Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Austrian DPA Ruling Against Google Paves the Way to EU-Based Cloud Services

infoq.com

Post reply on HN
Print view View original

141–150 of 186 posts

Re: Austrian DPA Ruling Against Google Paves the Way to EU-Based Cloud Services

#141

Post by brnt »

mrweasel wrote: post #71
sirwitti wrote: post #3

This is already affecting websites and web apps. At least all of our customers are moving away from Google Analytics and many try to also get rid of other Google services like fonts and maps. I'm very interested to see what this changes in other european countries.

We can't sell AWS consulting services to anyone right now, haven't been able to for over a year, almost two I think. Non of our clients trust Amazon right now. The claims from AWS is that it's fine to host EU data in AWS, but very few companies are willing to risk that.

What AWS claims is not important: the fact that US intelligence agencies are legally required to have access to data worldwide of US companies clashes with EU requirements: it is simply not allowed to expose data on natural EU persons that way.

Re: Austrian DPA Ruling Against Google Paves the Way to EU-Based Cloud Services

#142

Post by mrweasel »

jtbayly wrote: post #121
BjoernKW wrote: post #104

Earlier quoted context omitted.

> I mean, they have EU datacenters That doesn't matter anymore. According to the relatively recent ECJ ruling mentioned in the article you're not allowed to transfer any PII to companies that are in any way affiliated with a US-based entity (e.g., by virtue of having a US-based parent company), which clearly is the case for Amazon and AWS. It doesn't stop there. According to some privacy experts, even a third party j…

Go GDPR for the win! I like the goal of privacy, but I won't be sad to see the ridiculous GDPR law implode.

That’s a weird attitude, at its core the GDPR is simply about keeping track of data, and ensuring that it’s not used for anything the users didn’t consent to.

I’m having a hard time seeing how the rules could be any different. Remember that the GDPR is also result of companies looking at the cookie law and deciding “fuck it, let’s find a loop hole and not change anything”.

Re: Austrian DPA Ruling Against Google Paves the Way to EU-Based Cloud Services

#143

Post by floatingatoll »

dbbk wrote: post #60
john61 wrote: post #53

Earlier quoted context omitted.

No, because Google hast to comply with US law and has to transfer data to US officials.

Not if it's run through a European subsidiary surely

The rulings this past week specifically contradict this. Subsidiaries of US corporations are subject to illegal-under-GDPR data collection requests by US authorities, just as much as any other US corporation, as the subsidiary has no legal protections under US law from GDPR-illegal requests by its parent.

Re: Austrian DPA Ruling Against Google Paves the Way to EU-Based Cloud Services

#144

Post by Puts »

belter wrote: post #128
radicalbyte wrote: post #2

This is an excellent decision from the Austrian DPA: there is no good argument for exfiltrating data to a country with low-to-non-existent data-protection standards. It would be nice if the same logic applied to manufacturing and environmental legislation - it stops the race to the bottom.

Will make no difference for what really matters... "BND helped NSA to spy on Austria, EU partners: report" https://www.aa.com.tr/en/world/bnd-helped-nsa-to-spy-on-aust... "Alleged NSA post in Austria becomes state affair" https://apnews.com/a3537677459e41b9ba4d21d8208dd28a "UK, Dutch spy agencies curb intel flow to Austria over Russia ties: MP" https://www.reuters.com/article/us-austria-security-idUSKCN1... "Vienna I…

At least it seems like the head of the Danish intelligence services is actually facing charges for helping the NSA spy on Swedish politicians: https://www.dw.com/en/danish-spy-chief-detained-over-highly-...

But I think this more then anything shows why the US should not be regarded a country with adequate level of data protection. I would honestly just assume that they force Google to record every single meeting between heads of states or meetings with companies that work in telecom or weapon systems. Even the most boring meeting with officials in some small municipality can probably be valuable information about infrastructure and how it's going to be protected and these are maybe the most unsuspecting because they think "why would anybody care about the water distribution in our small city".

Re: Austrian DPA Ruling Against Google Paves the Way to EU-Based Cloud Services

#145

Post by arlort »

pimterry wrote: post #21
wbl wrote: post #4

EU based cloud services always could compete before. Now they will compete on the basis of being in the EU instead of being better.

Interestingly, it's not actually about being in the EU specifically, it's just about being in a jurisdiction with equivalent data protections. It's not a "must be EU" cloud requirement, it's a "must not be USA" requirement. Canada, Brazil, Japan, India, and many other non-EU countries have GDPR-like data protection regulation that would be totally acceptable I think (IANAL). The core problem is USA specific - either…

> that would be totally acceptable

There needs to be an official adequacy decision, it's not automatic

https://ec.europa.eu/info/law/law-topic/data-protection/inte...

Canada is indeed covered by one such decision

Re: Austrian DPA Ruling Against Google Paves the Way to EU-Based Cloud Services

#146

Post by yohannparis »

andybak wrote: post #66
yohannparis wrote: post #41

Earlier quoted context omitted.

I agree that section 702 is a bit extreme. But, at the heart of it, it makes sense. If foreigners can use services in your jurisdiction, you want to see what they do for security purposes. Nonetheless, it's against the belief of "innocent until proven guilty."

> But, at the heart of it, it makes sense. If foreigners can use services in your jurisdiction, you want to see what they do for security purposes. As a "foreigner" in a friendly country I'm understandably not too happy about this. And the logical outcome is that the US will lose business anywhere this is unacceptable.

I completely agree with your statement, and I feel the same!

Re: Austrian DPA Ruling Against Google Paves the Way to EU-Based Cloud Services

#147

Post by jtbayly »

mrweasel wrote: post #142
jtbayly wrote: post #121

Earlier quoted context omitted.

Go GDPR for the win! I like the goal of privacy, but I won't be sad to see the ridiculous GDPR law implode.

That’s a weird attitude, at its core the GDPR is simply about keeping track of data, and ensuring that it’s not used for anything the users didn’t consent to. I’m having a hard time seeing how the rules could be any different. Remember that the GDPR is also result of companies looking at the cookie law and deciding “fuck it, let’s find a loop hole and not change anything”.

Oh, I don't know, maybe writing it so that it doesn't mean companies in the EU "basically have to cease all economic activity"?

Or writing it so that it doesn't claim to tell me what I have to do with my website when I live in another jurisdiction. I laugh at GDPR. The EU can keep its bureaucracy to itself thank you very much. Making simple websites illegal and forcing me to hire a lawyer to figure out not what I'm allowed to do, but how I must do it just so is just the sort of nonsense I've come to expect from them.

And yes, I agree that it is a continuation of the stupid cookie law that has made the web measurably worse in every regard. As I wrote here recently,

> What an utterly useless law. We have a convenient way for people to request universally that sites not track them. So let’s make a law that makes them have to ask “the right way” every. Single. Stinking. Site. On. The. Internet. Every. Single. Time. They. Visit. Every. Single. Site. > > One might be forgiven for assuming that the law was actually intending to accomplish the reverse of the stated goal. It gives site owners tons of explicit opt-ins that nobody can complain about, even though they were coerced.

Re: Austrian DPA Ruling Against Google Paves the Way to EU-Based Cloud Services

#148

Post by pimterry »

arlort wrote: post #145
pimterry wrote: post #21

Earlier quoted context omitted.

Interestingly, it's not actually about being in the EU specifically, it's just about being in a jurisdiction with equivalent data protections. It's not a "must be EU" cloud requirement, it's a "must not be USA" requirement. Canada, Brazil, Japan, India, and many other non-EU countries have GDPR-like data protection regulation that would be totally acceptable I think (IANAL). The core problem is USA specific - either…

> that would be totally acceptable There needs to be an official adequacy decision, it's not automatic https://ec.europa.eu/info/law/law-topic/data-protection/inte... Canada is indeed covered by one such decision

Ah, good info, thanks! Looks like the full list of 'already approved as adequate' countries for data protection is:

- Andorra

- Argentina

- Canada (commercial organisations)

- Faroe Islands

- Guernsey

- Israel

- Isle of Man

- Japan

- Jersey

- New Zealand

- Republic of Korea

- Switzerland

- the UK

- Uruguay

2022 is a great year to be a cloud provider based in any of those.

Re: Austrian DPA Ruling Against Google Paves the Way to EU-Based Cloud Services

#149

Post by trasz »

iqanq wrote: post #26
litgab wrote: post #24

Earlier quoted context omitted.

true, but to be fair: seems like it worked out pretty well for china...

It worked out pretty well for politicians and those who work in the tech sector. Worked out terribly for the rest of citizens.

[citation needed]

Re: Austrian DPA Ruling Against Google Paves the Way to EU-Based Cloud Services

#150

Post by runako »

The website of the German federal tax office is not GDPR-compliant:

https://twitter.com/jdvhouten/status/1488481039630704644

Seems premature to sanction private businesses when EU governments have not yet been able to come fully into compliance. Perhaps the changeover is more difficult than anticipated? As others allude below, it might make sense for the relevant EU-based alternatives to come online/scale up.

Post reply on HN