undefined | Better HN

0 pointsspiffytech4y ago0 comments

> The EU part cannot be owned by the US entity since the US government can compel the US mother company to have it's subsidiary hand over data.

Is this true for ownership by individuals too?

If I, an American citizen & resident, owned and operated a company registered to a European nation to serve my European customers (with European hosting), does that make me compliant? Does an American solo founder have a path to compliance at all, or would I be required to collaborate with a completely separate workforce that has no ties to America?

0 comments

tyfon4y ago

If you are subject to the cloud act in the US then you are not compliant or in anyway can be compelled by the US to hand over data on EU citizens.

As a private individual I suspect you would not have much to stand on if the NSA knocked on your door.

Another way to be compliant is to not collect PII.

spiffytechOP4y ago

> Another way to be compliant is to not collect PII.

The GDPR extends far beyond the US notion of PII. As I understand it, it covers basically all user-submitted or user-related data if it's possible for that data to be hypothetically tied to an individual in the EU (even if that can be done without your service holding traditional PII).

> As a private individual I suspect you would not have much to stand on if the NSA knocked on your door.

Yeah, a federal agent with a wrench can do anything they want to me (https://xkcd.com/538/), but I'm trying to figure out my options.

inetknght4y ago

> The GDPR extends far beyond the US notion of PII.

That's a good thing. The US notion of PII is ridiculously naive.

jimmydorry4y ago

It includes IP address... the fundamental glue that makes routing to and from said servers possible. Good luck being able to resolve web requests without knowing where to send the response.

1 more reply

j / k navigate · click thread line to collapse