5 ms·

Edit: I'm reacting to "Facebook and Twitter [...] could be forced to host European user data in Europe" Border control with data is the worst idea ever. Think

Edit: I'm reacting to "Facebook and Twitter [...] could be forced to host European user data in Europe" Border control with data is the worst idea ever. Think of it: my Facebook friends lists has EU and US people in it. This list can't reside in EU or US. This webpage can't be served by either a EU or US web-server. By law. LOL Plus I'm a EU citizen, and I can choose to give my data to whoever I want... no more. That's sad. This ruling only shows the dismal tech knowledge of lawyers and lawmakers. It's impossible to implement Facebook with data spread between EU and US. Same for Tweeter and others. Say goodbye to social networks. Because of model denormalization, because of network latency and intercontinental bandwidth. Some mention cloud zones, but they're only useful with replication, which IS data transfer. OR... social networks will cheat. And one day, they'll be sued for cheating the impossible regulations (think VW...)

pjc50 11y ago
This webpage can't be served by either a EU or US web-server. It's not bidirectional: you could keep it in the EU and serve it from there.
- weddpros 11y ago
  you assume the US would be OK with hosting US data in Europe...
  - pjc50 11y ago
    The US has no applicable law on the subject? You can't host US classified data overseas, but there's no general law of privacy.
    - weddpros 11y ago
      With the Safe Harbor law, it was reasonable. But without it? Protectionism is seldom one-way
Oletros 11y ago
You can't be more wrong in your claims
- weddpros 11y ago
  Please tell me how. We can surely debate the technicalities.
  - Oletros 11y ago
    For exaqmple > Think of it: my Facebook friends lists has EU and US people in it. This list can't reside in EU or US. This webpage can't be served by either a EU or US web-server. This is plainly wrong, a reference tyo an user in a list is not the user data Have you read the ruling?
    - weddpros 11y ago
      A reference will not be enough when my friend wants to see my name and photo on the list. And if my friend must fetch it from Europe (and not cache it), expect Facebook to be slower and use more bandwidth than ever. Without intercontinental replication, you'll be facing latency and bandwidth problems which will make social networks impossible. note: when I say bandwidth, I mean intercontinental bandwidth, not your local internet bandwidth.
simonh 11y ago
> Think of it: my Facebook friends lists has EU and US people in it. This list can't reside in EU or US. I think you're misunderstanding the ownership of the data, hence the down votes. If I as an EU citizen create a private friends list like this, that list belongs to me. If I live in the EU but create the list using a US service with servers in the US, there is no problem. US privacy laws apply. If I create the list using an EU service on EU hosted servers there is no problem, EU privacy laws apply. However in this second case if the internet service company wants to transfer the list from their EU servers to their US servers without my explicit permission, that's a problem.
- estefan 11y ago
  I think the parent is getting at if you're in the EU and your data cannot be transferred to the US, and a friend in the US has data that cannot be transferred to the EU (if they were to follow suit) you wouldn't be able to create a list of friends in both localities because of the restriction to send data around, without incurring intercontinental latencies. Obviously the list itself could reside in either location, but the service provider would need to perform an intercontinental join each time you wanted to view the names of friends in your list.
  - weddpros 11y ago
    Thank you! You got my point.
    - estefan 11y ago
      Where it gets really tricky is caching. Say you do your intercontinental join but then want to cache HTML fragments for performance, well, is that classed as "transferring data" because technically it is...
      - buro9 11y ago
        I think it will be reasonably argued that data in this context is the master record. The source of truth to which queries are sent. A cache is not that, and you need only look at something like the EU e-commerce directive to find exceptions for caches and networks on the basis of being a "mere conduit" for the communication. It is not as if the data is now toxic and cannot be cached or communicated outside of the EU, only that the data must be stored in the EU and should not be replicated to any database or storage outside of the EU that would prevent EU privacy law taking effect. That's important as EU privacy law already has enough exceptions to allow reasonable scenarios like caching to function. And if you are going to say "well I could just query my cache", then I'd suggest that if your cache is able to do much more than a single key|value lookup to retrieve the cached item then it is in fact a database you'd lose the protections of being a cache and you're back in the world of not storing EU data outside of the EU.
rbehrends 11y ago
The judgment does not prevent you from storing personal data in the US per se. It only nullifies the blank check of the safe harbor provision. As far as I can tell, there's nothing preventing Facebook from obtaining consent from you using Model Contract Clauses or Binding Corporate Rules, for example. This is already normal for companies from countries that do not enjoy the benefits of a safe harbor provision, after all.
- weddpros 11y ago
  If it's just a problem with Facebook's contract, all is well. But the article says "Facebook and Twitter [...] could be forced to host European user data in Europe". That's way more agressive than just a contract change and poses a threat of technical blocking problems.
  - rbehrends 11y ago
    I didn't say that it's just a problem with Facebook's contract. Model Contract Clauses and Binding Corporate Rules are pretty restrictive, and Facebook may not like them and prefer to instead separate their data. But neither does it mean that they cannot do it.

pjc50 11y ago

This webpage can't be served by either a EU or US web-server. It's not bidirectional: you could keep it in the EU and serve it from there.

weddpros 11y ago
you assume the US would be OK with hosting US data in Europe...
- pjc50 11y ago
  The US has no applicable law on the subject? You can't host US classified data overseas, but there's no general law of privacy.
  - weddpros 11y ago
    With the Safe Harbor law, it was reasonable. But without it? Protectionism is seldom one-way

Oletros 11y ago

You can't be more wrong in your claims

weddpros 11y ago
Please tell me how. We can surely debate the technicalities.
- Oletros 11y ago
  For exaqmple > Think of it: my Facebook friends lists has EU and US people in it. This list can't reside in EU or US. This webpage can't be served by either a EU or US web-server. This is plainly wrong, a reference tyo an user in a list is not the user data Have you read the ruling?
  - weddpros 11y ago
    A reference will not be enough when my friend wants to see my name and photo on the list. And if my friend must fetch it from Europe (and not cache it), expect Facebook to be slower and use more bandwidth than ever. Without intercontinental replication, you'll be facing latency and bandwidth problems which will make social networks impossible. note: when I say bandwidth, I mean intercontinental bandwidth, not your local internet bandwidth.

simonh 11y ago

> Think of it: my Facebook friends lists has EU and US people in it. This list can't reside in EU or US. I think you're misunderstanding the ownership of the data, hence the down votes. If I as an EU citizen create a private friends list like this, that list belongs to me. If I live in the EU but create the list using a US service with servers in the US, there is no problem. US privacy laws apply. If I create the list using an EU service on EU hosted servers there is no problem, EU privacy laws apply. However in this second case if the internet service company wants to transfer the list from their EU servers to their US servers without my explicit permission, that's a problem.

estefan 11y ago
I think the parent is getting at if you're in the EU and your data cannot be transferred to the US, and a friend in the US has data that cannot be transferred to the EU (if they were to follow suit) you wouldn't be able to create a list of friends in both localities because of the restriction to send data around, without incurring intercontinental latencies. Obviously the list itself could reside in either location, but the service provider would need to perform an intercontinental join each time you wanted to view the names of friends in your list.
- weddpros 11y ago
  Thank you! You got my point.
  - estefan 11y ago
    Where it gets really tricky is caching. Say you do your intercontinental join but then want to cache HTML fragments for performance, well, is that classed as "transferring data" because technically it is...
    - buro9 11y ago
      I think it will be reasonably argued that data in this context is the master record. The source of truth to which queries are sent. A cache is not that, and you need only look at something like the EU e-commerce directive to find exceptions for caches and networks on the basis of being a "mere conduit" for the communication. It is not as if the data is now toxic and cannot be cached or communicated outside of the EU, only that the data must be stored in the EU and should not be replicated to any database or storage outside of the EU that would prevent EU privacy law taking effect. That's important as EU privacy law already has enough exceptions to allow reasonable scenarios like caching to function. And if you are going to say "well I could just query my cache", then I'd suggest that if your cache is able to do much more than a single key|value lookup to retrieve the cached item then it is in fact a database you'd lose the protections of being a cache and you're back in the world of not storing EU data outside of the EU.

rbehrends 11y ago

The judgment does not prevent you from storing personal data in the US per se. It only nullifies the blank check of the safe harbor provision. As far as I can tell, there's nothing preventing Facebook from obtaining consent from you using Model Contract Clauses or Binding Corporate Rules, for example. This is already normal for companies from countries that do not enjoy the benefits of a safe harbor provision, after all.

weddpros 11y ago
If it's just a problem with Facebook's contract, all is well. But the article says "Facebook and Twitter [...] could be forced to host European user data in Europe". That's way more agressive than just a contract change and poses a threat of technical blocking problems.
- rbehrends 11y ago
  I didn't say that it's just a problem with Facebook's contract. Model Contract Clauses and Binding Corporate Rules are pretty restrictive, and Facebook may not like them and prefer to instead separate their data. But neither does it mean that they cannot do it.