4 ms·

I have a few questions about this: >In a nutshell: this was the only reason any modern internet service could keep their primary user data in the United States

I have a few questions about this: >In a nutshell: this was the only reason any modern internet service could keep their primary user data in the United States on services like Amazon EC2 or Heroku. But shouldn't you be fine if you use EC2 with a European location? (Then you can approximate by using the instance with the lowest ping to the user) >The harder part is to figure out which user belongs to which jurisdiction. Does the climbing website have to do store personal information in the first place? Does a random user-name like "a_bonobo" count as private data? An e-mail address? An e-mail address from a throwaway host? Pictures of climbing walls? What constitutes "personal data" here?

yuhong 11y ago
Probably depends on whether the US can request the data to be transferred. I think there is a US court case on that one too.
- JoshTriplett 11y ago
  Exactly. As a US citizen, if I run a service with data in the US, exactly one jurisdiction can attempt to demand data on my users; if I run a service with data in an EU country, at least two jurisdictions can. So unless a country wants to turn into China and try to stop all services not entirely run within their borders, they'll have to start trusting their citizens to select responsible service providers for themselves. Of course, the best possible solution: no jurisdiction can demand data a service doesn't have.
esseti 11y ago
For the first question is YES But, to be picky you have to be sure that data are ALWAYS STORED in the EU boundaries. which Amazon cannot guarantee. Personal data (and other data) are defined by the EU and probably US. The EU is EU Directive 95/46/EC (citing from wikipedia) "any information relating to an identified or identifiable natural person ("data subject"); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity;" (art. 2 a).
- a_bonobo 11y ago
  Thank you for that - > ALWAYS STORED in the EU boundaries. which Amazon cannot guarantee. That makes sense, and I fear of what we'd do to enforce this - full data inspection just to make sure that Amazon doesn't transfer private data to the US? >n identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity So a username like "a_bonobo" wouldn't fall under personal data as it's not really identifiable (but what if I research bonobos? My username gives a clue to my job, if that would be my job!). So under gasull's link I think that a lot of what the climbing community would save isn't directly personal data, as you don't need much information from your users to run such a site (except if you want to have Facebook's business model). Or am I wrong? I mean, you can even identify someone based on their writing patterns.
  - esseti 11y ago
    (sorry for the late reply) You can't guarantee that AWS is doing. You have to belive it. That's why hospitals & co keep the data in their own servers. And, if in the cloud, they try to avoid US companies as much as they can. the username if not directly linked to someone (e.g., not an email) usually does not fall into personal data. But, since many usernames are reused by people they may identify the person. This is a a case which, honestly, i would not know how to deal with. I'll try to get an answer.
    - deleted 11y ago
      [deleted]
  - esseti 11y ago
    Ok, talking with colleagues the outcome is: if the username is reused and used as something personal, than it's a personal data. I do bet that if you google my username it's not that difficult to find out who I am. Then is personal, which make sense in the end. The problem is how to deal with the data since for a Data Processor the datum is meaningless. That's why we created our startup in EU.
yardie 11y ago
From the operations side this isn't a problem. From a business op this will be very hard. Jobs will be replicated one for US and one for European client data. If you work in ads and are in the US you've lost access to an entire market of 500MM. I assume a lot of businesses are waking up and calling their lawyers.
rmc 11y ago
Personal data includes a lot of things. IP addresses of when someone connects. Yes, email addresses. What 'friends' someone has.
gasull 11y ago
I think personal data is any user generated content, including data about themselves like email address.

yuhong 11y ago

Probably depends on whether the US can request the data to be transferred. I think there is a US court case on that one too.

JoshTriplett 11y ago
Exactly. As a US citizen, if I run a service with data in the US, exactly one jurisdiction can attempt to demand data on my users; if I run a service with data in an EU country, at least two jurisdictions can. So unless a country wants to turn into China and try to stop all services not entirely run within their borders, they'll have to start trusting their citizens to select responsible service providers for themselves. Of course, the best possible solution: no jurisdiction can demand data a service doesn't have.

esseti 11y ago

For the first question is YES But, to be picky you have to be sure that data are ALWAYS STORED in the EU boundaries. which Amazon cannot guarantee. Personal data (and other data) are defined by the EU and probably US. The EU is EU Directive 95/46/EC (citing from wikipedia) "any information relating to an identified or identifiable natural person ("data subject"); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity;" (art. 2 a).

a_bonobo 11y ago
Thank you for that - > ALWAYS STORED in the EU boundaries. which Amazon cannot guarantee. That makes sense, and I fear of what we'd do to enforce this - full data inspection just to make sure that Amazon doesn't transfer private data to the US? >n identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity So a username like "a_bonobo" wouldn't fall under personal data as it's not really identifiable (but what if I research bonobos? My username gives a clue to my job, if that would be my job!). So under gasull's link I think that a lot of what the climbing community would save isn't directly personal data, as you don't need much information from your users to run such a site (except if you want to have Facebook's business model). Or am I wrong? I mean, you can even identify someone based on their writing patterns.
- esseti 11y ago
  (sorry for the late reply) You can't guarantee that AWS is doing. You have to belive it. That's why hospitals & co keep the data in their own servers. And, if in the cloud, they try to avoid US companies as much as they can. the username if not directly linked to someone (e.g., not an email) usually does not fall into personal data. But, since many usernames are reused by people they may identify the person. This is a a case which, honestly, i would not know how to deal with. I'll try to get an answer.
  - deleted 11y ago
    [deleted]
- esseti 11y ago
  Ok, talking with colleagues the outcome is: if the username is reused and used as something personal, than it's a personal data. I do bet that if you google my username it's not that difficult to find out who I am. Then is personal, which make sense in the end. The problem is how to deal with the data since for a Data Processor the datum is meaningless. That's why we created our startup in EU.

yardie 11y ago

From the operations side this isn't a problem. From a business op this will be very hard. Jobs will be replicated one for US and one for European client data. If you work in ads and are in the US you've lost access to an entire market of 500MM. I assume a lot of businesses are waking up and calling their lawyers.

rmc 11y ago

Personal data includes a lot of things. IP addresses of when someone connects. Yes, email addresses. What 'friends' someone has.

gasull 11y ago

I think personal data is any user generated content, including data about themselves like email address.