Cloud Computing: The US versus The EU

The International Association of Privacy Professionals has published my article on how US cloud providers and the US government can respond to the wave of hypocrisy from the EU over PRISM.

European cloud providers have tried for years to gain a competitive advantage in the European market over U.S.-based counterparts by claiming that content stored with European providers is more protected from government access than data stored with U.S. companies. These European providers have tried to instill fear in potential customers, claiming that the USA PATRIOT Act gives the U.S. government essentially unfettered access to content stored with U.S. companies.

As has been well-documented here and elsewhere, the truth is that the U.S. imposes tighter restrictions on the ability of its law enforcement and security agencies to get data stored in the U.S. than many EU governments face in accessing data stored in their home countries. Moreover, unlike in the U.S., providers in the EU can voluntarily provide content and customer data to the government, and EU providers are required to retain data for up to two years, helping ensure the data is there when the government comes looking for it.

When I was at the Justice Department, it was not uncommon for law enforcement officials in European countries who were seeking their citizens' content stored in the U.S. to complain that the evidentiary standards that had to be met to obtain that data under U.S. law were too high. No, you didn't read that wrong: European governments complain to U.S. officials that they can more readily access their citizens' data if that data is stored in Europe than if that data is stored in the U.S., because they often cannot satisfy our stricter standards for government access—standards that protect data in the U.S. regardless of whether that data is owned by an American or European customer.

Even before anyone ever heard of Edward Snowden, U.S.-based providers and U.S. government officials struggled to combat the misinformation being propagated by EU providers and media, with limited success. The hyperbole and hypocrisy from EU officials in the wake of the PRISM leaks has made that struggle even more difficult. The overheated rhetoric coming out of the EU shows no signs of abating, almost as if EU officials were determined to keep the public's focus away from the even more permissive national security laws in their own backyard. But despite that rhetoric, the reality is that data...