Re: Looks like endgame.
Start building those EU data centres and make sure there's a good legal firewall between their operations & the US corporation. You know you're going to need them.
Won't help due to leverage. In the case of a subsidiary (say, Microsoft Ireland), you're deemed as owner to have enough power to compel certain activity. This stance is assisted by the refusal of US law to acknowledge that anything else exists in the Universe - US courts couldn't care less that complying with a US order for disclosure could cause the subsidiary to be in breach of local laws.
It's getting slightly better insofar that moving your HQ from the US will now help a bit, but a while ago I informally spoke to lawyers* of a rather well known US company when I was in Brussels for some briefings, and they were working from the principle that even having a man and a shed subsidiary in the US was putting them (and, by implication, their many, many EU clients) at risk of leverage attempts. This is why you now get big hosting projects and resales set up: they're mainly tests to see what amount of work needs to be done to create feasible proxies to indeed establish that sort of isolation.
In the case of a contractual relationship, if the DoJ can make it stand that you have set up such a contract to specifically work your way around US law you have a problem too.
The latter, by the way, is far more complicated anyway: in most countries, hosting the data of your company deems said data to remain under the jurisdiction of origin. I see that a lot with UK and US companies who think that just hosting their data abroad somehow makes it magically exempt from local law. In that sort of construct, that data is usually still considered local and remains under local jurisdiction. It can be done (after all, that's what I do), but it's not as trivial as most people think - there are /lots/ of gotchas, both in law and in practical implementation.
* I'm not a lawyer, I just have many dealings with them.
Biting the hand that feeds IT
