On September 5th Dutch Minister Ivo Opstelten (Security and Justice) responded to questions relating to US cloud companies storing Duth data and the impact of the US Patriot Act. The minister’s response has major implications on data jurisdication. Here is a Google translation of the questions and answers:
Question 1: Are you familiar with the message “Microsoft admits Patriot Act, can access EU-based cloud data”?
Answer 1: Yes.
Question 2: How do you assess the statement of Gordon Frazer, managing director of Microsoft UK, that all data are managed by an American company…can be requested by the US government under the Patriot Act?
Answer 2: …The statement that all data can be retrieved always seems to not reflect reality.
Question 3: Does the Dutch government, Dutch agencies or institutions store semi-public data with (or in association with) a US company (or several US companies)? If so, what parts of the (semi-) government agencies or what are these?
Answer 3: Yes… experimenting with Google Docs and Dropbox.
Question 4: Is there at present scenarios where the US government, under the Patriot Act, may request information on Dutch citizens? If so, what data are involved?
Answer 4: Such scenarios are not known to me.
Question 5: Are there other foreign countries that currently have laws similar to the US Patriot Act and are therefore not eligible to Dutch manage [data]?
Answer 5: There are no other governments I know thatapply similar laws.
Question 6: Is there a policy designed to prevent a foreign power from getting access to information without the permission of the Dutch government?
Answer 6: There is no policy that specifically focused on the possible consequences of applying foreign law. However, the Minister of the Interior and Kingdom Relations takes into account the possible consequences of the application of foreign law in the policy…To prevent information from the government (also public) from being requested under the Patriot Act by the United States, the supplier for outsourcing data centres is not allowed data from the government (also Citizens). This basically means that companies from the United States are excluded from such bids