In 2020, the European Court of Justice declared the Privacy Shield agreement, an agreement on data exchange with the US, incompatible with European law and thus effectively terminated it, not because of the activities of any corporations, but because data stored on US servers is not sufficiently protected from access by the US government (Schrems II ruling). The reason for this is the absurd legislation in the US, such as the Patriot Act, which, although it has been weakened, still allows the state to force any company or private individual to hand over all data processed on servers physically located on US soil, even without any suspicion or a court order.

As a result, all US companies doing business in the EU were forced to operate servers on European soil in order to continue their activities legally. European companies that used US providers that did not comply had to switch to providers that do not operate servers in the US.

Unfortunately, it took only 21 months for US lobbying to undermine the European Court of Justice’s decision: in 2022, a follow-up agreement was adopted, the “EU-U.S. Data Privacy Framework,” which is no different from its predecessor at all. The legal situation remains the same in the US, and once again there is no protection of data from the US government.

In short, anyone who uses services that are processed on US servers is not protected from arbitrary access by the US - and this also applies to EU citizens.