There is such a law:

http://export.gov/safeharbor/eu/eg_main_018365.asp

US companies that want to hold EU data in the US have to guarantee the same level of protection the EU provides.

Do that law prevent surveliance initiated by the state, and does it put liability at those who use the services rather than putting liability at those who offers the service?

Ie, can someone use that law to sue a doctor who happens to use gmail/microsoft/icloud for communicate with his patients?

If the EU had their own Facebook and Google, it'll have their own intelligence agencies tapping data from those servers.

Sure we can perhaps get them to change their minds by boycotting, but try asking a regular American citizen to fully disconnect from the internet.

> If the EU had their own Facebook and Google, it'll have their own intelligence agencies tapping data from those servers.

This is a fallacy that gets repeated a lot.

First of all, the EU is not a single entity, but rather a hydra with many heads. The competency and resources of "intelligence agencies" varies a lot by country, the privacy laws and the wire-taping/surveillance culture too.

If you are speaking about the UK, sure, but try doing this in Germany. Also, in my country (Romania) the government wouldn't have the resources for it and they are too incompetent to cooperate with other agencies without people finding out about it. I also cannot see France doing this, since the French get pretty violent when they get upset. So what EU are you talking about exactly?

Second, even if snooping of online activity does happen in an EU country, at least it's an EU intelligence agency you're talking about. This is relevant for US companies, because I don't know how much EU's governments care about our privacy, but I can assure you that they care about leaks to the US or China or other non-EU countries. Which means US companies will suffer for it.

The USA was and is still seen as the benevolent dictator of the Internet. That's why we've been accepting your governance of TLDs, or your online services. That's why we've been blaming China for their tight control of online access. But if the US government keeps jerking around much, things will change.

> First of all, the EU is not a single entity, but rather a hydra with many heads. The competency and resources of "intelligence agencies" varies a lot by country, the privacy laws and the wire-taping/surveillance culture too.

Not that much.

The is a single EU privacy directive, (95/46/EC), and an extension to provide better privacy for online data (2002/58/EC). All the member state have implemented the same directive. What changes among states are just implementation details (as a programmer would say).

The thing to note here is that the EU directive provides a blanket exception for almost all governmental organizations and for all the police branches. This means that something like PRISM, if architectured in a proper way, would be completely legal.

Truth be told, in EU most telcos and ISP are forced by the law to keep track of all the communications and forward them to the relevant authorities either in batch or on demand.

EU directives are in general just guidelines. The EU is a culturally and politically diverse part of the world and there are differences between countries like night and day.

The EU directives are legally binding acts that force every member state to implement them in 2 years and in the proper way. Big fines have have been levied in the past against member states that tried shortcuts. The EU directives are also more powerful than local laws: if a state law conflicts with a directive, the directive takes precedence.

The state of the political part of the EU is not the mess many politicians say.

However, my main point is that in EU a program like PRISM would be totally legal under current laws. And it is probably already in place if you think about the SIREN program and you make it access the wealth of data harvested through the data retention directives.

I'm not sure how the countries exactly cooperate with each other, but let's say a social network is located in the Netherlands and has tons of European users. What's stopping the Dutch intelligence agencies from spying on European users, including the Romanians who use said social network?

Spying on EU citizens outside of Netherlands is more complicated, first because we aren't Dutch and compared to the US, we are EU citizens so it's not like they don't care about foreigners, the issue being delicate.

I'm not saying that they can't do that. I'm saying that they are thinking twice about it.

The EU does not have it's own singular intelligence agency. It's not a country. EU states may have their own but there's a big difference between the Netherlands, Spain and Sweden in terms of approach.

The US and other parts of the world aren't one single country either, but that doesn't stop the US intelligence agencies from collecting data from all over the world.