Difference is that your US and German branches have access to a justice system that can stop the government.

In China, the justice system is part of the CCP and if you don’t comply, your company is gone.

The whole US / EU safe harbour provisions issue is because the EU is not satisfied that in the United States you don’t in fact have a justice system that can stop the government… that there are insufficient powers to stop certain parts of the government like the the NSA, CIA, DEA, FBI counter terrorism groups etc… who are granted extraordinary powers to do questionable shit like sucking up as much internet data as possible without a warrant in the name off “efficiency” using such flimsy reasoning as “it’s only a search for legal purposes when we run a database query on a US citizens data later” and “we’re legally allowed to do anything we like with the data of anyone who isn’t a US citizen… so these EU guys can fuck off” (or the appropriate US lawyer speak equivalent)

The CJEU explicitly ruled that the FISA courts are not independent, I.e. kangaroo courts. I think it’s a fair assessment.

> Difference is that your US and German branches have access to a justice system that can stop the government.

Germany sure, but The US? Do you not remember the Snowden leaks at all?

Almost every company I've worked with the past several years has had a very strict No-US-Servers-Ever-policy, because people don't trusts the US government to not snoop around.

It should be “No US company, period” because the Cloud Act empowers the US government to compel, say Amazon Web Services to disclose information they hold on a server hosted in Germany even if this violates EU law.

My interpretation of what GP is trying to say that the way forward is to intentionally limit your own capabilities such that it is simply impossible to comply with government overreach. For an example see Signal and their subpoenas.

> a justice system that can stop the government.

There might be a law that allows government to obtain the data if it is a matter of national security. And what is considered such a matter is up to government to decide.

> have access to a justice system that can stop the government.

Haha, good one.

Encrypting data at rest and in transit will certainly reduce the risk. If a branch is deemed at risk, its employees would not be given access to any databases. Or don't have branches in regions where you have the risk of a government threatening your employees for other countries' users' data.

I am the believer of simple statement - if you don't control physical servers then your data is not secured, no matter what you do to secure it. Once vault is unlocked and you don't control physical hardware your game is over.