Subtracting Washington

A new excuse (to me, anyway) I was given this week for ignoring digital sovereignty was that it didn’t matter if you picked a European or American service because Europe has a new law letting police hoover up your data anyway. That it’s the same as the US CLOUD Act, so why bother?

What they were referring to was e-Evidence, a law that goes live in a couple of weeks. And it’s definitely not the same – I looked.

Let’s be clear: no one’s trying to avoid the police here, every country lets them gather evidence; that’s the deal, that’s fine. The problem with the CLOUD Act is that it lets US authorities reach across an ocean and yank data out from anywhere a US company parks it. No European court involved; and frequently with a gag order attached, forbidding the company from telling you. Your files could be sitting in a data centre in Frankfurt or Amsterdam and walk straight out the back door without you or anyone else knowing.

The European law is nothing like that. A request has to go through a judge, then the country where the provider is based gets told and gets to say no. A European court oversees the whole thing, and you can fight it. No back doors or silent extraction here…

Another difference: the European law covers anyone offering services in Europe, Americans firms very much included. So US providers actually fall under both laws at once. Choosing European services subtracts the US law from the deal.

So reality is kind of the opposite: the law that treats everyone the same is the European one. The CLOUD Act is the one you get to opt out of – by not handing your data to a company that Washington can compel secretly.

Colin

PS: For more, go to the horse’s mouth – the EU’s plain-language summary.