Microsoft case: how to avoid contradictions by working with personal data in Europe and the USA?

We have already written about the concept of “ sovereignty of data ” or the question of which country’s laws should regulate data matters: where are they located? Or the laws of the country to which the company owns the data? Maybe you need to be guided by the laws of the country of origin of the company that hosts them? These questions acquired new meaning in light of Edward Snowden’s revelations and the discovery that the NSA (US National Security Agency) was monitoring, which led to companies in some countries now avoiding storing data in the United States.

A recent court decision has further complicated the issue and put the US company in a position in which they have to follow the mutually exclusive laws of different countries.
')
Consider a specific case : Microsoft was presented with a search warrant issued by the US government (which authority is unknown; all court records are sealed) with respect to data on one of the users of Internet mail. Microsoft has determined that data about this user is stored on a server that is located in Dublin, in Ireland. On this basis, the company stated that US jurisdiction does not apply to this server. But the magistrate judge of the southern district of New York, James Francis (James Francis) ruled that Microsoft in any case will have to provide data.

“It would be fair in relation to“ traditional ”orders, but not to those issued for inspection of the contents of Internet resources and regulated by the federal law“ On the storage of information ”- explains the BBC . “According to him, the order should be considered, rather, as a subpoena for submitting documents to the court. He said that anyone who received a subpoena from a US court must provide the information sought, regardless of its location. ” Francis also added that this part of his decision is based on the fact that it would have been too difficult for the United States to negotiate with all foreign countries.

So what's wrong with that?

This means that any of the companies around the world that use a firm that stores their data in the United States — Microsoft, Google, Amazon, etc. — may find that its data operations are governed by US law. In some cases, these laws violate the laws of other countries on privacy and protection of information.

At the very least, foreign companies that are concerned are much less likely to use the services of US companies to store their data. This is not very good impact on the business of American companies. "If the cloud industry in the United States had attended to a lack of trust in foreign customers earlier, this court decision would simply significantly increase the stakes," said Caspar Bowden, an independent privacy researcher, in the British newspaper The Guardian.

“This unexpected court decision could have a significant impact not only on the use of free email services like Hotmail and Gmail. It could also affect all cloud services, such as Office 365, Google Apps, and even cloud application providers like Amazon, ”agree three lawyers from the law firm Drinker Biddle & Reath in a response published by the National Law Review.

What could be interesting - if by “interesting” to actually mean “scary and very bad” - the likelihood that other countries will take this case as a precedent and decide that their various laws on information, such as “the right to be forgotten ” should be valid in the United States. In the end, this can take the form of a disorderly Balkanization of data management, which can put an end to the existence of the Internet to which we are accustomed.

So, for example, Microsoft is in trouble, as lawyers admitted. Well, well, they didn’t say exactly “in trouble”. Being professional lawyers, they put it more gracefully. "Apparently, Microsoft is faced with the need for an unpleasant choice: either a violation of European data transfer laws, or a failure to comply with a US court order," writes Rob Corbet, partner at Arthur Cox, in Data Protection Ireland.

Microsoft has announced that it is going to appeal the decision of the court and in fact made it clear that it is ready for anything, just to resolve the issue. “When we filed a complaint, we knew that the process had to start with a justice of the peace, and in the end, we had the opportunity to refer this case to a judge of the US District Court and, possibly, to a federal court of appeal,” writes David Howard (David Howard ), Vice President of Microsoft and Deputy General Counsel. "This is the first step to raising this issue in the courts, which have the authority to influence the outdated views of the government regarding the use of search warrants for information stored in digital form outside the United States."