US Data Transfers

https://noyb.eu/en/us-supreme-court-just-blew-eu-us-data-transfers

by tomwas54 • 23 days ago

263 163 23 days ago

atoav2• 23 days ago

As a European citizen I do not trust entities located in the US to not abuse my private data ever since the patriot act.

If it was me that deal would have never came to be. If some EU entity decides to use Microsoft 365 can Microsoft guarantee that it won't give access to one US government agency or another? It really can't. Because if that EU entity wants to act in accordance with EU law, this matters. This is what that deal was for. Basically the EU saying "it is okay" although it never really was okay.

IMO we in the EU need to finally start doing our own stuff that adheres to our own laws and isn't subject to the whims of a mad king. Public Money, Public Code.

rixed2• 23 days ago

Who do you want to abuse your private data then? Some administration closer to home?

It's well overdue to take seriously and put all our efforts behind the many (various but little known) local-first initiatives.

See for instance: https://elfaconsortium.eu/ It's a race against time.

frereubu• 23 days ago

Who do you want to abuse your private data then? Some administration closer to home?

This is a very bad-faith question. If you want people to take you seriously, at least give them the respect of trying to argue with a strong, good-faith interpretation of what they're saying.

nickslaughter023• 23 days ago

As a European citizen I do not trust entities located in the US to not abuse my private data ever since the patriot act.

EU is working on mandating scans of all your private encrypted messages right now. EU data protection is marketing for the gullible.

https://news.ycombinator.com/item?id=48707719

jeroenhd4• 23 days ago

A small group of people from the EU parliament is going against the wishes of the EU commission in an attempt to force through a change that contains a subsection of the bill that tries to mandate E2EE scanning.

The way this is going is definitely worrying, but what you're saying is disingenous at best.

Furthermore, even if this passes somehow, that doesn't change the fact that the US remains an unreliable partner. Now we have two governments scouring through your data instead of one.

dgellow8• 23 days ago

The EU isn’t a single entity, it’s a whole ecosystem of actors pushing their own agenda. The parliament, which represents the people, has been very clearly opposed to chat control

atoav2• 22 days ago

No news to me. Reactionary authoritarians are a threat to freedom everywhere.

sublimefire2• 23 days ago

I do not trust either but you have to at least agree that having some sort of mutually recognised data privacy framework is a good idea because the courts can enforce it then. Saying everything must be from EU is also slightly silly and we should instead have something similar like certification (cyber act ?) to ensure enough competition exists to avoid service degradation. IMO cryptography could be the answer to many privacy related issues for the cross border transfers.

Also these decisions related where the data is stored and which service is used are under control of each commercial org buying them. The risks are assessed at the end of the day and in case of any issues the providers change. Why would a publicly funded org store citizen data in the US is a question regardless of privacy laws though.

pbasista• 23 days ago

Public Money, Public Code

This seems like a very good principle to adhere to in general. Anything that is funded by the public needs to serve the public interest, in my opinion.

Putting public money into e.g. proprietary software and proprietary services that are then operated and gated by a few selected companies, for profit, with their only goal being the rent seeking via long term government contracts, is in my opinion far from being in the public's best interest.

fsflover• 21 days ago

I'm not sure why the OP didn't provide the link to the petition: https://publiccode.eu

Chu4eeno• 23 days ago

I wonder how many billions in lobbying money Schrems has cost various big companies.

The treaties and deals he has managed to torpedo by forcing courts to uphold privacy laws is insane (and impressive).

jhanschoo• 23 days ago

For the skimmer/TL;DR'er, note that this article is by an advocacy group presenting their analysis of a situation, and then advocating and taking action on it: "Next Steps: Commission must repeal EU-US deal. noyb ..."

It is not reporting on an opinion of a representative or proxy of the European Commission.

eesmith4• 23 days ago

For the skimmer, the advocacy group was founded by Maximilian Schrems, whose legal cases first got the European Court of Justice to overturn the International Safe Harbor Privacy Principles (which described how a US company could legally store private data on EU citizens), and then got the ECJ to overturn EU–US Privacy Shield, which replaced the Safe Harbor principles.

These decisions are known as Schrems I and Schrems II after the founder of this advocacy group.

The newest version of that data transfer framework is called the Trans-Atlantic Data Privacy Framework. The European Commission deemed it sufficient, in no small part because they considered it (and more specifically the Data Protection Review Court, an extrajudicial executive branch tribunal) sufficiently independent of the president.

However, in January 2025, Trump fired the Democrat members of the review court, leaving it unable to reach quorum to make decisions, which highlighted it wasn't all that independent. Now it's clearly not independent.

I don't see how a Schrems III is not in the works.

maratc5• 23 days ago

You could both be right: Shrems III could be in the works, and TLA could be presenting their legal analysis as an established fact.

In other words, (a) no, the "US Supreme Court" didn't "Just Bl[ow] Up EU-US Data Transfers" – there's nothing in the decision even remotely addressing the transfers (nor the EU!) – but (b) the situation might progress in that direction (or it might not.)

xiphias2• 23 days ago

EU needs to decide if it wants to do data processing or not.

If it’s a yes, it needs datacenters and get a lot more energy.

If no, it needs to transfer data to US for training/inferencing on it.

joe_mamba7• 23 days ago

If it’s a yes, it needs datacenters and get a lot more energy.

It can outsource its data centers abroad too like it did with its manufacturing industry.

ShinyLeftPad2• 23 days ago

or wait for the bubble to burst and come out on top.

drstewart3• 23 days ago

This. The US is playing the right move with solar panels, wait for the bubble to burst and then swoop in. Let China take the early losses.

noosphr• 23 days ago

The internet is a fad and will pass any day now.

amarant2• 23 days ago

Doing business with the US is just impossible these days. If this trend continues any further the US is gonna end up a piranha state with no allies and no business partners.

I'm really not sure what consequences that'll have for the rest of the world, but it looks like we're about to find out

recursive-call• 23 days ago

pariah: outcast, disliked

piranha: carnivorous fish

Etheryte• 23 days ago

Also piranha: Brazilian Portugese slang for hooker.

rusk5• 23 days ago

Sounds right

mistersquid• 23 days ago

piranha: carnivorous fish

Nice callout.

Neither here nor there, but many (most?) fish are carnivorous.

IncreasePosts• 23 days ago

paraná: a state/river in southern Brazil

Lucasoato• 23 days ago

Pearà: very peppery cream from Verona, served best with boiled meat

bryanrasmussen2• 23 days ago

everybody loves piranha!

rusk5• 23 days ago

The concern is not so much that the US will lose friends moreso that other business partners will become more prominent. The US has a lot of social capital to burn. I’m not certain that somebody hasn’t calculated how much they can get away with…

coffe2mug• 23 days ago

Sadly nothing will change.

- Pretty sure a large number of politicians are using claude, chatGPT etc.

- Majority of researchers in EU are dependent of all of US SV companies. There are nothing equivalent. EVen if there is mistral or other open source llms - every damn Uni/company is uploading everything to claude or open AI or gemini.

- Majority see these but just move on

- 99% of EU politicians either dont care or show apathy or worse live in a moat

- Ideally EU could have forced iphone, Google to openup. They did not.

- Same with taxation. Ireland fights EU to give tax breaks

- Its f*king broken system

0xy• 22 days ago

The EU will rely on US tech forever because it is literally not possible to create an EU alternative in that business climate. There are no major EU clouds, nor are there any major EU software services and there never will be because the EU is the worst place in the entire world for startups (try starting a company in Germany or France).

buzer2• 22 days ago

nor are there any major EU software services and there never will be

SAP and Spotify come to my mind first. Some ex-EU services include Skype and Booking.com (latter might still be counted as EU service depending on definition).

penguin_booze• 22 days ago

As long as US dollar remains the reserve currency, others will have to suck up to the US. This is why moving away from the USD is critical. Beyond that, people should pull their investments away from the US. This is difficult, however: US is the market that offers most returns (as to for how long, that remains to be seen), but it takes only a initial dominos falling.

seydor2• 23 days ago

The EU keeps trying to manifest the missing european data infrastructure via data regulation instead of outright bans and limits on american companies, the way China did it.

jimbob45• 23 days ago

Ban, limits, and regulation won’t solve a country with too many worker protections. The EU simply can’t compete in the modern globalized world.

hgtt664868• 23 days ago

slashing worker protections would do what exactly?

geraneum• 23 days ago

Reduced worker protections -[somehow]-> better worker output. /s

0dayz• 23 days ago

It's more simple than that; lack of investment due to various factors among which some are due to regulations, but also because the lower ROI you get in the USA due to corporate culture, higher cost in general (wages, energy, resources, manufacturing, etc.), slower economic growth and so on.

barnabee• 23 days ago

The only answer isn't to sink to the lowest common denominator.

Ban or tax things from the "globalised" world that are just worker/societal/environmental protection arbitrage so they're competing for the EU market on a level playing field, then we'll see who can compete.

The EU is plenty big enough to be self-sufficient if it has to and shouldn't be afraid of risking this if abusive and exploitative companies from other places don't way to pay their way.

dgellow8• 23 days ago

The EU isn’t a country, which is exactly why things are lacking vision and feel confusing. The EU is actually too decentralized and fragmented for its own good, contrary to what people whine about. We need more federalism, and an actual single market

bambax3• 23 days ago

The EU should cut all ties with the US, tax US products and impose costly (and difficult to get) visas to American citizens wanting to visit.

It won't do any of this because it has no balls and no vision.

We're doomed and it's our fault.

rusk5• 23 days ago

no balls and no vision

Seems to me they’re waiting it out. Everything could change in a presidential election and the European economy wins either way. It is an economic bloc after all.

What you describe would be what’s called “cutting off your nose to spite your face”

drstewart3• 23 days ago

Europeans should cut ties with their own fascist, Russian sympathizers leading the polls first, then worry about Americans.

AndroTux3• 23 days ago

They should, but the entire EU economy runs on US clouds. It's hard enough to get new hardware as it is (US hardware btw), so how should the EU, especially today, move to sovereign clouds within the next few years?

I'd argue every single EU business with more than five employees would be impacted by such a decision. Just pulling the plug would be economic suicide.

CalRobert9• 23 days ago

Alternately, it should roll out the red carpet for American entrepreneurs, scientists, and talent who want to try moving here and having a go of things in Europe. The Dutch American Friendship Treaty accidentally enables this and has become quite popular, but is only for one country.

danmaz742• 23 days ago

No, we shouldn't act like (stupid) children. We should enact a transition based on what we can do and when. I know that nuanced and complex solutions to complex problems don't fire up voters anywhere, but that's the only way to not shoot our own feet.

villish• 23 days ago

Why? You talk as if you've been victimized by America. I completely understand the desire for privacy and digital sovereignty, but you're talking about escalating into a full out economic war with the US. Meanwhile you personally patron American websites (such as this one) and services.

luke5441• 23 days ago

The main blocker for this was that Trump extended this to the military domain. I.e., tax US hyperscalers and Ukraine does not get US weapons/information anymore. Becoming independent from the US in the military domain will take some work.

armchairhacker3• 23 days ago

Outright bans would destroy European companies that rely on American companies. First they need to build their own infrastructure (which China has done).

shmeeed2• 23 days ago

Legislation for a ban will take years anyway, and will have sunrise/sundown provisions. This will provide ample time to build the infrastructure. But infra won't happen without mandating the transition, since market incentives will always pull against it.

The time to start this process is now.

BlueTemplar2• 23 days ago

What kind of 'infrastructure' did China have when they had "fallen out" with Google (in 2010?), that the EU does not have now ?

iamnothere2• 23 days ago

Europe has Jolla and Fairphone (who could surely work out something with GrapheneOS). Seems like the problem is will.

NoGravitas• 22 days ago

China was really only able to build out their own infrastructure because of blocking American companies starting early on, though. Europe may just be fucked...

sublimefire2• 23 days ago

Privacy laws are actually one of the very useful things that came out. It is difficult to do the same in the US because of the business lobby. It is crazy that US citizens data can be purchased in the “black” market and the used by the agencies. Leaving tech companies to self regulate is just not viable and it is proven time and time again they cannot do it.

tancop• 23 days ago

bans and limits just hurt consumers and freedom of speech. data regulation is useless as you said. what china actually did is a lot better.

they ignored decades worth of friedman inspired economic "theory" and started directly investing in their own industry. most successful chinese tech companies are a joint venture between state owned, municipal and private capital. you can get loans way under market rate if you have a good business plan in a industry the government is treating as a priority.

in america every time someone like obama or biden tried they got shut down by big money interests. any investment is bad because its "picking winners and losers". subsidies are bad because the only way to pay for them is increasing taxes and thats bad for profits. europe should never go down that path.

seydor2• 23 days ago

FWIW the EU is a basically a large subsidies-handing body. They do pick winners (like with solar companies) but it did not work.

hilariously• 21 days ago

The headline is that the US Supreme Court broke the deal that made this work, the EU was perfectly fine with an independent organization managing the problem. Blaming the EU for asking for some basic sanity is ???

nickslaughter023• 23 days ago

Europa, the official web portal of the tech sovereign European Union, will have to change their CDN provider (Amazon's CloudFront).

https://europa.eu

cesaref2• 23 days ago

Unless that site collects personal information, it's fine isn't it? This isn't about where stuff is hosted, it's about privacy.

AndroTux3• 23 days ago

IPs are personal information afaik

AndroTux3• 23 days ago

So will https://wero-wallet.eu - you know, the European alternative to VISA/MasterCard.

hahahaa3• 23 days ago

Can they even use a CDN now?

dgellow8• 23 days ago

We have European CDNs

manueltgomes• 23 days ago

Switching to EU companies is often the solution, but also we're in a tricky position in Europe since alternatives exist but can't compete with US. So finding European alternatives is possible but hard. Also EU is doing its job enforcing privacy and anti-competition laws but then American companies just say "feature not available in EU" (like Apple is doing more and more for example), making things even harder to switch. Like nick mentioned, even EU official sites use CloudFront so it's a tricky process.

shevy-java2• 23 days ago

This is even worse. For instance, in a medical university, we recently were told we need a smartphone and install an app from Google store (!!!), in order to read emails sent out by officials at the medical university. I protested to that but they had a deal already with the private company and their signature meant they had to keep on being addicted to that private company, so now I am locked out of receiving emails since for redirect you also need to have that app installed once. I don't have a smartphone though and I find it outrageous that people are forced to install it AND forced to use Google Store, for publicly funded (!!!) universities here in central Europe. Some lobbyists are currently getting very rich. I call it theft of taxpayer's money though.

dgellow8• 23 days ago

What country? Which university?

tempfile2• 23 days ago

I don't know where you are, and I'm not an expert, but a job requiring specific technology typically means it is your employer's responsibility to provide that technology. So if they signed a contract that mandates you have a smartphone, you can use your own if you like, but I think they are legally required to provide you with one if you choose not to buy one. In fact in most cases, I think they should prefer that (since the security of your personal device is very much none of their business).

I think this is kind of a ticking time bomb with a lot of companies depending on personal devices for 2FA.

soco2• 23 days ago

Which is exactly the point of the whole "sovereignty" debate: on one hand there's a lot of slop about "national interest" and "privacy" and "features" and such, and on the other hand management decides for whoever offers something (anything) cheaper and with a golf tournament on top. And then everybody moans and complains about the situation.

ethbr1• 22 days ago

Imho, the missing component here (in both the EU and US) is an individual right to access covered services.

Where "access" is specifically defined as full functionality on a device of an individual's choice, and offers safe harbor for example options. Like HTML over HTTP (without javascript) or REST APIs.

This should be built on top of existing accessibility requirements, with the goal of preventing not having a Google / Apple smartphone from being an access barrier.

"Covered services" should be defined two-fold, either by market share above a certain threshold or services that are required for normal life/studying/work (and tied to any public funding).

It should be default illegal for entities to make bargains with Google/Apple (or app developers) that exclusively rely on certified devices, except for extremely limited special circumstances.

CalRobert9• 23 days ago

European companies just ignore privacy and make their lawyers write increasingly contorted cya statements. I’ve worked in several and the idea we shouldn’t be using American hyperscalers (remember, the CLOUD act means hosting in Europe is useless) gets laughs.

rdsubhas• 23 days ago

Yeah the problem with EU is that once "compliance" becomes the only reason, lethargy kicks in. Their players stop competing because they have no incentive to, the compliance will keep them afloat.

I would assume the same here. If they are forced to move to EU just because of compliance, the alternatives would remain poor quality.

khalic• 23 days ago

This is simplistic to the point of meaninglessness

gb2d_hn• 23 days ago

Think the issue is that it was supposed to be a 'world wide web', but increasingly there's caveats to that.

znpy2• 23 days ago

the issue with EU companies is often the mindset: https://julien.danjou.info/blog/europes-cloud-problem-isnt-t...

As tech worked who has worked in US FAANGs (still in europe)... the difference is immense.

EU companies simply can't compete and will never be able to compete until they change the mindset. And the change must be pervasive, across all aspects (including IC compensation).

bryanrasmussen2• 23 days ago

if the EU furniture maker has the correct mindset and the EU tech company does not then it seems to me the conclusions fall apart

European tech imported the product ambition. It forgot to import the customer obsession that’s supposed to come with it.

The French furniture maker didn't import the customer obsession. I agree that U.S tech in these particular subsets are better at the EU doing it, and that needs to be fixed but you can't really talk about how great U.S tech is when you can also point at thousands of horrifying lack of support stories from them also.

U.S Tech has a good mindset for replacing hardware when it fails, they have a good workflow for that. The idea that they have good support however should be tempered by regular reading of some sort of online tech news aggregator.

jve• 23 days ago

Oh boy, that server story is painful to read. That ain't universal across providers. I work at european data center and was a tech and the worst SLA is like next business day and even then if our hardware is at fault, you won't be waiting for the next day for us to start taking action on it. And if you have a feeling you're left in dark, you can even pick up the phone at middle of the night to call our support and either get some status or light some fire that will prioritize the process in the pipeline (well, to actually DO something other than cold reboot at night time you may need to purchase SLA that will require involvement of higher support level at nighttime/holiday)

There are some things that I'd like to be improved in technical support side, but we are way better in "human reachability", responsiveness and "blame game" point of view than US hyperscalers.

JumpCrisscross2• 23 days ago

The gap is the same “playing not to lose” instinct I wrote about with French tech: do the minimum, follow the procedure, don’t get blamed

Oof, Exhibit B: Arianespace.

rcarmo• 23 days ago

As someone who also works for a US company with very large EU customers and partners I can attest this is completely true. Most European people on HN seem to be in the startup/SME space, so this won’t resonate, but the key point is that people who work for US companies also have zero incentive to switch to an EU company due to the mindsets we see locally.

foldr• 17 days ago

This reminds me a bit of that stuff people used to say about how China could never compete economically with the US until it embraced Western-style democracy, or about how it could copy but not innovate, etc. etc. Europe will continue being Europe, culturally speaking. Some aspects of European work culture will seem off to Americans, and vice versa. But ultimately, if the market for European cloud services grows, companies will adapt and take advantage of this.

yread• 23 days ago

Switching to EU companies is easy. Switching to EU companies that don't have American companies as sub-processors is a lot harder.

GoblinSlayer2• 23 days ago

What's hard? Just switch.

OgsyedIE• 23 days ago

The fact that they can't compete can be solved fairly easily by implementing strong trade barriers and legal penalties. Use Salesforce inside of a building in Prague instead of SAP? Police raids and charges of sanctions circumvention up the org chart.

shevy-java2• 23 days ago

So the US Supreme Court is doing here more and better for EU citizens (!!!) than the EU commission and EU courts are. Because the EU officials constantly keep on lying to EU citizens how our data is safe in the USA, which it clearly is not, even aside from Trump's brown shirts, the ICE snipers that have already killed US citizens in shootings. The world is a very strange place, but one good thing is that Trump's criminal gangster organisation has not undermined the whole US court system yet. And he is now too old and too demented to do so, so they will rally behind hugely uncharismatic losers such as eyeliner-boy "can't stop it with my make-up" Vance or "I change my opinion all the time" Mr. Rubio.

A big loser team.

jeroenhd4• 23 days ago

The US supreme court is correcting the lies the American government made when they assured the EU and its citizens that they can be trusted with their data. It's not just the EU lying, both sides are awful at this.

I don't know why the EU wants to trust the USA so bad, it's clearly unwise. It makes sense, because banning EU companies from using AWS/GCP/etc. would bankrupt the EU into a recession, but the way they're going about these things is very annoying.

That said, if the USA would actually keep its promises and adopt legislation that solves the reasons why the EU cannot give out a decent competency decision, the problem would go away entirely.

The Biden administration set up a precarious body within the government to resolve the issue rather than go through the normal lawmaking process, probably because it wouldn't go through.

dgellow8• 23 days ago

I don't know why the EU wants to trust the USA so bad, it's clearly unwise

We are too afraid of change and having to take responsibilities. Delegating to the US worked for decades, and it’s very hard to accept that we’ve done a mistake and need to take some risks ourselves. I feel it’s the same issue we have at European countries level.

But also, the EU is still a patchwork of entities that do not have a common vision of what the future should be. Hopefully losing our largest ally will push towards a closer, more federalist union. There is still so much work to do to unify the single market. I’m watching closely what is going on with the 28th regime[0] for that purpose

0: https://the28thregime.eu/

watwut3• 23 days ago

The US supreme court is correcting the lies

Nah. They are simply giving more power to Trump, power that he did not used to have and should not have. That is it. Supreme court is are advancing their own ideological goals and rewriting parts of constitution they don't like.

danmaz742• 23 days ago

don't know why the EU wants to trust the USA so bad

Because not trusting them is very expensive. But unfortunately, it's necessary.

aristofun• 22 days ago

Can someone explain me like im 10 - what exactly is the root problem here? Why all these dances (and wasted taxpayers money) with data living here or there? Isnt it (in general) just another unnecessary pain for good guys while relatively easy solvable issue for bad guys? What do I miss? Genuine question.

rayiner• 21 days ago

I find it hilarious that the potential effect on EU law didn’t factor into the arguments in this case on either side. I’m not sure anybody involved even knew that the EU relied on FTC independence. Not that it’s relevant to the legal question.

US Supreme Court Just Blew Up EU-US Data Transfers

Related Stories