4 ms·

I am actually the Lead Developer at a medical device company making software that manages patient data from EU citizens. Our answer to this is really easy: Do

I am actually the Lead Developer at a medical device company making software that manages patient data from EU citizens. Our answer to this is really easy: Do not host anything in the US. We intend to use AWS. Frankfurt will do just fine, even if it is a bit more expensive.

onli 10y ago
Medical data and AWS? Urks. If you host with an US-company, your data is no more secure then if they were physically in the US. Not if preventions of overreach like Privacy Shield (which was mostly a joke anyway) are dismantled. Get a EU data-provider!
- Beltiras 10y ago
  AWS is 27001 and 27018 compliant: https://aws.amazon.com/compliance/iso-27001-faqs/ https://aws.amazon.com/compliance/iso-27001-faqs/
  - onli 10y ago
    So what? You really think that if a government agency asks for data, and an US-government argues (again) that an US-company does not have the right to not give the data out, Amazon will not comply? This is exactly what was part of the whole discussion about Privacy Shield, and you saw how that ended up. Edit: grabehs answer is clearer than my own. Thanks.
  - grabeh 10y ago
    Onli is talking about the potential for US authorities to order US companies to disclose information hosted by them regardless of the location of their services, not the actual security of the data. The issue of US companies being compelled to disclose is the subject of ongoing litigation between Microsoft and the US. I believe the Supreme Court will hear arguments this year. Of course if you are encrypting hosted data and AWS has no access to the keys, then that gives comfort over the disclosure. The relevant authorities/local authorities would have to come to you for disclosure of the keys and you would have any protections applicable under local laws...
    - Beltiras 10y ago
      That would exclude AWS from an awfully large segment of data hungry industries. Operating in the EU AWS has to comply with GDPR for at least the operations they have located in the EU. Frankfurt is safe.
      - onli 10y ago
        It is not. See https://www.extremetech.com/extreme/186302-us-government-asserts-unilateral-right-to-access-private-data-even-if-its-stored-outside-the-us https://www.extremetech.com/extreme/186302-us-government-ass... for a popular explanation why. AWS being excluded from business is exactly what those companies are arguing.
        Beltiras 10y ago
        Still being litigated [1]. Last ruling was for Microsoft's position. [1] https://en.wikipedia.org/wiki/Microsoft_Corporation_v._United_States_of_America
        onli 10y ago
        That's a good caveat. Still: Being litigated means the US is trying to achieve a state which is explicitly unsafe. Which for me means already that AWS-Frankfurt is not safe. Especially for something like medical data. The potential danger is way too big, especially since we know that the US-agencies will siphon the data anyway, regardless of what the court rules. Think business: Do you really want to face the media backlash when your competitor lances the story that the medical data you collect goes directly into the tiny little hands of Trump, and to the NSA?
        Beltiras 10y ago
        If they are using extra-judicial means to get at the data I have no recourse anyways. I will have to store it somewhere and a dedicated attacker will always (eventually) find a vulnerability. The standards I have to implement do not state that I must keep the data out of the hands of attackers. They state principles and methods that make it less likely. When the regulators come knocking after an 'incident' their levying of fines will depend on standards and regulation compliance, not the leaked documents. You have an unreasonable expectation of what can be done.
- tyfon 10y ago
  I work in a startup bank in Norway, and we have been explicitly denied using AWS, Azure or google cloud by the authorities for our data/services because of this. So there this is not new for us. We are currently using a EU based provider for some of the services and a Norwegian based one for the rest. We might go for azure now for some processing, but the data we can keep there has to be anonymized to the point where it is almost useless.
romanovcode 10y ago
Actually, in Germany there is a law that prohibits storing any user data somewhere else then Germany.
- lorenzk 10y ago
  Citation needed
  - onli 10y ago
    Right call here, as that broad the statement is not correct. §4b BDSG, Absatz 2. See https://www.gesetze-im-internet.de/bdsg_1990/__4b.html https://www.gesetze-im-internet.de/bdsg_1990/__4b.html. The gist is: You can transfer data if you inform and the data protection is adequate. Then Safe Harbor collapsed, that was not the case anymore (also before, protection was not really adequate, but that was partly ignored). Thus Privacy Shield to give a new legal foundation. If now that collapsed as well, transferring personal data to the US will indeed be illegal again.
- grabeh 10y ago
  The Federal Data Protection Act in Germany authorises data transfers within the EEA (and outside the EEA in certain conditions). It implements the EU's Data Protection Directive. Clearly you're not going to have much of a single market in the EEA if individual states are permitted to restrict data from being transferred outside its borders.
patrickk 10y ago
Relevant case: the DOJ attempted to gain access to Hotmail data residing on a server based in Ireland: https://www.theguardian.com/technology/2015/sep/09/microsoft-court-case-hotmail-ireland-search-warrant https://www.theguardian.com/technology/2015/sep/09/microsoft... Any US connection is worrying from a privacy POV.
- Beltiras 10y ago
  Still being litigated[1]. As it stands the ruling is for Microsoft's position. [1] https://en.wikipedia.org/wiki/Microsoft_Corporation_v._United_States_of_America
  - patrickk 10y ago
    The reason I mention it is because if you don't have a US connection, this concern goes away. Imagine if this happened to a small data storage company that didn't have deep pockets of Microsoft to fight the case...
Fradow 10y ago
You may want to research requirements for patient data by country. I am pretty sure you can't store medical data in AWS in France. (if your data actually qualify as medical data according the law, it's hard to know without knowing the details, the exact term is "données de santé à caractère médical" which translates to health data of medical nature) There, you have to choose from a list of certified providers (thanksfully, OVH is now in the list [1]). It will probably be different for every country, though you should be able to fly under the radar until you get some traction. [1] Full list [FR] : http://esante.gouv.fr/services/referentiels/securite/hebergeurs-agrees http://esante.gouv.fr/services/referentiels/securite/heberge...
- Beltiras 10y ago
  We don't have operations in France as of yet. Thank you for the heads-up.
  - laingc 10y ago
    In Germany, you should also be careful with §203 StGB-relevant data [0]. There is no really good legal solution to this. The so-called "Gehilfern-Lösung" has never been tested in court, and is not possible with AWS in any event. https://dejure.org/gesetze/StGB/203.html https://dejure.org/gesetze/StGB/203.html
Scarblac 10y ago
I think it needs a country by country solution. Doesn't France make it illegal to move transmit data on patients to outside France?
- Beltiras 10y ago
  A sibling comment had a link to a list of approved vendors. It's in french but Google translated it quite well.

onli 10y ago

Medical data and AWS? Urks. If you host with an US-company, your data is no more secure then if they were physically in the US. Not if preventions of overreach like Privacy Shield (which was mostly a joke anyway) are dismantled. Get a EU data-provider!

Beltiras 10y ago
AWS is 27001 and 27018 compliant: https://aws.amazon.com/compliance/iso-27001-faqs/ https://aws.amazon.com/compliance/iso-27001-faqs/
- onli 10y ago
  So what? You really think that if a government agency asks for data, and an US-government argues (again) that an US-company does not have the right to not give the data out, Amazon will not comply? This is exactly what was part of the whole discussion about Privacy Shield, and you saw how that ended up. Edit: grabehs answer is clearer than my own. Thanks.
- grabeh 10y ago
  Onli is talking about the potential for US authorities to order US companies to disclose information hosted by them regardless of the location of their services, not the actual security of the data. The issue of US companies being compelled to disclose is the subject of ongoing litigation between Microsoft and the US. I believe the Supreme Court will hear arguments this year. Of course if you are encrypting hosted data and AWS has no access to the keys, then that gives comfort over the disclosure. The relevant authorities/local authorities would have to come to you for disclosure of the keys and you would have any protections applicable under local laws...
  - Beltiras 10y ago
    That would exclude AWS from an awfully large segment of data hungry industries. Operating in the EU AWS has to comply with GDPR for at least the operations they have located in the EU. Frankfurt is safe.
    - onli 10y ago
      It is not. See https://www.extremetech.com/extreme/186302-us-government-asserts-unilateral-right-to-access-private-data-even-if-its-stored-outside-the-us https://www.extremetech.com/extreme/186302-us-government-ass... for a popular explanation why. AWS being excluded from business is exactly what those companies are arguing.
      - Beltiras 10y ago
        Still being litigated [1]. Last ruling was for Microsoft's position. [1] https://en.wikipedia.org/wiki/Microsoft_Corporation_v._United_States_of_America
        onli 10y ago
        That's a good caveat. Still: Being litigated means the US is trying to achieve a state which is explicitly unsafe. Which for me means already that AWS-Frankfurt is not safe. Especially for something like medical data. The potential danger is way too big, especially since we know that the US-agencies will siphon the data anyway, regardless of what the court rules. Think business: Do you really want to face the media backlash when your competitor lances the story that the medical data you collect goes directly into the tiny little hands of Trump, and to the NSA?
        Beltiras 10y ago
        If they are using extra-judicial means to get at the data I have no recourse anyways. I will have to store it somewhere and a dedicated attacker will always (eventually) find a vulnerability. The standards I have to implement do not state that I must keep the data out of the hands of attackers. They state principles and methods that make it less likely. When the regulators come knocking after an 'incident' their levying of fines will depend on standards and regulation compliance, not the leaked documents. You have an unreasonable expectation of what can be done.
tyfon 10y ago
I work in a startup bank in Norway, and we have been explicitly denied using AWS, Azure or google cloud by the authorities for our data/services because of this. So there this is not new for us. We are currently using a EU based provider for some of the services and a Norwegian based one for the rest. We might go for azure now for some processing, but the data we can keep there has to be anonymized to the point where it is almost useless.

romanovcode 10y ago

Actually, in Germany there is a law that prohibits storing any user data somewhere else then Germany.

lorenzk 10y ago
Citation needed
- onli 10y ago
  Right call here, as that broad the statement is not correct. §4b BDSG, Absatz 2. See https://www.gesetze-im-internet.de/bdsg_1990/__4b.html https://www.gesetze-im-internet.de/bdsg_1990/__4b.html. The gist is: You can transfer data if you inform and the data protection is adequate. Then Safe Harbor collapsed, that was not the case anymore (also before, protection was not really adequate, but that was partly ignored). Thus Privacy Shield to give a new legal foundation. If now that collapsed as well, transferring personal data to the US will indeed be illegal again.
grabeh 10y ago
The Federal Data Protection Act in Germany authorises data transfers within the EEA (and outside the EEA in certain conditions). It implements the EU's Data Protection Directive. Clearly you're not going to have much of a single market in the EEA if individual states are permitted to restrict data from being transferred outside its borders.

patrickk 10y ago

Relevant case: the DOJ attempted to gain access to Hotmail data residing on a server based in Ireland: https://www.theguardian.com/technology/2015/sep/09/microsoft-court-case-hotmail-ireland-search-warrant https://www.theguardian.com/technology/2015/sep/09/microsoft... Any US connection is worrying from a privacy POV.

Beltiras 10y ago
Still being litigated[1]. As it stands the ruling is for Microsoft's position. [1] https://en.wikipedia.org/wiki/Microsoft_Corporation_v._United_States_of_America
- patrickk 10y ago
  The reason I mention it is because if you don't have a US connection, this concern goes away. Imagine if this happened to a small data storage company that didn't have deep pockets of Microsoft to fight the case...

Fradow 10y ago

You may want to research requirements for patient data by country. I am pretty sure you can't store medical data in AWS in France. (if your data actually qualify as medical data according the law, it's hard to know without knowing the details, the exact term is "données de santé à caractère médical" which translates to health data of medical nature) There, you have to choose from a list of certified providers (thanksfully, OVH is now in the list [1]). It will probably be different for every country, though you should be able to fly under the radar until you get some traction. [1] Full list [FR] : http://esante.gouv.fr/services/referentiels/securite/hebergeurs-agrees http://esante.gouv.fr/services/referentiels/securite/heberge...

Beltiras 10y ago
We don't have operations in France as of yet. Thank you for the heads-up.
- laingc 10y ago
  In Germany, you should also be careful with §203 StGB-relevant data [0]. There is no really good legal solution to this. The so-called "Gehilfern-Lösung" has never been tested in court, and is not possible with AWS in any event. https://dejure.org/gesetze/StGB/203.html https://dejure.org/gesetze/StGB/203.html

Scarblac 10y ago

I think it needs a country by country solution. Doesn't France make it illegal to move transmit data on patients to outside France?

Beltiras 10y ago
A sibling comment had a link to a list of approved vendors. It's in french but Google translated it quite well.