Hacker News new | ask | show | jobs
by jiggywiggy 1412 days ago
Yeah wondering about the consequences.

By this logic almost every non-EU Saas would be forbidden.

For sure Stripe is also not allowed, huge amount of customer data in US hands.

4 comments

IMO that could be good, I would welcome more competition in the payment processor space.
But this won't encourage more competition in the EU, it will limit the number of competitors by creating an insurmountable barrier to entry for foreign providers. This is akin to import controls, which often cause stagnation, and generally lead to more costly and inferior goods.
This is about getting qualified in comunal/state procurement and not general public business.
As far as I understand the reasoning is that the accepting of a bid of on of the companies in not allowed because they don't comply with the GDPR law. Although it was filed by a competing company it theoretically would mean according to this judge cloud hosting is not in line with GDPR. In that line, wether you are a governmental organisation or company doesn't matter if they decide to enforce it as such.
> non-EU

The problem isn't non EU services, it's the US CLOUD act

Other countries have legal systems which are considered as offering equivalent protection:

> The European Commission has so far recognised Andorra, Argentina, Canada (commercial organisations), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Republic of Korea, Switzerland , the United Kingdom under the GDPR and the LED, and Uruguay as providing adequate protection.

And for many more countries standard contractual clauses would probably be enough

Uruguay? I wouldn't exactly call them for known being a tech nation...

So why does USA fail at this? Or are they just too big and diverse for that sort of stuff? And you can't really expect such nation to succeed... In anything...

> I wouldn't exactly call them for known being a tech nation

And?

> So why does USA fail at this?

Because, and I'm going from memory here, should be Schrems I or Schrems II if you want to dig deeper, in the view of the ECJ (which invalidated a similar recognition for the US) the US doesn't provide a satisfactory way for EU citizens to contest their data being accessed by US government agencies

It's not a tech issue, but a govt issue.

Look up the cloud act. It essentially makes it impossible for any US company to truly comply with GDPR.

Still works with consent.