A New Law Could Force Tech Companies to Turn Over Personal Data Across Borders

New Laws

The European Union (E.U.) is preparing new legislation that would radically change how personal data is shared during criminal investigations.

According to Reuters, the E.U. wants to pass legislation forcing any technology company that does business within its territory to turn over a customer's personal data if requested as part of an investigation into a serious crime. Such crimes are defined as ones that carry a minimum penalty of three years.

The law would apply regardless of the customer's nationality or the location of the data server. For example, if a country within the E.U. is investigating a serious crime involving an American citizen and the nation believes Google has data stored on an American server that would help with that investigation, the proposed law would force Google to turn over the data.

The legislation will reportedly be ready to go before E.U. lawmakers and member states by the end of March.

International Data

If the previously proposed scenario were to happen today, the European prosecutor would need to contact the U.S. government and obtain a local subpoena or search warrant to obtain the data.

The time required to go through that process could be the difference between stopping a crime before it happened or playing catch-up with the criminals. A faster method could lead to less crime.

Tech companies, however, are resistant to any laws that force them to turn over customer data to foreign nations. Such extraterritorial jurisdiction laws could erode individual privacy rights and undermine consumer trust in cloud services, they argue.

As John Frank, vice president for E.U. government affairs at Microsoft, told Reuters, such laws could also infringe upon national sovereignty, giving E.U. nations police jurisdiction outside their territory.

If the E.U. did pass a new law, it would likely need to work out new international agreements to address this. If a nation didn't agree to enforce the new law, the E.U. could ban companies from that nation from operating within its borders, but that could upset citizens.

According to Reuters, the E.U. law alone could take a couple of years to complete, so for now, nations will just have to continue to rely on one another for help obtaining the data they need.