A question was asked at the social platform Linkedin to the following terms “Does anyone know whether data transmitted from a server at a US Army Post Office (APO) and Fleet Post Office (FPO) location overseas is subject to the data privacy laws of the country in which the server sits, or is considered a US transfer?".I personally believe it is subject to jurisdiction and laws of the nations where such APO/FPO has been based. Further, I also believe that if a crime like cyber espionage has been committed by such unit or any person stationed therein, that nation can take cognizance of such matter.
However, the matter must be elaborated further. I believe that a US military base/facility would not become automatically entitled to diplomatic or legal immunity from host country’s civil and criminal laws and US laws would not apply to it in such circumstances. There is nothing like automatic immunity, implied immunity or absolute immunity that is available to US armed forces, including US APO/FPO.
Armed forces immunity can be claimed either under the international law and in a member country alone that is also part to any treaty in this regard to which US is also a member or it must be claimed through an executive agreement with the concerned country where US armed forces are stationed.
Until the post-World War II era, status of forces agreement (SOFAs) addressed this conflict between sovereigns and US policy was to rely heavily on the concept of immunity from host nation criminal jurisdiction created by the host nation's implied consent in expressly consenting to US forces being stationed there. The US policy of insisting on complete immunity from foreign criminal jurisdiction continued in the early post-World War II period, but ultimately gave way to the negotiation of systems of "concurrent jurisdiction" in SOFAs and bilateral supplementary agreements.
With the exception of the multilateral SOFA among the United States and North Atlantic Treaty Organization (NATO) countries, a SOFA is specific to an individual country and is in the form of an executive agreement.
It is not correct that no matter whatever criminal acts US APO/FPO commits, it or people behind the same would not be punishable in the host country, especially if it has nothing to do with the official duty as mentioned by me earlier through the cyber espionage example.
