EU demands answers over Microsoft's Patriot Act admission

By | July 5, 2011, 11:50am PDT

Members of European parliamentary states have demanded changes to the way data is sent to the United States from Europe, amid conflicts between the European data laws and the USA PATRIOT Act.

Last week in London, at the Office 365 launch, Microsoft UK chief executive Gordon Frazer admitted to ZDNet that Microsoft could not provide guarantees that EU-based cloud data would not leave Europe under any circumstances, even under a Patriot Act request — and neither can any other company.

While Microsoft came clean and admitted on the record that data was not protected under EU law, the focus for European legislators is now to bolster existing EU law, amid Microsoft’s admission.

Cloud stored data in the EU is not protected against U.S. law, following Frazer’s admission. This has led many of the members of the European Parliament to question whether the European data protection legislation brought out in 1995 has any effect whatsoever.

Sophie in ‘t Veld, Dutch member of the European Parliament’s civil liberties committee, brought up questions in the committee relating to whether the Patriot Act overrules the European data protection laws, and whether European data protection legislation can be adequately enforced.

One of the major considerations for the European members of parliament is to question the nullification of European data protection laws by the invoking of the Patriot Act.

Legal experts who spoke to IDG said that the EU data protection legislation is “hardly worth the paper it’s written on“.

The European commissioner charged with data protection said earlier this year that companies such as Microsoft, Google and Facebook “must adhere” to the strict EU privacy rules.

But as the Patriot Act overrules the European directive when data is on U.S. soil, regardless of whether the data is covered under the Safe Harbor framework, the “strict EU privacy rules” have no powers of protection.

Related content:

Also read ZDNet’s Patriot Act series:

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

Topics

Zack Whittaker, a criminologist who studied at the University of Kent, Canterbury, is a journalist, writer and broadcaster.

Disclosure

Zack Whittaker

I worked briefly with Microsoft UK in 2006 but no longer have any connection with the company. Regardless, I remain impartial and unbiased in my views.

I don't hold any stock or shares, investments or industrial secrets in any company, but have signed confidentiality agreements with a number of UK and U.S. organisations, whose names I am not at liberty to disclose.

I was involved with Kent Union, the University of Kent's student union, undertaking voluntary, non-salaried, elected positions between early 2009 and mid-2010.

No other company, body, government department, non-governmental organisation or third sector organisation employs me or pays me a salary in any capacity whatsoever.

As a freelance journalist, whenever expenses are given and taken by a company that is not CBS Interactive, these will be disclosed in each relevant post to ensure transparency.

I currently work with a UK law enforcement unit, but this is an entirely separate position which bears no connection to other work.

(Updated: 23rd October 2011)

Biography

Zack Whittaker

Zack Whittaker, criminologist who studied at the University of Kent, UK, is a journalist, writer and broadcaster.

After studying criminology at university, though still in his early-20's, he has already had a series unconventional work and voluntary positions. He has worked with researchers studying neurological illnesses like Tourette's syndrome (which he suffers from), has given lectures on the nature of disabilities in the public community, and occasionally ends up speaking on television and radio discussing the events of the day.

He first had academic work published at the age of 22, then still an undergraduate, and has been cited by a wide range of publications: from the Huffington Post, Business Insider, AllThingsDigital, The Atlantic Wire and CBS News.

63
Comments

Join the conversation!

Just In

Re: gavinwray1
gavinwray1 28th Dec
Losing weight has been a problem since time immemorial and with the growing awareness of diseases that are being linked to obesity and being overweight, more and more people today are being conscious and cautious with their diet and their lifestyle. http://www.fatburning.ca/

There are no specific rules choosing and naming your dogs. The only boundary you would have to cross is to name them according to their sex. http://www.femaledognames.ca/

You???ve now made the decision to buy a house in Canada, so it???s time to ensure that finding your new house. http://www.findhouse.ca/
0 Votes
+ -
and providing data to tyrannical regimes like China must stop!
The people should boycott M$ and switch to google where your data is safe and sound!
@Linux Geek
Comedy week?
@TKR1 No! He is always funny. He is our resident jester! Its nice to have him around. He makes people laugh. Laughter is good for health. And he does it for FREE !! happy
0 Votes
+ -
@TKR1

I fail to see why he continues to post them.

plain
0 Votes
+ -
Re: gavinwray1
gavinwray1 28th Dec
Losing weight has been a problem since time immemorial and with the growing awareness of diseases that are being linked to obesity and being overweight, more and more people today are being conscious and cautious with their diet and their lifestyle. http://www.fatburning.ca/

There are no specific rules choosing and naming your dogs. The only boundary you would have to cross is to name them according to their sex. http://www.femaledognames.ca/

You???ve now made the decision to buy a house in Canada, so it???s time to ensure that finding your new house. http://www.findhouse.ca/
  • Flagged
@Linux Geek
- get help.
0 Votes
+ -
safe and sound with Google?
Joe_Raby 5th Jul
@Linux Geek

You are quite the comedian.
@Linux Geek *yawn*
Data..safe and sound? hehehe... I think you are just a funny troll. You must be!
0 Votes
+ -
Not Microsoft you blowhard
use_what_works_4_U 6th Jul
@Linux Geek
This is the fault of the United States Federal Government and Google has to comply as well.

But you knew that.
Ban them from operating in the EU unless they obey EU law. Simple isn't it?
0 Votes
+ -
Contributr
@timspublic1@... It is relatively simple -- but that would mean that 700 million people in the EU would be at a massive disadvantage. This is why Safe Harbor was set up in the first place. Patriot Act, however, trumps it completely.
0 Votes
+ -
Demanded changes from Microsoft?
Will Pharaoh 5th Jul
@zwhittaker
shouldn't they be talking to the US government? MS is just following the rules forced on us over here, as you guys are forced with rules from your government.

If the data is stored in Europe, but accessed in the US, what rules apply there?

This is a time where the governments should get together on the same page, as both sides have some pretty Draconian laws that can effect citizens on both sides of the Pond.
@Will Pharaoh: ... which operates it still in the USA -- id est obliged to follow the law.

Microsoft, Google, Apple, whoever else will be never able to protect data of their users, no matter where their information is situated territory, unless they will outsource data management/operations to EU's locally registered company.

However, not there is no way how it could be business-wise practical before EU would declare a ban of any service which does not protect privacy of its citizens. Only then all of these mentioned companies will go through these risks, hurdles and technical difficulties to outsource operation of data to a third party local EU company.
0 Votes
+ -
@zwhittaker
Apple cares too much about security and about the happiness of their customers. Even though I live in the US, I'm sure that Apple would protect my data from the government. YEAH!!!
  • Flagged
0 Votes
+ -
@ DeRSSS

If a US firm form a subsidiary in an EU member state, it may be possible to include legal language giving the subsidiary sole access to data stored in the EU, even if the subsidiary remain wholly owned by the US parent. As a vaguely related example, German firms are answerable to supervisory boards that include owner (shareholder) and employee (trade union) representatives, rather than being solely accountable to the owners (shareholders). The point of the comparison is that legal systems can and do distinguish between ownership and control.

With the right legal framework, if management of a US firm were to order an EU-based employee, or an employee of the firm's EU subsidiary, to hand over any EU data, the employee would be legally obliged to refuse, and could face no retaliation for that refusal. If the US firm were to retaliate, e.g. by sacking the employee (directly or via the EU management of the subsidiary), the employee could sue the firm, which could potentially lose the right to operate in the EU.

If ownership by a US firm negates EU data protection directives, then EU lawmakers need to clarify or update the law. It has to be illegal for anyone in the EU to make protected data available (directly or indirectly) outside of the EU, irrespective of whether or not the person in question works for a US firm or for an EU subsidiary of such.
@zwhittaker Can't you guys (the British) just take back America? We're clearly too stupid and immature to run it.
@timspublic1@...

Apple, Google, and others likely follow the laws of the US as well. How many companies should they ban from the EU?
@timspublic1@...

"Ban them from operating in the EU unless they obey EU law. Simple isn't it?"

It certainly works in China where Microsoft and Google are complicit in enforcing the government rules.

EU customers should choose a vendor that will commit to abiding by EU law.
@timspublic1@... Absolutely. Cloud or NOT cloud, EU information laws should be respected by the vendors serving the area. Im pretty sure if the microsoft was chineese based, most of the jokers here would be saying much different things. ALSO, someone said they didnt care about feds looking into their info, that guy must have worked in the industry hmmm at least around 40 yrs ago! Get Real !!
EU should protect its rights and laws. Totally agreed!
0 Votes
+ -
If a US company has EU data on US-located servers and it's vulnerable to the Patriot Act, then the safe harbour agreement with the US needs to be ripped up as it isn't practical.

The bigger issue is what happens to EU data in the EU-located servers of an EU subsidary of a US organisation. If the Patriot Act is invoked against the parent organisation and the subsidary hands it over when it is against EU law to do so, what will happen? Prosecution by the EU? But if they refuse the company will be prosecuted by the US?

The EU either needs to reach an agreement with the US over the limits of the Patriot Act as it pertains to European data, or refuse to give some kind of data protection endorsement to companies that have data vulnerable to the Act.

For companies like Microsoft I can see this not being a massive problem as they could license the infrastructure to run their cloud services to resellers and so never touch the data themselves.
0 Votes
+ -
Perhaps the key is location
WilErz Updated - 6th Jul
@ OffsideInVancouver

Under an optimal legal framework, if US management order an EU-based employee (direct or subsidiary) to hand over EU-based data, the employee must refuse or face prosecution under EU law. At the same time, an EU-based employee is not subject to US law, so there would be no grounds for prosecution by the US (even if the employee were to later visit the US).

As long as US management had requested the data from the EU-based employee, there would be no basis for US prosecution of the management either, since they would have done all that thay had the power to do.

What's needed is a clarification or modification of the law, so it becomes clear that: (a) nobody physically in the EU may make protected EU data available outside of the EU, either directly or indirectly; (b) any retaliation against an EU-based individual for complying with the above is grounds for loss of the privilege of operating in the EU.
0 Votes
+ -
Limited solution
use_what_works_4_U 6th Jul
@WilErz
What if the customer, that is the actual owner of the data, travels to the U.S. and wants to access his/her files? Then either the entity in the E.U. makes the files directly available, or the cloud service is not really a cloud service. This is the crux of the matter - the Internet is worldwide by default.
0 Votes
+ -
That's a completely different issue
WilErz Updated - 7th Jul
@ macadam

In your example it's the owner of the data, not the cloud provider, bringing it onto US soil. Data owners are perfectly free to do that, but if they do, then their data become susceptible to seizure under the USA Patriot Act. That's an entirely different matter to what's being discussed here, and one I don't find objectionable. In the US, you're subject to US law. In the EU, you're subject to EU law. In China, you're subject to Chinese law. If you disagree with US, EU or Chinese law, don't go there. I certainly wouldn't bring confidential EU data onto US soil.

The issue here is that private data owned by EU citizens and stored on EU soil is potentially being moved to US soil without the consent of the owner (or even notification). That's absolutely unacceptable. US law does not apply in the EU, and EU lawmakers need to make this absolutely clear to their US counterparts. Any US firm violating EU data protection laws should lose the right to operate in the EU. Full stop.
0 Votes
+ -
That is a bit naive
VBJackson Updated - 11th Jul
@WilErz
I see three problems with your reply:

First, you make the assuption that there IS an optimal legal framework. I would NOT place any bets that if an EU employee of a US corporation failed to comply with a US government order, that there would be no repercussions for the employee.

Second, I can fairly well guarantee that there would be SEVERE repercussions for any US company that said, "Well, we asked for your data and they said no".

Third, I would expect that most companies that maintained clouds in the US and in the EU would have links for transferring data between them for backup/disaster recovery, and, as someone else posted, the common eventuality that an EU customer might need to access thier data from the US. Given that infrastructure, the US management might not even ASK, they might just pull the data and hand it over without the involvement of any personnel in the EU.
0 Votes
+ -
I just don't get it
jck 6th Jul
If someone puts data on an EU server in an EU country, how does the US have any right to require any company, US-based or not, to surrender such data. The US government can't just walk into a Chase branch in London and say "surrender all these assets under the PATRIOT act..." can they?

I'm all for stopping terrorism and what not, but the USA is stepping out of bounds by requiring this of US-based firms doing business overseas.

I think the EU should, if the US doesn't begin to respect its laws, arrest any corporate personnel complying with PATRIOT act requests that are in blatant disregard of EU laws and occur within EU borders.

The US would never put up with EU governments doing the same. It's time that they show some mutual respect.
0 Votes
+ -
@jck

Do you really think they give a s---???

The US Government has, since 9/11, acted like a bunch of Nazi's, and stomped all over its citizens rights; all in the name of "terrorism".

In the past few days, I saw something in the news about "boob bombs". (Yes, that's right,, plastic explosives in breast implants!) Surely this latest line of bulls--- out of the Department of Homeland (in)Security; will be used as justification for even more intrusions into the rights of airline passengers.

Absolute power corrupts absolutely!
Who would have thought, the cloud stopped in its tracks by government pi**ing contests.
No company will trust public cloud offerings as long as these conflicts continue. And as we all know, governments seldom really resolve internal issues, much less international ones.
0 Votes
+ -
It's not as though a blind man in an isolation chamber
ego.sum.stig@... Updated - 5th Jul
Couldn't have seen this coming.

All hail the new cloud overlords! Which might be the EU or another entity where they struggle to speak English.

Thanks for an actually useful blog Zack, it appears that I must revise your status up to somewhere near human, as opposed to being merely a spawn of U of Kent :P
What they did was draw attention to the Patriot Act - a law that should never have been passed in the first place.

None of these major tech companies will move their world headquarters out of the US, so they are all subject to this.

Likewise, there are still major TLD servers and pipeline connections joining the western hemisphere to the east which the Internet relies on, which are also run by US-based companies. Who is to say that the US gov't won't flex their Patriotic powers and just intercept transmissions before they reach their target? Here in Canada, even if you host stuff on Canadian servers, everything flows through major connections in Seattle, Chicago, and several other near-border cities in the US, so the companies processing connections are US-based, and hence, subject to the Patriot Act.
0 Votes
+ -
@Joe_Raby
By paying hoge 'royalties' to subsidieries in tax havens.

Whatever happened to 'do no evil'? Expediency, that's what!
0 Votes
+ -
Well said
use_what_works_4_U 6th Jul
@Joe_Raby
As a U.S. citizen I completely concur that the Patriot Act is not patriotic and should not exist at all.
@Joe_Raby

I for one don't. And this comes from a rabid ABMer. This is one of the few times they have been honest with their customers; and I applaud them for making sure their customers know that the US Government is out of control.
0 Votes
+ -
The Patriot Sucks...
jessiethe3rd 5th Jul
Let's be honest - the Patriot Act sucks, however, everyone knows this isn't a Microsoft thing at all. Every one in the EU already knows this as well. If you are headquartered in the EU and so much as touch US soil you have to confirm to the US Patriot Act.
0 Votes
+ -
Contributr
@jessiethe3rd You're right. It's not a solely Microsoft thing -- but they did become the first company to openly admit it (and exclusively to ZDNet/CBSi).

Either the Patriot Act needs to be repealed (probably never going to happen) or the EU needs to bolster their laws. One or the other, really.
@zwhittaker Yeah but lets face it the EU is toothless. They don't have anything to force US compliance with any data protection policy they care to try and implement. I don't agree with the Patriot Act at all but, honestly what sort of leverage can the EU possibly bring to bear? Economic sanctions? The EU does not represent a significant enough portion of our trade to bother us that much. Military action? Never going to happen. The only question will be whether the United States openly flouts any EU data protection laws passed or just circumvents them clandestinely.
0 Votes
+ -
Not so complex
WilErz 7th Jul
@ Str0b0

If someone operating on EU soil violates EU data protection law, arrest him/her. If an EU-based employee reports that a US-based manager ordered (not asked) him/her to violate EU law, with the threat of punishment for refusal, and backs this up with evidence, issue an arrest warrant for the US-based manager. If the manager sets foot on EU soil, arrest him/her. Back this up by allowing the EU-based employee to resign and sue the EU-based subsidiary of the US firm for compensation, plus costs and damages.
0 Votes
+ -
Ah, the underinformed
ego.sum.stig@... 8th Jul
Presumably American, but who knows.

FYI, The EC's economy in terms of scale and value is on a par with that of the USA. That and there's an awfully large amount of two way trade between the EC and the USA.

The EC is far from toothless. Witless and confusing maybe, but toothless, no.
0 Votes
+ -
Smells like an opportunity
NoAxToGrind 6th Jul
For an EU competitor to pick up a lot of customers.
0 Votes
+ -
Maybe
use_what_works_4_U 6th Jul
@NoAxToGrind
But consider that to truly avoid the Patriot Act, that competitor would have to guarantee that no data stored on their servers would ever be transmitted to the United States. See, the Patriot Act (hiding my head in shame over that abomination) impacts all businesses who do business in the United States regardless of where the company is based. I guarantee that the Congress would declare that accessing you files from Manhattan (or San Juan P.R. for that matter) constitutes providing services/conducting business on U.S. soil and thus completely opens that firm up to all provisions of the Patriot Act.

I believe the Patriot Act to be unconstitutional and I believe it should be revoked. Unfortunately I haven't formed a legally compelling case to take before the Federal Courts yet. Almost makes me wish I was a lawyer. Almost.
0 Votes
+ -
Agree
sboverie 6th Jul
@macadam
The Patriot act was rushed through congress and needs to be reeled in. The problem is the way laws are deliborated, as in there is no deliboration. Another problem is we elect people who want to write new laws for problems that have layers of older laws.

Some laws deal with problems that are either temporary or not that much of a problem. I think that those kinds of laws should have an expiration date so that if the law is bad that it will automatically cease to be a law. A mediocre law could be rewritten to eliminate flaws and run through the process from bill to law.

I like the idea of keeping laws simple, easy to read and understand. Too many laws are written in legaleze to the point that only lawyers and judges can interprete the law and even then only after months or years of litigation.
@macadam

Just another reason for them to not do business with us.


I agree, the Patriot Act is garbage. You and i can't do much about it but when it starts hitting the US's largest businesses you can bet things will change.
0 Votes
+ -
domino effect
p.vinnie@... 6th Jul
US government will need to come up with some solution to protect their companies operating in EU otherwise EU will create yet another law making life miserable for them.

In turn other countries such as India will follow suite and then others will follow. In turn what will happen that data will get fragmented and make working as global operation nightmare for everyone. At this moment most of web operates whole world as single platform which will fall apart.
It's not that complicated. US companies must US law, but their European subsidiaries must obey European law. The parent must instruct; the subsidiary must refuse. Both obey local law.
0 Votes
+ -
Contributr
@jw@... But subsidiaries cannot refuse because they are wholly owned by their U.S. counterparts.
0 Votes
+ -
I don't buy this argument
WilErz Updated - 7th Jul
@ zwhittaker

Even if a US firm fully own an EU subsidiary, the subsidiary and its employees are still subject to EU law. Ultimately some individual in the EU has to violate EU data protection law for the data to be sent to the US. That's the point at which this has to be stopped.

If I worked for an EU subsidiary of a US firm and a US-based manager ordered me to violate EU law, I'd refuse. If I were then sacked or punished for refusing to break the law, I'd sue.
Maybe the Swiss should start offering cloud based services... (LOL)
0 Votes
+ -
separate the data zones.
Been_Done_Before 14th Jul
It sucks for redundancy, but i suppose they could have companies sign a waiver.
0 Votes
+ -
attent
Firat31 15th Aug
sohbet odalari sohbet odalari
sohbet odalari sohbet odalari sohbet odalari
sohbet odalari sohbet odalari
sohbet odalari sohbet odalari sohbet odalari
sohbet odalari sohbet odalari sohbet odalari sohbet odalari
sohbet odalari sohbet odalari
sohbet odalari sohbet odalari sohbet odalari
sohbet odalari
sohbet odalari sohbet odalari sohbet odalari sohbet odalari sohbet odalari sohbet odalari sohbet odalari
sohbet odalari sohbet odalari
sohbet odalari sohbet odalari sohbet odalari
sohbet odalari sohbet odalari sohbet odalari sohbet odalari
sohbet odalari sohbet odalari
sohbet odalari
sohbet odalari
sohbet kanallari ? radyo dinle ? radyo dinle ?
mirc ? cet ? dul sohbet ? chat odalari ? chat odalari ?
sohbet odalari ? sohbet odalari ? sohbet odalari ? sohbet odalari ? sohbet odalari ? sohbet odalari ? sohbet odalari ? sohbet odalari ? sohbet odalari ? sohbet odalari ? cet ? cet
sohbet odalari
sohbet odalari turk chat - turk chat - cet
odalari islami sohbet
dini sohbet
sohbet odalari
sohbet odalari
Beni takip edenin gotune koyim =)dgdfg
The best way to handle this kind of extra jurisdictional reach of American laws is to simply make sure nothing is held on US territory, then you can tell them to go to Hell. They're half way there already.
0 Votes
+ -
Thats good information for me , tnx for sharing!
software development

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

White Papers, Webcasts, & Resources
ie8 fix