Live data from Hacker News

Austrian DPA Ruling Against Google Paves the Way to EU-Based Cloud Services

infoq.com

101–110 of 186 posts

Re: Austrian DPA Ruling Against Google Paves the Way to EU-Based Cloud Services

#101

Quoted post unavailable.

I think part of it is desperation. There is absolutely nothing the EU can say that will convince the American politicians that privacy and corporations are out of control in the US. Americans might believe it's fine, but Germans are careful about how personal data is handled and who has access to it. Culturally the US and Europe is drifting further apart and from the European side it's very hard to see that the US is…

American here - we absolutely do not think it's fine. There is no cultural drift[0]. The reason why we don't have GDPR-like laws is that our political system uses culture wars as a distraction tactic. There are plenty of things that Americans absolutely support that have a snowball's chance in hell if it were put into the form of a bill for Congress to vote on.

The EU basically threatening to ban the US from the Internet if they don't play ball on data protection is the sort of thing that might just be loud and forceful enough to get US politicians to actually pass some strong privacy legislation. I'm also happy that US intelligence agencies have been specifically called out - it's like some kind of virtuous inverse of the Five Eyes policy-laundering strategy.

My only complaint is that this ruling is the second-biggest incursion[1] of national borders into what is ostensibly supposed to be an international space. If interpreted a specific way, one might argue that even basic things like messaging systems and web forums need to be totally hosted in the EU, or users need to be siloed off from the US. I'd much rather prefer an international privacy framework that fixes the privacy issues without splintering the Internet, but we tried that with Privacy Shield and the courts shot that down.

[0] More generally, I've found that the gulf in culture between countries is often overstated. Usually because the person overstating it either wants to make the foreign country seem alien and thus interesting, or seem alien and thus dangerous.

[1] First-biggest one being China's Great Firewall

Re: Austrian DPA Ruling Against Google Paves the Way to EU-Based Cloud Services

#102
post #80

Earlier quoted context omitted.

Am not legally savvy on this to be educated on merits of what cited FISA/EO mean. I am curious as to what argument can find it acceptable to block US company, also when they place data within EU and can’t be compelled to handover to US law enforcement.

>can’t be compelled to handover to US law enforcement Even if a US company holds their data in the EU, due to FISA 702, the CLOUD act and EO 12.333, they can still be compelled to hand over that data. So being a US company is a dealbreaker, regardless of where the data is stored.

What if google uses EU based legal company?

https://cloud.google.com/terms/google-entity

Re: Austrian DPA Ruling Against Google Paves the Way to EU-Based Cloud Services

#103

Earlier quoted context omitted.

Every restaurant, every taxi, every plumber you have ever interacted with did not make their money by selling your personal information. They did it by providing value in exchange for a fee. Google and Facebook are the exception to the rule. Sure in the category of free and very popular social networks and search engines this may be the norm, but that category consists of less than a dozen companies.

> Every restaurant, every taxi, every plumber Sure, except they don't find an advantage in the restriction. They are not cloudy. A dark kitchen OTOH ...

Proton Mail, GitLab, Pivotal Tracker, Dropbox, Square, ecobee, DuckDuckGo. All found ways to make money without selling your personal data.

Re: Austrian DPA Ruling Against Google Paves the Way to EU-Based Cloud Services

#104

Earlier quoted context omitted.

We can't sell AWS consulting services to anyone right now, haven't been able to for over a year, almost two I think. Non of our clients trust Amazon right now. The claims from AWS is that it's fine to host EU data in AWS, but very few companies are willing to risk that.

I mean, they have EU datacenters... the issue with Google Analytics is that this data can be moved through other datacenters. This was one of the ways the NSA programs worked... just tap the google lines which were unencrypted and slurp the data as it moved from datacenter to datacenter.

> I mean, they have EU datacenters

That doesn't matter anymore. According to the relatively recent ECJ ruling mentioned in the article you're not allowed to transfer any PII to companies that are in any way affiliated with a US-based entity (e.g., by virtue of having a US-based parent company), which clearly is the case for Amazon and AWS.

It doesn't stop there. According to some privacy experts, even a third party just having a US-based supplier might be construed as a customer of that third party being in violation of GDPR, at which point we'd basically have to cease all economic activity.

Re: Austrian DPA Ruling Against Google Paves the Way to EU-Based Cloud Services

#105
post #92
post #56

Earlier quoted context omitted.

This assumption leads to the conclusion that only services that reside in the same jurisdiction (EU, USA, ...) can be used if legal protection from the state is desired. If legal protection from the state is enforced (even for other states) this means there need to be wholly separate services in each jurisdiction. This seems very undesirable, especially for the US with it's multinational web companies.

> This assumption leads to the conclusion that only services that reside in the same jurisdiction (EU, USA, ...) can be used if legal protection from the state is desired. which is the correct conclusion? As the state can only offer legal protection under its own jurisdiction. Sure, real life complicates things a bit. (mainly, the jurisdiction of the EU as an institution in and of itself compared to its member states…

>which is the correct conclusion? As the state can only offer legal protection under its own jurisdiction.

Not sure I follow, US gov can't legally protect non US citizens from itself abusing them? It should be as hard for the spying to happen for an US or non US citizen or company.

Re: Austrian DPA Ruling Against Google Paves the Way to EU-Based Cloud Services

#106

I keep hearing that claim, yet it is never backed up by any substantive evidence or actionable advice as to which of these apparently abundant exclusively EU-based services to use for solving a particular problem. Well, other than the usual Fathom and Plausible, that is. It might come as a surprise to some, but the web and software in general isn't just comprised of analytics. Just to try and prove myself wrong I sea…

Livestorm.co - Paris

Wonder.me - Berlin

whereby.com - Oslo (technically not EU, but close enough)

That site is just lacking.

Re: Austrian DPA Ruling Against Google Paves the Way to EU-Based Cloud Services

#107

Actually, there's an "easy" way out for Google & Co: set up a EU subsidiary and allow them to run autonomously. Il will be subject ONLY to EU laws, on EU servers... but with US technology... and money (ONLY and not datas) will flow back to the US ! As a side effect: Google.EU will be able to use the "full" power allowed by GDPR (european data & world data) as Google.WORLD will "only" be able to use world data excludi…

No, that wouldn't work either because that EU subsidiary would still be controlled by its US-based parent company.

Re: Austrian DPA Ruling Against Google Paves the Way to EU-Based Cloud Services

#108

Earlier quoted context omitted.

> Every restaurant, every taxi, every plumber Sure, except they don't find an advantage in the restriction. They are not cloudy. A dark kitchen OTOH ...

Proton Mail, GitLab, Pivotal Tracker, Dropbox, Square, ecobee, DuckDuckGo. All found ways to make money without selling your personal data.

Well, that is a better answer. Still doesn't invalidate my original comment though.

Re: Austrian DPA Ruling Against Google Paves the Way to EU-Based Cloud Services

#109

Earlier quoted context omitted.

Google Analytics is very hard to replace, because the real value to businesses is in the integrations with Google Ads and Search Console. There's no viable alternative to Google's advertising networks at the minute.

This. We use a non-Google analytics product that we could even move to self-hosting if needed. But the marketing director basically was like “This is better than GA, and I will use it for almost everything, but we have to have GA also because it shows as conversions.”

Which non-Google analytics product are you using?

Re: Austrian DPA Ruling Against Google Paves the Way to EU-Based Cloud Services

#110
post #74

Quoted post unavailable.

"Google will just lock the data in the EU and keep doing business as usual." Personal data of EU citizens cannot be processed by american companies, full stop.

Wow, as an EU citizen with some data stored by US credit agencies, I would love to see those credit rating agencies restricted in how they use my data!

Post reply on HN