EU-US Data Privacy Laws

As I have understood it from a lawyer: US laws require a company to hand over the data wherever the data is located. EU, Japan, whatever. You are a US company, so hand it over.EU law states: EU data shall not leave the EU.Those two bite each other, and the result is that a company can _never_ bow to both laws.So, if EU data must be kept in the EU, choose a (hosting) company with no ties to the US. Vice versa is no problem, the EU law _does_ respect data locality.It is the reason why

CLOUD ACT is the problem. Even for data stored outside the US, authorities can demand access to data. This is why for example in the EU you are a customer of AWS SARL in Luxembourg instead of AWS Inc.

Couldn't they have kept the data stored in the EU? What US law prevents that?

There are specifically EU based companies offering cloud services only at EU based server parks. These companies make sure the US cannot have access to their data because a) the company isn't a US one b) the company does not have a part of its business located on US grounds and c) all servers are located in data centres on EU grounds.Such services are offered with explicit notion of data protection against US laws, giving "us" EU people a safe harbour of data protection where we are (at this

They don't, hence why EU has data residency requirements, and American companies set up firewalled entities to comply (eg. Azure Germany).

Looking for an informed opinion; what are the practical consequences for European companies using American cloud providers (which I guess is most of them) ?

I hope they will have a US cloud region since the European laws are pretty strict and hard to keep up with

Hi @oliv__17, I am a DPO (PHD in law) and a developer, the best advice I could give you is to host your data in EU, of course, but also only by using the services of a company that is European itself, and not controlled or owned by a US company or person. This means that you can no longer rely on AWS or G Cloud. This is due to the fact that there is the Cloud Act, that is not compatible with GDPR requirements about data transfers outside EU (for more details you can also check decisions of the C

Sounds like they are trying to get the same deal most of the EU countries have, Germany, France, ... Where user data has to be stored in the home country.

Due to the Cloud Act, hosting "In the EU through a US company" and "In the EU through an EU company" are two very different things.