Search

The Guidelines 05/2021 on the interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR proposed for public consultation (‘the Guidance’) deal with a topic that has long puzzled the data protection community – the identification of international personal data transfers. The General Data Protection Regulation (GDPR) does not define international personal data transfers, though it requires their identification for the application of its transfer rules in Chapter V. It is therefore principally to be welcomed that the European Data Protection Board (EDPB) has tried to address the legal uncertainty stemming from the absence of a clear concept of international personal data transfer, especially in relation to the territorial scope of the GDPR regulated in Article 3. However, as legal researchers active in this area,1 we would nevertheless like to raise three areas to the attention of the EDPB that in our opinion are not sufficiently considered in the guidelines and should be addressed in the revised version after the public consultation. These are: i) the level of detail of the definition of ‘data transfer’ provided, ii) the potential inconsistency for the application of the GDPR by excluding from the definition of a transfer direct transmissions of personal data from an individual residing in the European Economic Area (EEA) to entities outside of it (‘direct transmission from the data subjects’), and iii) measures to ensure the protection of individuals is not undermined when Chapter V is not applicable in the latter situation.

During the last decade, managed runtime systems have been constantly evolving to become capable of exploiting underlying hardware accelerators, such as GPUs and FPGAs. Regardless of the programming language and their corresponding runtime systems, the majority of the work has been focusing on the compiler front trying to tackle the challenging task of how to enable just-in-time compilation and execution of arbitrary code segments on various accelerators. Besides this challenging task, another important aspect that defines both functional correctness and performance of managed runtime systems is that of automatic memory management. Although automatic memory management improves productivity by abstracting away memory allocation and maintenance, it hinders the capability of using specific memory regions, such as pinned memory, in order to perform data transfer times between the CPU and hardware accelerators.In this paper, we introduce and evaluate a series of memory optimizations specifically tailored for heterogeneous managed runtime systems. In particular, we propose: (i) transparent and automatic ''parallel batch processing'' for overlapping data transfers and computation between the host and hardware accelerators in order to enable pipeline parallelism, and (ii) ''off-heap pinned memory'' in combination with parallel batch processing in order to increase the performance of data transfers without posing any on-heap overheads. These two techniques have been implemented in the context of the state-of-the-art open-source TornadoVM and their combination can lead up to 2.5x end-to-end performance speedup against sequential batch processing.

International audience; This study, which focuses on the commercial use of personal data by U.S. airlines, uses actual cases to help analyze the application of the EU General Data Protection Regulation (GDPR) to the airline industry. It is one of the first studies to do so, and as such contributes to the literature. It begins by highlighting the British Airways GDPR penalty case, in which the UK regulator publicized its notice of intention to issue the highest administrative fine to-date under the GDPR. When the GDPR applies to them, airlines should become fully aware of key provisions of the GDPR, starting with those related to its scope and its underlying data protection principles, discussed in this study. In addition, airlines must have a legal basis to process personal data under the GDPR and, as this study shows, must have adequately prepared for data subject requests to exercise rights and potential data breaches.Several examples of the first GDPR sanctions in the airline industry are detailed, and lessons drawn. In this context, security of data is a key element. Finally, the recent Schrems II decision invalidating the EU-U.S. Privacy Shield Decision is examined, and its potential impact on the transfer of personal data from the European Union to the United States by airlines is studied, following an analysis of their privacy policies available on the Internet in the European Union.

The Court of Justice of the European Union (CJEU) emphasised in the ‘Schrems II’ judgment the importance of ensuring ‘effective and enforceable rights and effective administrative and judicial redress’ for data subjects whenever personal data about them are transferred to third countries. The availability of ‘(e)nforceable data subject rights and effective legal remedies for data subjects’ is actually a necessary condition for data exporters to rely on any transfer mechanisms under Article 46 of the General Data Protection Regulation (GDPR). Data subject rights and remedies, however, can only be effectively available to individuals if the data subjects are aware of the existence of such rights and remedies, and if they know how to exercise them. The CJEU has previously stressed that information about data processing directly affects the exercise of data subject rights, and that information obligations imposed on data controllers – beyond being directly connected to the principle of transparency – are also necessary to comply with the principle of fairness

In this document we provide a series of recommendations regarding the wording of the proposed Commission Implementing Decision on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council and its Annex. Concretely, we focus on recommendations for the proposed Annex (Annex to the Commission Implementing Decision on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council), referring when relevant to the Implementing Decision.

The race to create local cloud solutions has become a constant in the digital development programs of member States. Italy is promoting the establishment of the so-called "national cloud", and Germany and France have been working for some time on the Gaia-X project. At European level, the development of cloud computing is taking a strategic role, at least for the immediate future. The declared objective is to free us from solutions that today are almost entirely dependent on infrastructures made available by international providers. Contributing to the debate - more by superimposition than composition - there are broadly geopolitical motivations, aspirations to global technological predominance and concerns associated with personal data protection for third party interference due to the extraterritorial application of foreign legislation. The recent "Schrems II" ruling by the Court of Justice of the European Union, and previously, but with less impact in the broader public, the results of the joint EDPB (European Data Protection Board)-EDPS (European Data Protection Supervisor) study on the United States' Cloud Act, have forced the question of the international acquisition of personal data flows (and non-personal, we may add) and the associated assurances. This paper intends to offer an analysis of the subject, aimed above all at unravelling the multiple levels of the questions raised, which touch not only on legal but on political matters and give an initial, reasoned census of the various bodies of applicable law. Above and beyond hard-hitting declarations, we need to determine to what point the independence of a local European cloud is effectively possible or desirable compared to non-EU providers and, in more concrete terms, to what point an autonomous solution is economically and technically practicable in terms of services that are essential for the States, and that enable the exercise of other fundamental rights and freedoms, for individuals, and therefore must not be susceptible to impairment or interruption. We also have to understand to what point it would be opportune in terms of security, even if this, at first glance, may seem counter-intuitive. In this sense, at least in the overall assessment, we have to consider the high levels of service stability and the existence of high-tech measures to contrast cybercrime that the major international providers can ensure, levels it would be inadvisable to forgo if it were possible to keep the benefits, thereby significantly reducing the associated risks. Indeed, the protection of processed data from external interference must also be measured on a different, but nonetheless significant, level to that of any potential "extraterritorial" threat, represented by criminal activity and security breaches. Another factor that must be considered is the availability of solutions, already entirely actual and "in the hands" of users, which offer immediate protection, such as encryption or the segregation of strategic data sets. In other words, if there are possible measures that significantly reduce the extraterritorial risk and that retain the advantages in terms of contrasting cybercrime, these must be duly included in the overall assessment. Our analysis will also shed light on inconsistencies in terms of data protection within the European Union, and misalignments between national efforts toward localization and the principle of the free circulation of data. In short, we intend to offer a more articulate, less obvious outline of the subjects we are dealing with, which cannot be reduced (if not at the cost of excessive simplification) to the simple contraposition of E.U. versus non-EU, but which reveal lateral synergies and joint misalignments on fronts apparently united; rather, it would be better to think in terms of the creation of a shared ecosystem that draws the most significant advantage from the solutions available today and acknowledges the need to adopt concrete forms of protection. This does not in any way mean evading the serious, but not immediately solvable extraterritorial questions, but preferably using them, if anything, as a mechanism for obtaining a critical reconsideration of the shortcomings and lack of legal harmonization that emerge even within the European Union. Nor does it mean embarking on a path toward domestic solutions that offer little, or at least less protection than those currently available, but instead maintaining high levels of protection against unlawful activity through more advanced technological solutions, and at the same time identifying legal instruments which assure greater national control of the infrastructures and data, and reduce risk to a legally acceptable level.

International audience; Today, cross-border data flows are an important component of international trade and an element of digital service models. However, they are impeded by restrictions on cross-border personal data transfers and data localization legislation. This Article focuses primarily on these complexities and on the impact of the new European Union ("EU") legislation on personal data protection-the GDPR. First, this Article introduces its discussion of these flows by placing them in their economic and geopolitical setting, including a discussion of the results of a lack of international harmonization of law in the area. In this framework, rule overlap and rival standards are relevant. Once this situation is established, this Article turns to an analysis of the legal measures that have filled the gap left by the lack of international regulation and the failure to harmonize law: extraterritorial laws in the European Union (regional legislation) and the United States (state legislation);and data localization laws in China and Russia. Specific provisionsrestricting cross-border personal data transfers are detailed under EU legislation, as are the international agreements that have been invaluable in allowing flows between the United States and the European Union to continue—first the Safe Harbor, and now the Privacy Shield. Finally, in this context, the role of data governance is investigated, both in the context of data controllers’ accountability for the actions of other actors in global supplychains under EU law and under the Privacy Shield. Thus, this Article goes beyond the law itself, to place requirements in the context of the globalized business world of data flows, and to suggest ways that companies may improve their compliance position worldwide.; Aujourd’hui, les flux transfrontaliers de données sont un élément important du commerce international et un élément des modèles de services numériques. Toutefois, elles sont entravées par des restrictions sur les transferts transfrontaliers de données à caractère personnel et la législation sur la localisation des données. Le présent article met principalement l’accent sur ces complexités et sur l’impact de la nouvelle législation de l’Union européenne (UE) sur la protection des données à caractère personnel - le RGPD. Tout d’abord, cet article présente sa discussion sur ces flux en les plaçant dans leur contexte économique et géopolitique, y compris une discussion sur les résultats d’un manque d’harmonisation internationale du droit dans le domaine. Dans ce cadre, le chevauchement des règles et les normes rivales sont pertinents. Une fois cette situation établie, cet article se tourne vers une analyse des mesures juridiques qui ont comblé le vide laissé par l’absence de réglementation internationale et l’absence d’harmonisation du droit : lois extraterritoriales dans l’Union européenne (législation régionale) et les États-Unis (législation des États); et lois sur la localisation des données en Chine et en Russie. Des dispositions spécifiques restreignant les transferts transfrontaliers de données à caractère personnel sont détaillées dans la législation de l’UE, de même que les accords internationaux qui ont été précieux pour permettre aux flux entre les États-Unis et l’Union européenne de continuer, d’abord la sphère de sécurité (Safe Harbor), et maintenant le bouclier de protection de la vie privée (Privacy Shield. Enfin, dans ce contexte, le rôle de la gouvernance des données est étudié, tant dans le contexte de la responsabilité des responsables du traitement pour les actions d’autres acteurs de l’offre mondiale en vertu du droit de l’UE et dans le cadre du Bouclier de protection de la vie privée (Privacy Shield). Ainsi, cet article va au-delà de la loi elle-même, pour placer des exigences dans le contexte du monde des affaires mondialisé des flux de données, et pour suggérer des moyens que les entreprises peuvent améliorer leur position de conformité dans le monde entier.

International audience; Today, cross-border data flows are an important component of international trade and an element of digital service models. However, they are impeded by restrictions on cross-border personal data transfers and data localization legislation. This Article focuses primarily on these complexities and on the impact of the new European Union ("EU") legislation on personal data protection-the GDPR. First, this Article introduces its discussion of these flows by placing them in their economic and geopolitical setting, including a discussion of the results of a lack of international harmonization of law in the area. In this framework, rule overlap and rival standards are relevant. Once this situation is established, this Article turns to an analysis of the legal measures that have filled the gap left by the lack of international regulation and the failure to harmonize law: extraterritorial laws in the European Union (regional legislation) and the United States (state legislation);and data localization laws in China and Russia. Specific provisionsrestricting cross-border personal data transfers are detailed under EU legislation, as are the international agreements that have been invaluable in allowing flows between the United States and the European Union to continue—first the Safe Harbor, and now the Privacy Shield. Finally, in this context, the role of data governance is investigated, both in the context of data controllers’ accountability for the actions of other actors in global supplychains under EU law and under the Privacy Shield. Thus, this Article goes beyond the law itself, to place requirements in the context of the globalized business world of data flows, and to suggest ways that companies may improve their compliance position worldwide.; Aujourd’hui, les flux transfrontaliers de données sont un élément important du commerce international et un élément des modèles de services numériques. Toutefois, elles sont entravées par des restrictions sur les transferts transfrontaliers de données à caractère personnel et la législation sur la localisation des données. Le présent article met principalement l’accent sur ces complexités et sur l’impact de la nouvelle législation de l’Union européenne (UE) sur la protection des données à caractère personnel - le RGPD. Tout d’abord, cet article présente sa discussion sur ces flux en les plaçant dans leur contexte économique et géopolitique, y compris une discussion sur les résultats d’un manque d’harmonisation internationale du droit dans le domaine. Dans ce cadre, le chevauchement des règles et les normes rivales sont pertinents. Une fois cette situation établie, cet article se tourne vers une analyse des mesures juridiques qui ont comblé le vide laissé par l’absence de réglementation internationale et l’absence d’harmonisation du droit : lois extraterritoriales dans l’Union européenne (législation régionale) et les États-Unis (législation des États); et lois sur la localisation des données en Chine et en Russie. Des dispositions spécifiques restreignant les transferts transfrontaliers de données à caractère personnel sont détaillées dans la législation de l’UE, de même que les accords internationaux qui ont été précieux pour permettre aux flux entre les États-Unis et l’Union européenne de continuer, d’abord la sphère de sécurité (Safe Harbor), et maintenant le bouclier de protection de la vie privée (Privacy Shield. Enfin, dans ce contexte, le rôle de la gouvernance des données est étudié, tant dans le contexte de la responsabilité des responsables du traitement pour les actions d’autres acteurs de l’offre mondiale en vertu du droit de l’UE et dans le cadre du Bouclier de protection de la vie privée (Privacy Shield). Ainsi, cet article va au-delà de la loi elle-même, pour placer des exigences dans le contexte du monde des affaires mondialisé des flux de données, et pour suggérer des moyens que les entreprises peuvent améliorer leur position de conformité dans le monde entier.

Motivation: As the size of high-throughput DNA sequence datasets continues to grow, the cost of transferring and storing the datasets may prevent their processing in all but the largest data centers or commercial cloud providers. To lower this cost, it should be possible to process only a subset of the original data while still preserving the biological information of interest. Results: Using 4 high-throughput DNA sequence datasets of differing sequencing depth from 2 species as use cases, we demonstrate the effect of processing partial datasets on the number of detected RNA transcripts using an RNA-Seq workflow. We used transcript detection to decide on a cutoff point. We then physically transferred the minimal partial dataset and compared with the transfer of the full dataset, which showed a reduction of approximately 25% in the total transfer time. These results suggest that as sequencing datasets get larger, one way to speed up analysis is to simply transfer the minimal amount of data that still sufficiently detects biological signal. Availability: All results were generated using public datasets from NCBI and publicly available open source software.

International audience; —We review the research literature investigating systems in which mobile entities can carry data while they move. These entities can be either mobile by nature (e.g., human beings and animals) or mobile by design (e.g., trains, airplanes, and cars). The movements of such entities equipped with storage capabilities create a communication channel which can help overcome the limitations or the lack of conventional data networks. Common limitations include the mismatch between the capacity offered by these networks and the traffic demand or their limited deployment owing to environmental factors. Application scenarios include offloading traffic off legacy networks for capacity improvement, bridging connectivity gaps, or deploying ad hoc networks in challenging environments for coverage enhancement.

Certification and seals as a form of co-regulation have been on the EU agenda for over a decade. Enhancing consumer trust and promoting transparency and compliance are central arguments in the policy endorsement for certification. In the field of data protection, the General Data Protection Regulation has substanti- ated considerably these policy objectives of the European Commission. Our con- tribution discusses the new legal EU regime for data protection certification. Starting from the background of data protection certification and the preparatory works of the General Data Protection Regulation, the chapter analyses the legal provisions in the new EU data protection framework and reflects on the steps after the Regulation starts to apply.

Safe Harbour (Henceforth, SH) has been the main enabler of EU-US personal data transfers since Decision 2000/520/EC came into force. Initially, Safe Harbour was seen as an innovative solution to a difficult problem. However, the problems the agreement was created to solve were never remedied. Thus, it did not come as a surprise that the Court of Justice of the European Union (hereinafter, CJEU), in Case C-362/14 (the Schrems ruling), deemed the agreement invalid. In the story “And he built a crooked house”, the infamous ‘crooked house’, designed by Robert A. Heinlein’s character Quintus Teal, mirrors SH’s flawed design. It also exemplifies the fact that great innovations can fail if not thought through carefully. Although the Schrems ruling’s scope does not go beyond Decision 2000/520/EC, it will force European Data Protection Agencies to look deeper into alternative data transfer mechanisms and possibly, consider transfers to jurisdictions other than the US. Furthermore, this decision highlights the fact that if any progress on this front is going to be made going forward regarding personal data transfers, any solution(s) would have to be made at a global level. This paper will provide an overview of the implications of the CJEU ruling on data transfers between the EU and the US going forward., info:eu-repo/semantics/publishedVersion

In this conference report, we summarize the main findings and messages from a workshop on 'Data Integrity'. The workshop was held at the 11th European Bioanalysis Forum Open (EBF) Symposium in Barcelona (21-23 November 2018), in collaboration with the Medicines and Health products Regulatory Agency to provide insight and understanding of regulatory data integrity expectations. The workshop highlighted the importance of engaging with software developers to address the gap between industry's data integrity needs and current system software capabilities. Delegates were also made aware of the importance of implementing additional procedural controls to mitigate the risk associated with using systems that do not fully meet data integrity requirements.

Silicon MOSFETs are active switching elements which form the basis for most currently available digital circuits. Especially in information technology the growth in circuit complexity and data throughput leads to an increase in power consumption. For this reason, the energy efficiency of transistors has become a major design issue. A common way to increase the energy efficiency of these devices is to reduce the signal level, which finally leads to the so-called sub-threshold operation. An advantage of this approach is that it can be applied to common structures so that new device concepts are not necessarily required. However, the reduction in the signal level leads unavoidably to a degradation of the signal to noise ratio. Especially random telegraph noise has a significant influence on the circuit behavior. In this work this type of noise is studied mathematically. A stochastic simulation model was developed and a method was provided by which it can be determined how low the supply voltage can be chosen in order to keep the noise influence sufficiently low.

Data transfers scheduling is an important part of almost all distributed virtual walkthrough (DVW) applications. Its main purpose is to preserve data transfer efficiency and render quality during scene exploration. The most limiting factors here are network restrictions such as low bandwidth and high latency. Current scheduling algorithms use multi-resolution data representation, priority determination and data prefetching algorithms to minimize these restrictions. Advanced priority determination and data prefetching methods for DVW applications use mathematic description of motion to predict next position of each individual user. These methods depend on the recent motion of a user so that they can accurately predict only near locations. In the case of sudden but regular changes in user motion direction (road networks) or fast moving user, these algorithms are not sufficient to predict future position with required accuracy and at required distances. In this paper we propose a systematic solution to scheduling of data transfer for DVW applications which uses next location prediction methods to compute download priority or additionally prefetch rendered data in advance. Experiments show that compared to motion functions the proposed scheduling scheme can increase data transfer efficiency and rendered image quality during scene exploration.

15 pages; International audience; Automatic data transfer generation is a critical step for guided or automatic code generation for accelerators using distributed memories. Although good results have been achieved for loop nests, more complex control ows such as switches or while loops are generally not handled. This paper shows how to leverage the convex array regions abstraction to generate data transfers. The scope of this study ranges from inter-procedural analysis in simple loop nests with function calls, to inter-iteration data reuse optimization and arbitrary control ow in loop bodies. Generated transfers are approximated when an exact solution cannot be found. Array regions are also used to extend redundant load store elimination to array variables. The approach has been successfully applied to GPUs and domain-speci c hardware accelerators.

International audience; This paper describes how the NewMadeleine communication library has been integrated within the MPICH2 MPI implementation and the benefits brought. NewMadeleine is integrated as a Nemesis network module but the upper layers and in particular the CH3 layer has been modified. By doing so, we allow NewMadeleine to fully deliver its performance to an MPI application. NewMadeleine features sophisticated strategies for sending messages and natively supports multirail network configurations, even heterogeneous ones. It also uses a software element called PIOMan that uses multithreading in order to enhance reactivity and create more efficient progress engines. We show various results that prove that NewMadeleine is indeed well suited as a low-level communication library for building MPI implementations.

With the rapid development of IT data driven experiments and simulations have become very advanced and complicated. The amount and complexity of scientific data increase exponentially. Nowadays the challenge is to efficiently support scientists who generate more data than they can possibly look at and understand. This requires not only high-performance visualization and feature extraction techniques but also efficient and intuitive management of available data and underlying computational resources. Consequently, Service Oriented Architectures and workflow management systems are becoming popular solutions for the deployment of e-Science Infrastructures aimed to assist in exploration and analysis of large scientific data. In this paper, we compare two transport models of workflow execution for data-intensive medical visualizations that rely on web services. The image-based analysis of vascular disorders served as a case study for this project. We applied a service oriented approach to construct distributed visualization pipelines, which allow visualization experts to develop visualizations to view and interact with large medical data sets. Moreover, end-users (i.e., medical specialists) can explore these visualizations irrespective of their geographical location and available computing resources. The paper reports on the current implementation status and presents our main findings.

The race to create local cloud solutions has become a constant in the digital development programs of member States. Italy is promoting the establishment of the so-called "national cloud", and Germany and France have been working for some time on the Gaia-X project. At European level, the development of cloud computing is taking a strategic role, at least for the immediate future. The declared objective is to free us from solutions that today are almost entirely dependent on infrastructures made available by international providers. Contributing to the debate - more by superimposition than composition - there are broadly geopolitical motivations, aspirations to global technological predominance and concerns associated with personal data protection for third party interference due to the extraterritorial application of foreign legislation. The recent "Schrems II" ruling by the Court of Justice of the European Union, and previously, but with less impact in the broader public, the results of the joint EDPB (European Data Protection Board)-EDPS (European Data Protection Supervisor) study on the United States' Cloud Act, have forced the question of the international acquisition of personal data flows (and non-personal, we may add) and the associated assurances. This paper intends to offer an analysis of the subject, aimed above all at unravelling the multiple levels of the questions raised, which touch not only on legal but on political matters and give an initial, reasoned census of the various bodies of applicable law. Above and beyond hard-hitting declarations, we need to determine to what point the independence of a local European cloud is effectively possible or desirable compared to non-EU providers and, in more concrete terms, to what point an autonomous solution is economically and technically practicable in terms of services that are essential for the States, and that enable the exercise of other fundamental rights and freedoms, for individuals, and therefore must not be susceptible to impairment or interruption. We also have to understand to what point it would be opportune in terms of security, even if this, at first glance, may seem counter-intuitive. In this sense, at least in the overall assessment, we have to consider the high levels of service stability and the existence of high-tech measures to contrastcybercrimethat the major international providers can ensure, levels it would be inadvisable to forgo if it were possible to keep the benefits, thereby significantly reducing the associated risks. Indeed, the protection of processed data from external interference must also be measured on a different, but nonetheless significant, level to that of any potential "extraterritorial" threat, represented by criminal activity and security breaches. Another factor that must be considered is the availability of solutions, already entirely actual and "in the hands" of users, which offer immediate protection, such as encryption or the segregation of strategic data sets. In other words, if there are possible measures that significantly reduce the extraterritorial risk and that retain the advantages in terms of contrastingcybercrime, these must be duly included in the overall assessment. Our analysis will also shed light on inconsistencies in terms of data protection within the European Union, and misalignments between national efforts toward localization and the principle of the free circulation of data. In short, we intend to offer a more articulate, less obvious outline of the subjects we are dealing with, which cannot be reduced (if not at the cost of excessive simplification) to the simple contraposition of E.U.versusnon-EU, but which reveal lateral synergies and joint misalignments on fronts apparently united; rather, it would be better to think in terms of the creation of a shared ecosystem that draws the most significant advantage from the solutions available today and acknowledges the need to adopt concrete forms of protection. This does not in any way mean evading the serious, but not immediately solvable extraterritorial questions, but preferably using them, if anything, as a mechanism for obtaining a critical reconsideration of the shortcomings and lack of legal harmonization that emerge even within the European Union. Nor does it mean embarking on a path toward domestic solutions that offer little, or at least less protection than those currently available, but instead maintaining high levels of protection against unlawful activity through more advanced technological solutions, and at the same time identifying legal instruments which assure greater national control of the infrastructures and data, and reduce risk to a legally acceptable level.

The race to create local cloud solutions has become a constant in the digital development programs of member States. Italy is promoting the establishment of the so-called "national cloud", and Germany and France have been working for some time on the Gaia-X project. At European level, the development of cloud computing is taking a strategic role, at least for the immediate future. The declared objective is to free us from solutions that today are almost entirely dependent on infrastructures made available by international providers. Contributing to the debate - more by superimposition than composition - there are broadly geopolitical motivations, aspirations to global technological predominance and concerns associated with personal data protection for third party interference due to the extraterritorial application of foreign legislation. The recent "Schrems II" ruling by the Court of Justice of the European Union, and previously, but with less impact in the broader public, the results of the joint EDPB (European Data Protection Board)-EDPS (European Data Protection Supervisor) study on the United States' Cloud Act, have forced the question of the international acquisition of personal data flows (and non-personal, we may add) and the associated assurances. This paper intends to offer an analysis of the subject, aimed above all at unravelling the multiple levels of the questions raised, which touch not only on legal but on political matters and give an initial, reasoned census of the various bodies of applicable law. Above and beyond hard-hitting declarations, we need to determine to what point the independence of a local European cloud is effectively possible or desirable compared to non-EU providers and, in more concrete terms, to what point an autonomous solution is economically and technically practicable in terms of services that are essential for the States, and that enable the exercise of other fundamental rights and freedoms, for individuals, and therefore must not be susceptible to impairment or interruption. We also have to understand to what point it would be opportune in terms of security, even if this, at first glance, may seem counter-intuitive. In this sense, at least in the overall assessment, we have to consider the high levels of service stability and the existence of high-tech measures to contrast cybercrime that the major international providers can ensure, levels it would be inadvisable to forgo if it were possible to keep the benefits, thereby significantly reducing the associated risks. Indeed, the protection of processed data from external interference must also be measured on a different, but nonetheless significant, level to that of any potential "extraterritorial" threat, represented by criminal activity and security breaches. Another factor that must be considered is the availability of solutions, already entirely actual and "in the hands" of users, which offer immediate protection, such as encryption or the segregation of strategic data sets. In other words, if there are possible measures that significantly reduce the extraterritorial risk and that retain the advantages in terms of contrasting cybercrime, these must be duly included in the overall assessment. Our analysis will also shed light on inconsistencies in terms of data protection within the European Union, and misalignments between national efforts toward localization and the principle of the free circulation of data. In short, we intend to offer a more articulate, less obvious outline of the subjects we are dealing with, which cannot be reduced (if not at the cost of excessive simplification) to the simple contraposition of E.U. versus non-EU, but which reveal lateral synergies and joint misalignments on fronts apparently united; rather, it would be better to think in terms of the creation of a shared ecosystem that draws the most significant advantage from the solutions available today and acknowledges the need to adopt concrete forms of protection. This does not in any way mean evading the serious, but not immediately solvable extraterritorial questions, but preferably using them, if anything, as a mechanism for obtaining a critical reconsideration of the shortcomings and lack of legal harmonization that emerge even within the European Union. Nor does it mean embarking on a path toward domestic solutions that offer little, or at least less protection than those currently available, but instead maintaining high levels of protection against unlawful activity through more advanced technological solutions, and at the same time identifying legal instruments which assure greater national control of the infrastructures and data, and reduce risk to a legally acceptable level.