2

I am a software developer with almost no knowledge of international laws. So here is a hypothetical scenario. Let's say, I live in a XYZ country and Google cloud has a data center in my country and I use their service to keep my data in the cloud, in the data center that is present inside my country.

If the USA puts my country on the sanctioned list(or restricts trade), like Iran, then I suppose American companies won't be allowed to do any business with any citizen of my country. In this case, what happens to my data? Since to do any business in my country, a company has to register a local entity, there will be a separate entity that is "Google XYZ".

Is it legal for "Google XYZ" to continue the operation in my country? Or Since this is a subsidiary or related to Google in the USA, it can't continue the business? (I have no idea how this type of setup works when a company opens a branch in another country)

If it is allowed, I guess I will be able to retrieve my data, but what if it's not technically feasible to retrieve data without going through infrastructure owned by Google in the USA?

If it is not allowed, then what happens to company assets in the sanctioned country? Like some have manufacturing units, some have data centers, and many other kinds of assets.

I am a little worried since I saw how some people in Iran were locked out of Github without any option to export their data. And this case, the majority of cloud providers are American companies, so just wanted to get some clarity.

Improve this question
1
  • 1
    Not an answer, but practically speaking you do not own any data which you store in a cloud service and which you don't have a copy of somewhere else which is within your control. You should assume that such data can vanish at any moment. Sanctions are just one (and relatively less likely) possibility. Bankruptcy, incompetence, hacks, fire, theft, etc. are others. Cloud services should be seen as a convenience tool, not a primary mode of data persistence.
    – JBentley
    Aug 16, 2021 at 15:46

2 Answers 2

Reset to default
3

There is a specific answer about Iran, and a vague general answer. The vague general answer is "It depend on what the sanctions are". Here is the summary of the sanctions against DR Congo. The gist of the sanctions is that they are directed against 7 particular individuals. The prohibited transcations are described as:

Unless otherwise authorized or exempt, transactions by U.S. persons, or in or involving the United States, are prohibited if they involve transferring, paying, exporting, withdrawing, or otherwise dealing in the property or interests in property of an entity or individual listed on the SDN List. The property and interests in property of an entity that is 50 percent or more directly or indirectly owned, whether individually or in the aggregate, by one or more persons on the SDN List are also blocked, regardless of whether the entity itself is listed.

In the case of Iran, the sanctions are much broader, but not universal. Bear in mind that a service provider may take an action which is not absolutely mandated by US law, out of an abundance of caution and fear of misinterpreting the law. Here is a list of computer things that are allowed to flow to Iran. Note the following.

441. Do the Personal Communications GLs authorize the exportation of fee-based cloud computing services to Iran and Sudan?

Yes. Paragraphs (a)(1) of the Personal Communications GLs authorize the exportation to Iran and Sudan of fee-based cloud computing services incident to the exchange of personal communications over the Internet. In addition, paragraphs (a)(2)(i) and (a)(3) authorize software necessary to enable such services, provided that such software is designated EAR99 or classified by the U.S. Department of Commerce on the CCL under ECCN 5D992.c or, in the case of software that is not subject to the EAR, would be designated EAR99 if it were located in the United States or would meet the criteria for classification under ECCN 5D992.c if it were subject to the EAR.

Would that cover your interest? (Would you, as a business, take a risk in possibly mis-interpreting this guidance?)

Indeed, Github announced earlier this year that it now has a license to operate in Iran (they don't discuss details what caused the earlier restrictions, which were not absolute). During that period, some users had access suspended (but not, it is reported, public repositories).

Improve this answer
1
  • Thanks for the detailed answer, but that paragraph is too complex for me to interpret. I think it means that export of those softwares allowed but needs to meet certain criteria. Anyway, as you mentioned Github got a license in this case but I guess that won't be possible for every company or every time.
    – Sajan
    Aug 16, 2021 at 4:35
1

You lose it

Just like you lose it if your country goes to war with another country.

If you have assets in a foreign country (could be data, could be real estate, could be gold bricks in a bank vault, doesn’t matter) and your country passes a law making it illegal to do business with that country, you can’t get your still until that law is repealed.

Improve this answer
2
  • 1
    But in this case the datacenter is in my country. So I understand if the company from USA is not allowed to access it, but shouldn’t I be allowed to access it ? Also, as I mentioned, I think every company needs to setup a local entity to do business in foreign country, can this local entity access these assets ?
    – Sajan
    Aug 16, 2021 at 4:39
  • 1
    This is too simplistic and depends on the exact terms of the sanction. It's not unheard of to have sanctions "freeze" assets of affected foreign nationals, but assets belonging to regime leaders might be seized instead of frozen.
    – MSalters
    Aug 16, 2021 at 13:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .