The fact that the same content might be simultaneously located on servers in multiple jurisdictions shows that it often makes little sense to have jurisdiction based only on the location of servers. One could argue that this fact also leaves data location requirements with little if any meaning. However, it depends on why data location requirements are created. When the requirements stem from a country’s desire that data be stored and/or processed only within its jurisdiction, then the simultaneous use of servers in multiple jurisdictions defeats the purpose of the requirement. However, when the requirements arise from a country’s need to have some means of enforcement against a physically absent operator, it might be sufficient (or as good as it can get under the circumstances) for the country to have access to some servers, even if the data might also be on other servers outside the country.

The solution in Scenario 3 of (a) no jurisdiction based solely on the location of servers, and (b) no data location requirements seems to make the most sense from a technological perspective. But the solution can work only if countries can rely on mutual assistance for enforcement, with built-in safeguards for the protection of internationally-recognized fundamental rights and freedoms.

In the context of the Microsoft (Data Stored in Ireland) decision, several commentators pointed out the problem with jurisdiction based on server location when data are on multiple servers in different jurisdictions (for example, Orin Kerr at https://www.washingtonpost.com/news/volokh-conspiracy/wp/2016/11/29/the-surprising-implications-of-the-microsoftireland-warrant-case/?utm_term=.eb7004721475; I pointed it out at https://blog.ericgoldman.org/archives/2016/08/second-circuits-decision-in-microsoft-v-u-s-data-stored-in-ireland-good-news-for-internet-users-guest-blog-post.htm).