Corporations operating in the EU are subject to EU data protection laws.
It does not matter if the PATRIOT Act forces them to hand this data over. They are breaking the law in the EU.
Google had two choices:
1. Don't hand over the data => they break the US law
2. Hand over the data => they break EU law plus hand over personal data of users who might not want that
To me choice number one would be the lesser "evil" thing to do.
The solution is to have completely separate entities of the company in the local jurisdictions. Those follow local law and only share data with their foreign sister companies in a lawful manner and otherwise can ignore foreign law.
Of course this creates some complexities but it's the right way to do, everything else gets you into trouble and even huge companies as Google can't get around colliding laws from different jurisdictions.
Handing over data to intelligence agencies is just one example of mutually exclusive laws. There are actually many more like data retention laws. The internet is probably the biggest challenge to international laws and treaties ever.
Google had two choices:
To me choice number one would be the lesser "evil" thing to do.The solution is to have completely separate entities of the company in the local jurisdictions. Those follow local law and only share data with their foreign sister companies in a lawful manner and otherwise can ignore foreign law. Of course this creates some complexities but it's the right way to do, everything else gets you into trouble and even huge companies as Google can't get around colliding laws from different jurisdictions.
Handing over data to intelligence agencies is just one example of mutually exclusive laws. There are actually many more like data retention laws. The internet is probably the biggest challenge to international laws and treaties ever.