Not if Mozilla itself doesn't have the data.

A major part of the purpose of persona is to build a system that designs out the capability to engage in surveillance against the users.

I know. That's why I wrote in the article that they will need to move "both the legal entity behind [Persona] and the servers involved" to another country :)

They don't necessarily need to move the Mozilla organization, but then they'd need to make Persona an organization in itself and move that organization.

It's a much safer bet to make it impossible to get the data for the company. It's not like if non-US countries were much better.

Just a bump to support this comment. Too many people do not realize that the privacy breaching laws (public and secret, if they are even adhered to by the govt) extend to any US entity wherever the data is in the world.

This is why data on Amazon, Google or Microsoft data centers in Europe and elsewhere are still open season for US authorities. The same would apply to Mozilla.

How is this compatible with European privacy laws? Wouldn't this mean European customers would be able to sue those companies over violation of this laws?

I think this should be regulated by the https://en.wikipedia.org/wiki/International_Safe_Harbor_Priv... , basically US companies must certify themselves by the stricter EU laws... But I'm not sure if this is mandatory.

European privacy laws vary greatly. Even within the EU (which only covers half Europe's population) privacy laws vary a lot.

Yet there are some universal EU privacy rules.

Yes, but the US doesn't care.

Then maybe Mozilla should move outside US juristiction.

Or Mozilla should create a separate Persona organization that is outside US jurisdiction.

can't an entity be incorporated in the EU that can own that piece of code, placing it out of the hands of Mozilla US?

Potentially. There was Mozilla Europe, but according to the Wikipedia it was disbanded in 2012.

https://en.wikipedia.org/wiki/Mozilla_Europe