4 ms·

Can anyone explain in layman's terms how Amazon have managed to exempt themselves from this regulation?

by anonymousDan 11y ago

deleted 11y ago
[deleted]
- tetrep 11y ago
  >my understanding is that AWS itself does not migrate, replicate, or otherwise transfer data out of its EU regions. Not at all correct, the article is quite explicit that transfer out of EU regions is allowed: "This is possible because AWS has already obtained approval from EU data protection authorities (known as the Article 29 Working Party) of the AWS Data Processing Addendum and Model Clauses to enable transfer of personal data outside Europe, including to the US with our EU-approved Data Processing Addendum and Model Clauses. AWS customers can continue to run their global operations using AWS in full compliance with the EU Data Protection Directive (Directive 95/46/EC). The AWS Data Processing Addendum is available to all AWS customers who are processing personal data."
  - deleted 11y ago
    [deleted]
eitally 11y ago
Model Clauses/Contracts (https://www.dataprotection.ie/docs/Model-Contracts/38.htm https://www.dataprotection.ie/docs/Model-Contracts/38.htm) are an alternative method of satisfying EU data protection requirements in dealing with overseas data transfers. Amazon, like Google and many other multinational technology companies, have adopted these in years past. What this posting means is that * from Amazon's perspective * they are compliant with Directive 95/46/EC (http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:en:HTML http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:...), which established (for the EU) these regulations. What it doesn't mean is that customers of Amazon are also compliant, because Amazon has no clue what types of data they are processing, what they are doing with it, and where they are putting it. They are wisely advised to consult counsel to ascertain this fact.
- pinaceae 11y ago
  correct. salesforce.com posted the same.
- the8472 11y ago
  But does amazon have a reasonable claim of being able to fulfill those requirements considering secret court orders that can't be challanged by european citizens, NSLs and the microsoft case[1]? [1] http://www.theguardian.com/technology/2015/sep/09/microsoft-court-case-hotmail-ireland-search-warrant http://www.theguardian.com/technology/2015/sep/09/microsoft-...
- aries1980 11y ago
  I'm not sure they still comply for the UK Data Protection Act. According to the Information Commisioner Office https://ico.org.uk/for-organisations/guide-to-data-protection/principle-8-international/ https://ico.org.uk/for-organisations/guide-to-data-protectio... : > A company in the UK uses a centralised human resources system in the United States belonging to its parent company to store information about its employees. or > A travel agent sends a customer’s details to a hotel in Australia where they will be staying while on holiday. > If you intend information on the website to be accessed outside the EEA, then this is a transfer. This means if your data can be accessed outside the EEA e.g. you access your on-premise CRM on your African holiday, you are likely to void the Principle 8.
  - M2Ys4U 11y ago
    The ICO is a member of the Article 29 Working Party (the WP is made up of a representative from each of the 28 EU Member States + the European Commission and EU bodies dealing with data protection, as detailed in Article 29 of the Data Protection Directive). The WP is designed to make sure that Member States' Data Protection Authorities apply the DPD in a roughly uniform manner. Of course, if the ICO deviates from the DPD then any party is able to appeal to the First-Tier Tribunal, the Upper Tribunal and the Court of Appeal who may then refer any questions of EU law to the ECJ in a similar way to Schrems' case.

Can anyone explain in layman's terms how Amazon have managed to exempt themselves from this regulation?

deleted 11y ago

[deleted]

tetrep 11y ago
>my understanding is that AWS itself does not migrate, replicate, or otherwise transfer data out of its EU regions. Not at all correct, the article is quite explicit that transfer out of EU regions is allowed: "This is possible because AWS has already obtained approval from EU data protection authorities (known as the Article 29 Working Party) of the AWS Data Processing Addendum and Model Clauses to enable transfer of personal data outside Europe, including to the US with our EU-approved Data Processing Addendum and Model Clauses. AWS customers can continue to run their global operations using AWS in full compliance with the EU Data Protection Directive (Directive 95/46/EC). The AWS Data Processing Addendum is available to all AWS customers who are processing personal data."
- deleted 11y ago
  [deleted]

eitally 11y ago

Model Clauses/Contracts (https://www.dataprotection.ie/docs/Model-Contracts/38.htm https://www.dataprotection.ie/docs/Model-Contracts/38.htm) are an alternative method of satisfying EU data protection requirements in dealing with overseas data transfers. Amazon, like Google and many other multinational technology companies, have adopted these in years past. What this posting means is that * from Amazon's perspective * they are compliant with Directive 95/46/EC (http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:en:HTML http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:...), which established (for the EU) these regulations. What it doesn't mean is that customers of Amazon are also compliant, because Amazon has no clue what types of data they are processing, what they are doing with it, and where they are putting it. They are wisely advised to consult counsel to ascertain this fact.

pinaceae 11y ago
correct. salesforce.com posted the same.
the8472 11y ago
But does amazon have a reasonable claim of being able to fulfill those requirements considering secret court orders that can't be challanged by european citizens, NSLs and the microsoft case[1]? [1] http://www.theguardian.com/technology/2015/sep/09/microsoft-court-case-hotmail-ireland-search-warrant http://www.theguardian.com/technology/2015/sep/09/microsoft-...
aries1980 11y ago
I'm not sure they still comply for the UK Data Protection Act. According to the Information Commisioner Office https://ico.org.uk/for-organisations/guide-to-data-protection/principle-8-international/ https://ico.org.uk/for-organisations/guide-to-data-protectio... : > A company in the UK uses a centralised human resources system in the United States belonging to its parent company to store information about its employees. or > A travel agent sends a customer’s details to a hotel in Australia where they will be staying while on holiday. > If you intend information on the website to be accessed outside the EEA, then this is a transfer. This means if your data can be accessed outside the EEA e.g. you access your on-premise CRM on your African holiday, you are likely to void the Principle 8.
- M2Ys4U 11y ago
  The ICO is a member of the Article 29 Working Party (the WP is made up of a representative from each of the 28 EU Member States + the European Commission and EU bodies dealing with data protection, as detailed in Article 29 of the Data Protection Directive). The WP is designed to make sure that Member States' Data Protection Authorities apply the DPD in a roughly uniform manner. Of course, if the ICO deviates from the DPD then any party is able to appeal to the First-Tier Tribunal, the Upper Tribunal and the Court of Appeal who may then refer any questions of EU law to the ECJ in a similar way to Schrems' case.