4 ms·

Bad for startups and the interconnected Internet, but still damage minimization compared to allowing the NSA dragnet. The bad consequences are explained very w

by gasull 11y ago

Bad for startups and the interconnected Internet, but still damage minimization compared to allowing the NSA dragnet. The bad consequences are explained very well here: http://lucumr.pocoo.org/2015/10/6/end-of-safe-harbor/ http://lucumr.pocoo.org/2015/10/6/end-of-safe-harbor/

a_bonobo 11y ago
I have a few questions about this: >In a nutshell: this was the only reason any modern internet service could keep their primary user data in the United States on services like Amazon EC2 or Heroku. But shouldn't you be fine if you use EC2 with a European location? (Then you can approximate by using the instance with the lowest ping to the user) >The harder part is to figure out which user belongs to which jurisdiction. Does the climbing website have to do store personal information in the first place? Does a random user-name like "a_bonobo" count as private data? An e-mail address? An e-mail address from a throwaway host? Pictures of climbing walls? What constitutes "personal data" here?
- yuhong 11y ago
  Probably depends on whether the US can request the data to be transferred. I think there is a US court case on that one too.
  - JoshTriplett 11y ago
    Exactly. As a US citizen, if I run a service with data in the US, exactly one jurisdiction can attempt to demand data on my users; if I run a service with data in an EU country, at least two jurisdictions can. So unless a country wants to turn into China and try to stop all services not entirely run within their borders, they'll have to start trusting their citizens to select responsible service providers for themselves. Of course, the best possible solution: no jurisdiction can demand data a service doesn't have.
- esseti 11y ago
  For the first question is YES But, to be picky you have to be sure that data are ALWAYS STORED in the EU boundaries. which Amazon cannot guarantee. Personal data (and other data) are defined by the EU and probably US. The EU is EU Directive 95/46/EC (citing from wikipedia) "any information relating to an identified or identifiable natural person ("data subject"); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity;" (art. 2 a).
  - a_bonobo 11y ago
    Thank you for that - > ALWAYS STORED in the EU boundaries. which Amazon cannot guarantee. That makes sense, and I fear of what we'd do to enforce this - full data inspection just to make sure that Amazon doesn't transfer private data to the US? >n identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity So a username like "a_bonobo" wouldn't fall under personal data as it's not really identifiable (but what if I research bonobos? My username gives a clue to my job, if that would be my job!). So under gasull's link I think that a lot of what the climbing community would save isn't directly personal data, as you don't need much information from your users to run such a site (except if you want to have Facebook's business model). Or am I wrong? I mean, you can even identify someone based on their writing patterns.
    - esseti 11y ago
      (sorry for the late reply) You can't guarantee that AWS is doing. You have to belive it. That's why hospitals & co keep the data in their own servers. And, if in the cloud, they try to avoid US companies as much as they can. the username if not directly linked to someone (e.g., not an email) usually does not fall into personal data. But, since many usernames are reused by people they may identify the person. This is a a case which, honestly, i would not know how to deal with. I'll try to get an answer.
- yardie 11y ago
  From the operations side this isn't a problem. From a business op this will be very hard. Jobs will be replicated one for US and one for European client data. If you work in ads and are in the US you've lost access to an entire market of 500MM. I assume a lot of businesses are waking up and calling their lawyers.
- rmc 11y ago
  Personal data includes a lot of things. IP addresses of when someone connects. Yes, email addresses. What 'friends' someone has.
- gasull 11y ago
  I think personal data is any user generated content, including data about themselves like email address.
_yy 11y ago
> Today does not seem to be a good day for small cloud service providers. Not for service providers in the US, but it's a great day for European cloud service providers.
- thibaut_barrere 11y ago
  I've thought about this a lot, especially when picking up 3rd party services for my EU-based SaaS [1]. Ultimately I chose (then) Safe Harbor compliant US services, not out of convenience, but because most of them exhibited better security practices (e.g. 2FA) or deliverability (e.g. Mandrill) compared to their European counterparts. I'm concerned about 2 things mainly: - being forced to rely on less advanced 3rd parties, potentially less secure, which would not be a win for my users - later down the road, seeing a backfire from the US telling that I cannot store US customers data in the EU I have started a discussion over here [2]. [1] https://www.wisecashhq.com https://www.wisecashhq.com [2] http://discuss.bootstrapped.fm/t/concrete-ramifications-of-safe-harbor-strike-down-ruling-by-eu-court/3542 http://discuss.bootstrapped.fm/t/concrete-ramifications-of-s...
rodgerd 11y ago
> Bad for startups Only for startups whose business plan consists of plundering EU citizens' data in ways not consistent with the privacy laws of those countries. Those are startups I'm happy to see inconveniences.
- gasull 11y ago
  You haven't read the link.

by gasull 11y ago

a_bonobo 11y ago

I have a few questions about this: >In a nutshell: this was the only reason any modern internet service could keep their primary user data in the United States on services like Amazon EC2 or Heroku. But shouldn't you be fine if you use EC2 with a European location? (Then you can approximate by using the instance with the lowest ping to the user) >The harder part is to figure out which user belongs to which jurisdiction. Does the climbing website have to do store personal information in the first place? Does a random user-name like "a_bonobo" count as private data? An e-mail address? An e-mail address from a throwaway host? Pictures of climbing walls? What constitutes "personal data" here?

yuhong 11y ago
Probably depends on whether the US can request the data to be transferred. I think there is a US court case on that one too.
- JoshTriplett 11y ago
  Exactly. As a US citizen, if I run a service with data in the US, exactly one jurisdiction can attempt to demand data on my users; if I run a service with data in an EU country, at least two jurisdictions can. So unless a country wants to turn into China and try to stop all services not entirely run within their borders, they'll have to start trusting their citizens to select responsible service providers for themselves. Of course, the best possible solution: no jurisdiction can demand data a service doesn't have.
esseti 11y ago
For the first question is YES But, to be picky you have to be sure that data are ALWAYS STORED in the EU boundaries. which Amazon cannot guarantee. Personal data (and other data) are defined by the EU and probably US. The EU is EU Directive 95/46/EC (citing from wikipedia) "any information relating to an identified or identifiable natural person ("data subject"); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity;" (art. 2 a).
- a_bonobo 11y ago
  Thank you for that - > ALWAYS STORED in the EU boundaries. which Amazon cannot guarantee. That makes sense, and I fear of what we'd do to enforce this - full data inspection just to make sure that Amazon doesn't transfer private data to the US? >n identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity So a username like "a_bonobo" wouldn't fall under personal data as it's not really identifiable (but what if I research bonobos? My username gives a clue to my job, if that would be my job!). So under gasull's link I think that a lot of what the climbing community would save isn't directly personal data, as you don't need much information from your users to run such a site (except if you want to have Facebook's business model). Or am I wrong? I mean, you can even identify someone based on their writing patterns.
  - esseti 11y ago
    (sorry for the late reply) You can't guarantee that AWS is doing. You have to belive it. That's why hospitals & co keep the data in their own servers. And, if in the cloud, they try to avoid US companies as much as they can. the username if not directly linked to someone (e.g., not an email) usually does not fall into personal data. But, since many usernames are reused by people they may identify the person. This is a a case which, honestly, i would not know how to deal with. I'll try to get an answer.
yardie 11y ago
From the operations side this isn't a problem. From a business op this will be very hard. Jobs will be replicated one for US and one for European client data. If you work in ads and are in the US you've lost access to an entire market of 500MM. I assume a lot of businesses are waking up and calling their lawyers.
rmc 11y ago
Personal data includes a lot of things. IP addresses of when someone connects. Yes, email addresses. What 'friends' someone has.
gasull 11y ago
I think personal data is any user generated content, including data about themselves like email address.

_yy 11y ago

> Today does not seem to be a good day for small cloud service providers. Not for service providers in the US, but it's a great day for European cloud service providers.

thibaut_barrere 11y ago
I've thought about this a lot, especially when picking up 3rd party services for my EU-based SaaS [1]. Ultimately I chose (then) Safe Harbor compliant US services, not out of convenience, but because most of them exhibited better security practices (e.g. 2FA) or deliverability (e.g. Mandrill) compared to their European counterparts. I'm concerned about 2 things mainly: - being forced to rely on less advanced 3rd parties, potentially less secure, which would not be a win for my users - later down the road, seeing a backfire from the US telling that I cannot store US customers data in the EU I have started a discussion over here [2]. [1] https://www.wisecashhq.com https://www.wisecashhq.com [2] http://discuss.bootstrapped.fm/t/concrete-ramifications-of-safe-harbor-strike-down-ruling-by-eu-court/3542 http://discuss.bootstrapped.fm/t/concrete-ramifications-of-s...

rodgerd 11y ago

> Bad for startups Only for startups whose business plan consists of plundering EU citizens' data in ways not consistent with the privacy laws of those countries. Those are startups I'm happy to see inconveniences.

gasull 11y ago
You haven't read the link.