Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Austrian DPA Ruling Against Google Paves the Way to EU-Based Cloud Services

infoq.com

Post reply on HN
Print view View original

121–130 of 186 posts

Re: Austrian DPA Ruling Against Google Paves the Way to EU-Based Cloud Services

#121

Post by jtbayly »

BjoernKW wrote: post #104
WrtCdEvrydy wrote: post #90

Earlier quoted context omitted.

I mean, they have EU datacenters... the issue with Google Analytics is that this data can be moved through other datacenters. This was one of the ways the NSA programs worked... just tap the google lines which were unencrypted and slurp the data as it moved from datacenter to datacenter.

> I mean, they have EU datacenters That doesn't matter anymore. According to the relatively recent ECJ ruling mentioned in the article you're not allowed to transfer any PII to companies that are in any way affiliated with a US-based entity (e.g., by virtue of having a US-based parent company), which clearly is the case for Amazon and AWS. It doesn't stop there. According to some privacy experts, even a third party j…

Go GDPR for the win!

I like the goal of privacy, but I won't be sad to see the ridiculous GDPR law implode.

Re: Austrian DPA Ruling Against Google Paves the Way to EU-Based Cloud Services

#122

Post by nix23 »

radicalbyte wrote: post #2

This is an excellent decision from the Austrian DPA: there is no good argument for exfiltrating data to a country with low-to-non-existent data-protection standards. It would be nice if the same logic applied to manufacturing and environmental legislation - it stops the race to the bottom.

Also cloud-act, not the best idea to open up your crown-jewels to every single US-Secret-service....by default ;)

Re: Austrian DPA Ruling Against Google Paves the Way to EU-Based Cloud Services

#124

Post by nostrebored »

shafyy wrote: post #123

Does this also mean that e.g. EU business are not allowed to use Stripe or PayPal, since those are owned by US companies? Or, that it's not good enough anymore to use a EU hosting for Mixpanel or AWS or DigitalOcean?

Austrian businesses I think, but yes

Re: Austrian DPA Ruling Against Google Paves the Way to EU-Based Cloud Services

#125

Post by floatingatoll »

shafyy wrote: post #123

Does this also mean that e.g. EU business are not allowed to use Stripe or PayPal, since those are owned by US companies? Or, that it's not good enough anymore to use a EU hosting for Mixpanel or AWS or DigitalOcean?

If you, a GDPR-bound business, are silently serving, embedding, or otherwise using resources served by US businesses without explicit opt-in approval, then you absolutely could be violating GDPR, specifically for example if the user’s IP becomes known to the US-operated resources.

This would theoretically apply whether using AWS hosting (even in EU availability zones), Stripe or PayPal cart checkouts, or any other platform owned and/or operated by a US business or its subsidiaries. It isn’t relevant where those US-owned data or servers are hosted.

This unfortunate situation could be corrected by the US signing a new treaty or other law that ensures that the US governments, law enforcement, and courts cannot compel US business to violate GDPR.

(I am not your lawyer, this is not legal advice.)

Re: Austrian DPA Ruling Against Google Paves the Way to EU-Based Cloud Services

#126

Post by xg15 »

Out of couriosity: Does the CLOUD act, FISA and whatever else also cover offshore subsidiaries? E.g. would a german Google GmbH still be subject to the CLOUD act if that legal entity has no relationship with the US?

On the one hand, I can't imagine US surveillance leaving open such a glaring hole, on the other hand I wonder what basis US law could apply to companies of non-US countries.

Re: Austrian DPA Ruling Against Google Paves the Way to EU-Based Cloud Services

#127

Post by floatingatoll »

xg15 wrote: post #126

Out of couriosity: Does the CLOUD act, FISA and whatever else also cover offshore subsidiaries? E.g. would a german Google GmbH still be subject to the CLOUD act if that legal entity has no relationship with the US? On the one hand, I can't imagine US surveillance leaving open such a glaring hole, on the other hand I wonder what basis US law could apply to companies of non-US countries.

In your scenario, is the theoretical Google GmbH a subsidiary of a US corporation?

Re: Austrian DPA Ruling Against Google Paves the Way to EU-Based Cloud Services

#128

Post by belter »

radicalbyte wrote: post #2

This is an excellent decision from the Austrian DPA: there is no good argument for exfiltrating data to a country with low-to-non-existent data-protection standards. It would be nice if the same logic applied to manufacturing and environmental legislation - it stops the race to the bottom.

Will make no difference for what really matters...

"BND helped NSA to spy on Austria, EU partners: report" https://www.aa.com.tr/en/world/bnd-helped-nsa-to-spy-on-aust...

"Alleged NSA post in Austria becomes state affair" https://apnews.com/a3537677459e41b9ba4d21d8208dd28a

"UK, Dutch spy agencies curb intel flow to Austria over Russia ties: MP" https://www.reuters.com/article/us-austria-security-idUSKCN1...

"Vienna Is the New Havana Syndrome Hot Spot" https://www.newyorker.com/news/news-desk/vienna-is-the-new-h...

Re: Austrian DPA Ruling Against Google Paves the Way to EU-Based Cloud Services

#129

Post by [deleted] »

technion wrote: post #14
sirwitti wrote: post #3

This is already affecting websites and web apps. At least all of our customers are moving away from Google Analytics and many try to also get rid of other Google services like fonts and maps. I'm very interested to see what this changes in other european countries.

Analytics and fonts shouldn't be too hard. What about Captcha?

[deleted]

Re: Austrian DPA Ruling Against Google Paves the Way to EU-Based Cloud Services

#130

Post by floatingatoll »

technion wrote: post #14
sirwitti wrote: post #3

This is already affecting websites and web apps. At least all of our customers are moving away from Google Analytics and many try to also get rid of other Google services like fonts and maps. I'm very interested to see what this changes in other european countries.

Analytics and fonts shouldn't be too hard. What about Captcha?

And GCP.
Post reply on HN