Deel (an American payroll and hiring company) is now under a DOJ criminal investigation and a federal RICO suit for allegedly planting a corporate spy inside Rippling, someone who confessed in an Irish court to handing customer lists and product roadmaps to Deel's leadership.
It's all in the court filings, a US federal judge just cleared the case to head to trial and refused to let Deel move it overseas.
And Deel is massive, it is one of the biggest employer of record platforms on earth, so for a huge number of European companies, an American firm is the legal employer of their staff and the custodian of their contracts and their entire payroll file.
We spend a lot of energy here arguing over which cloud or which office suite to buy, while the layer that holds our people's employment data stays almost entirely American, and one of its market leaders stands accused of running espionage.
And storing that data on EU servers does not fix it. Under the US CLOUD Act a US-headquartered company can be forced to hand over data it controls wherever the servers physically sit, which is the exact thing the new EU Data Act from last September was written to block.
The two laws are in open conflict, so if your employer of record answers to a US parent, your engineers' personal data sits on the wrong side of that fight.
And all of this lands right as Europe is finally waking up to the problem, the Commission put out its Tech Sovereignty Package in June, Amazon rushed a separate European Sovereign Cloud into Brandenburg to look independent, everyone is suddenly serious about chips and clouds, and yet the employment layer (the one holding the most sensitive personal data of every worker on the continent), gets left out of the conversation entirely.
I'm not saying tear up your contracts tomorrow, but if buying European is going to mean anything beyond a hosting region, it has to reach who legally employs your people.
Go and check who the parent company of your EOR or payroll provider really is, and which courts it answers to.
We did exactly that after this news broke, and when ours turned out to be American we moved the team onto Workmotion (a German one), so the data and the legal employer at least stay on this side of the Atlantic.
The European options aren't flawless, but that part matters a lot more to me now. I'd put money on a lot of you assuming yours is European when it isn't.
