6 ms·
Google is moving EU citizens’ data to US?
- Normal_gaussian 7y agoIt is not illegal at all. At all. Firstly lets establish the rules using the ICO's (the UK's Data Authority) handy FAQ [1], a site providing a copy of the GDPR [2], the EU Commissions adequacy decisions page [3], the EU's privacy shield page [4], and the dedicated site for the privacy shield's Google LLC page [5]: In short (yes, this is my idea of short): * We, the UK, are currently in the transition period where EU rules still apply [1 - "What happens now that the UK has a withdrawal agreement?"]. This lasts until Jan 1st 2021 [6] * We, the UK, are currently on track to have pretty much the same rules (cynicism allowed) [1 - "Will the GDPR still apply when we leave the EU"] * So Brexit shouldn't change the legality (more cynicism allowed) So are Google breaking the law? * The GDPR has a provision allowing third countries and international organisations to process data presuming. It is Article 45 [2] * The USA has been approved for this [3]. Years ago [4]. * Google LLC is approved under Privacy Shield [5] So, there is no indication of anything illegal going on. Yes they are segmenting the data incorrectly and messaging an italian as though they are a brit. However the change would be perfectly legal was it to be done to the whole of the EU. I don't like it, but it is legal. [1] https://ico.org.uk/for-organisations/data-protection-and-brexit/information-rights-and-brexit-frequently-asked-questions/ https://ico.org.uk/for-organisations/data-protection-and-bre... [2] https://gdpr.eu/article-45-adequacy-decision-personal-data-transfer/ https://gdpr.eu/article-45-adequacy-decision-personal-data-t... [3] https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en https://ec.europa.eu/info/law/law-topic/data-protection/inte... [4] https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/eu-us-data-transfers_en https://ec.europa.eu/info/law/law-topic/data-protection/inte... [5] https://www.privacyshield.gov/participant?id=a2zt000000001L5AAI https://www.privacyshield.gov/participant?id=a2zt000000001L5... [6] https://www.gov.uk/transition https://www.gov.uk/transition
- pcora 7y agoSo, question here: If I move from outside EU to a country that is part of the block, does that mean that my Google Account will change the terms and mention something about GDPR?
- notgoogle2 7y agoGoto https://myaccount.google.com/data-and-personalization https://myaccount.google.com/data-and-personalization Change Language to English(Ireland)
- andreagrandi 7y agoDone, thanks! I hope it will be enough to fix this.
- bognition 7y agoFile a complaint: https://edps.europa.eu/node/75_en https://edps.europa.eu/node/75_en
- andreagrandi 7y agoThanks, this is useful to know.
- lucb1e 7y agoNot the right place. Have you tried doing what you suggested? Because I end up on this page which, as expected, tells me that this is not the right authority: https://edps.europa.eu/data-protection/notre-r%C3%B4le-en-tant-que-contr%C3%B4leur/private-organisation_en https://edps.europa.eu/data-protection/notre-r%C3%B4le-en-ta... > Data protection supervision over private organisations such as companies is carried out by national data protection authorities. All EU Member States have at least one such authority. > You can also take up your complaint with the courts in the relevant Member State. > The EDPS is not competent for complaints against such private organisations; we can therefore only refer you to the relevant national authorities. Instead, you can find national authorities here: https://en.wikipedia.org/wiki/National_data_protection_authority https://en.wikipedia.org/wiki/National_data_protection_autho... The authority in the country where the headquarters of the infringing company are will handle your complaint, as per GDPR article 56(1)¹. I don't know what happens if you complain to your local authority, they might just forward it themselves or maybe they'll tell you that you're in the wrong place. It shouldn't matter much since GDPR is EU-wide, so you can just send the same complaint to another address. ¹ https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN#d1e4864-1-1 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL... In Google's case this is Ireland, so the correct link would be: https://forms.dataprotection.ie/contact https://forms.dataprotection.ie/contact Note that I am not saying anything about the article, whether Google/Alphabet is wronging anyone, or calling for anyone to file a complaint. If you want to file a complaint based on what others said, this would be the place.
- Findus23 7y agoMaybe also report it to the Italian data protection authority directly: https://www.garanteprivacy.it/ https://www.garanteprivacy.it/
- madeofpalk 7y ago> I'm an Italian citizen, living in Italy [...] and I'm fully entitled to GDPR protection and to have my data owned by a European data controller. I don't think the latter part is true. AFAIK GDPR does not give you the right do have your data owned or processed by an EU entity. GDPR does not say that. It doesn't matter where your data is stored or processed, Google must still follow GDPR rules for data about EU residents. The first part of the comment is correct. I'm not actually completely sure why some companies do this whole EU data controller seperate company thing. I guess for organisational or legal simplicity? (Edit: I reworded to hopefully remove ambiguity)
- pmontra 7y agoYes, even if he lives outside the EU https://gdpr.eu/companies-outside-of-europe/ https://gdpr.eu/companies-outside-of-europe/ It applies even to non EU citizens resident in the EU.
- madeofpalk 7y agoWait so, an an EU resident, processing my data outside of the EU is illegal under GDPR? I have a right to have it processed within the EU?
- HatchedLake721 7y agoIncorrect. It is legal to process data outside the EU. They have to be compliant with GDPR. GDPR does not require the data to processed within the EU borders.
- madeofpalk 7y agoExactly. Perhaps I worded my question wrong, but this is my assumption. The entire premise of the article seems incorrect.
- andreagrandi 7y agoMy understanding is that they can "process" it outside, but the "Data Controller" should be a European legal entity. After all, they are not saying "we are moving everyone data to US", they say "we are moving UK customers to US". I don't doubt they can do it, but I'm not a UK customer, that's the point.
- rupert1234 7y agoIt's difficult. You are pretending they are deliberately doing it. No one at Google wants to move your data to the US.
- wereHamster 7y ago> It's difficult. Please elaborate. What is difficult? And why is it difficult?
- malka 7y ago$
- rupert1234 7y agoIt's difficult to know for sure where to store data in a GDPR world. People move. People have multiple citizenships. People open accounts in countries where they aren't citizens. People give up citizenships. People share documents with other people. People ingest data from one product to another. People comment on documents. It's really, really hard to get all of this down. It's not even clear legally what to do in various scenarios and it's impossible to enumerate them all. It's difficult.
- OnlineGladiator 7y ago> You are pretending they are deliberately doing it. Are you saying they're doing it by accident? Even if so, that means they're negligently handling the data. And if not, they're purposefully disobeying the law.
- rupert1234 7y agoYes, I'm saying they are doing it accidentally, and that the specifics of the scenario will undoubtably be more complex than it seems on the surface.Every company is breaking some law somewhere. The legal environment is extremely complex. Google products are extremely complex. It's not some awful thing when they make an understandable, minor mistake.
- 7y ago
- kick 7y agoI feel like people don't accept that Google needs the EU less than the EU needs Google. If Google were to pull out of the EU overnight, there'd be death as a result. If the EU were to kick Google out, there might still be deaths, but none of them Google employees, and in the end it wouldn't substantially impact Google. There's no real incentive for Google to be a good actor: they have all of the leverage, and if the EU's fines get excessive, Google can always pull out.
- rsynnott 7y agoAnd that would be the end of Google. Anti-trust regulators in countries where it remained would take pretty decisive action in the face of that sort of madness. (Also whoever made this decision would presumably be torn apart by enraged shareholders)
- shadowgovt 7y agoGoogle isn't structured so that enraged shareholders can do more than scream and sell their stock, unless you get one of the company founders on-board with whatever you're enraged about.
- rsynnott 7y agoPresumably enraged about the precipitous stock price decline that this would inevitably entail.
- colmmacc 7y agoEurope is a huge advertising and services market. Excluding it would put a huge dent in Google's profitability.
- kick 7y agoEurope and the EU are not the same thing. It wouldn't put a "huge" dent in Google's profitability: EMEA accounted for something like 30% of Google's revenue last year, and now that the UK is no longer part of the EU, it's probably substantially less from the EU.
- iknownadaalot 7y agokinda clickbait [edit for clarity] Please cite where [your] data is now stored and how you found that information. Cause I'm US based and I got the same email! WTF Google?
- iknownadaalot 7y agoAnd by that, I mean I got that same email. And I definitely live in the US. Please cite sources of them actually moving [your] data to Google LLC and or US.
- andreagrandi 7y agoWhat do you mean by "source" ? I haven't "heard" this story somewhere on Internet. I did receive the email where they say they are going to move my data controller to US.
- iknownadaalot 7y agoAgain I am really dumb, so I don't know how to check if my data has been moved to a US controller. Also, I got the same email (multiple times, thanks Google), and I live in the US. Example: some_command -> where your data is stored at. I don't know how to verify that information.
- zadokshi 7y agoThe source is a direct email from a Google.
- three_seagrass 7y agoHow exactly is this illegal? AFAIK, it's not illegal (per GDPR) to process EU citizen data in data controllers if the individual is no longer in the EU. _Edit_: Yes, I read the article. It looks like this person got this email notification because they had activity in London (per their resume on their website). That doesn't make the email illegal nor does it mean their activity in Italy is going to be on a non-EU controller. The email implicitly states that it's for the UK only.
- andreagrandi 7y agoHave you read the article? Entirely? If yes, can you please tell me since when ITALY is not part of EU? Thanks
- three_seagrass 7y agoHave you VPN'd into the UK or had activity there recently? It says on your website that you worked in London. This email is likely a courtesy notification because you had activity in the UK, a UK billing address, or something that put you there, meaning if you have activity there again, the controller will be different. What this email does not mean is that your Italy based activity is going to a different controller, so how exactly is this illegal?
- andreagrandi 7y agoEven the article says I lived in UK/London, it's not a secret, but remains the fact I'm not a UK citizen :/ If US or EU would be the same, why mentioning brexit?
- three_seagrass 7y ago* You're receiving the email because you've had enough activity in UK to warrant a notification. * Read literally, the email only talks about the UK, not Italy. * If you go to the UK again, then your activity in the UK will be on a nom-GDPR handler. There is nothing illegal here, and just because you're sitting in Italy at this moment doesn't mean Google is moving Italian activity handlers. The email is a notification about Uk only.
- drcursor 7y agoIs there a way to find out where my google account is hosted ?
- auiya 7y agoI'm willing to bet your data is hosted in multiple locations based on the service you're using. I don't think it's as simple as "Oh John Smith's account is hosted in Lenoir, NC".
- asiachick 7y agoOf course it is. It's called backups, and being prepared. If one data center burns down or is taken offline for other reason your data needs to be somewhere else.
- inetknght 7y ago> If one data center burns down or is taken offline for other reason your data needs to be somewhere else. Somewhere else doesn't necessarily need to be "in different jurisdiction"
- deleted 7y ago[deleted]
- SAI_Peregrinus 7y agoNo, but ideally (and especially for live failover datacenters) it should be in a different wide-area synchronous grid segment[1] to prevent issues in the event of large disasters. For datacenters in the EU that means having a backup outside the continental EU, which has meant Ireland or Great Britain if they want to stay within the EU jurisdiction. With the UK leaving that means just Ireland. Other disaster recovery concerns also mean that having large geographical distance between datacenters is a good idea. This can lead to jurisdictional issues, which need to be addressed when building the system. [1] https://en.wikipedia.org/wiki/Electrical_grid#Wide_area_synchronous_grid https://en.wikipedia.org/wiki/Electrical_grid#Wide_area_sync...
- deleted 7y ago[deleted]
- myrandomcomment 7y agoThe simple suggestion would be that Google needs to ask for your citizenship status and go from there. Not sure else how to solve that. If I am an American living in the EU for a few years does the GDPR apply to me when I live there? I am going to the EU next week for 10 days. When I access my gmail from the EU what law applies?
- deleted 7y ago[deleted]
- kasey_junk 7y agoIts a big open question until there is precedent but the GDPR is explicit that residency and citizenship aren’t required. Most people are taking the position that if either end of the request is in the EU or owned by an EU entity its covered.
- contingencies 7y agoI have three western citizenships, one is EU, and I live across borders, usually accessing the internet via VPN from China. Google cannot possibly understand this, nor should it try to, rather it should give everyone the best protections guaranteed by law anywhere in the world and only punch holes in it for local regulations in specific jurisdictions where unavoidable. To do anything else (such as profiling for ads) is to be evil.
- andreagrandi 7y agoCouldn’t they provide a way to check/edit our personal details so we can set our home address?
- contingencies 7y agohttps://www.mjt.me.uk/posts/falsehoods-programmers-believe-about-addresses/ https://www.mjt.me.uk/posts/falsehoods-programmers-believe-a... ... Final falsehood: Each person has exactly one address. Same goes for phone numbers, citizenships, passports, etc.
- deleted 7y ago[deleted]
- deleted 7y ago[deleted]
- jacquesm 7y agoThey were doing the same thing with the data of citizens of Ireland. Google is flirting with a massive fine here, in spite of all their PR efforts in and around Brussels. Have you seen Brussels airport lately? It is wall-to-wall 'Google is pro privacy' PR.
- IAmEveryone 7y agoThere is obviously some ambiguity in the rules when people move around, and misclassifications can happen when, say, a Brasilian working for a US company in Switzerland picks up the neighbouring French wireless signal to log into their Asian VPN. But it's really a non-issue. Google will make a good effort reducing such errors, and there aren't going to be legal consequences, nor wild leaving-Europe-for-good-drama as envisioned by some in this threat.
- malka 7y ago> Google will make a good effort reducing such errors suuuuuuure.
- andreagrandi 7y agoWe all know that mistakes can happen. That is not the issue. The issue here is that there is no way to contact them and ask to fix this. I tried at least 3 or 4 times to contact them on Twitter (they are replying to other people for other issues, why not replying to me?) but I didn't have any luck with it.
- deleted 7y ago[deleted]
- nottorp 7y agoTop of HN usually works to get Google customer support :)
- dhosek 7y agoDon't be evil.
- alanfranz 7y agoI wonder if this is an issue with Andrea's Google account. Maybe it's some setting that makes Google think he's from the UK. The text of the same paragraph, just as I received it from Google: "We’re improving our Terms of Service and making them easier for you to understand. The changes will take effect on March 31, 2020, and they won’t impact the way you use Google services." No mention of Google LLC. And, surprise! I'm an Italian citizen living in Italy.
- supermatt 7y agoSame issue. I am resident in Lithuania (but I am from the UK originally). When I view youtube (on a firefox browser I have never logged in to youtube with) I get the same message...
- soneil 7y agoThe copyright line at the foot of the email seems to be the most reliable way to see which legal entity your account falls under. It’d be nice if they were a little more clear about this.
- dathinab 7y agoI (German citizen) also got a update them of service mail _which does not mention the UK_. I take this as a strong indicator, that Google believes you are a UK citizen.
- andreagrandi 7y agoNote: if anyone thinks I should at least re-phrase the title and the article, I'm more than happy to do that. My concern is: why do they mention UK leaving EU if I'm not UK citizen? And why there is no way to appeal/complain directly with them? Mistakes can happen from anyone, but if they don't let me contact them I have no way of fixing this.
- Normal_gaussian 7y ago"why do they mention UK leaving EU if I'm not UK citizen?" PR most likely. Within the UK this phrasing makes it less likely to actually be read / acted upon. However there could be more than a few grains of truth to it as well.
- LazarKrit 7y agoI believe this is because GDPR rules apply regardless of nationality. I believe the law is location based (e.g. if you are a non UK/EU citizen but operate in the UK/EU, you'll have the law affect you. But if you were and EU citizen in say, South America, GDPR does not matter to you. (happy to dig up some legal documents by Allen and Overy a well-known law firm if people want to read an analysis).
- andreagrandi 7y agoUPDATE: I've updated the article removing the "illegal" words. Since it doesn't seem to be clear if this is legal or not from their side, I think it's right to give it the benefit of the doubt. (give CloudFlare a few minutes to update the cache, please)
- Normal_gaussian 7y agoYeah this isn't illegal at all, in my other comment I expanded on it a lot more [1], but in essence the EU-US privacy shield is a thing, Google LLC is in it, and Brexit isn't really relevant. [1] https://news.ycombinator.com/item?id=22416701 https://news.ycombinator.com/item?id=22416701
- three_seagrass 7y agoThis isn't illegal. You worked in London and had enough UK-based activity to warrant receiving an email notification about UK-based data handlers.
- andreagrandi 7y agolet’s try to keep the technical mistake separate from the legal bit. I think their email is entirely legit if I was living in UK, but I don’t. Also: honestly, I use Google Maps almost everyday. Even without asking me I think they have plenty of data on me to clearly see I’ve been living in Italy in the last year and half.
- Gigablah 7y agoWait, are you complaining that Google knows too little about you?
- andreagrandi 7y agoUPDATE #2: after clicking here and there, I was able to find this https://pay.google.com/gp/w/u/1/home/settings https://pay.google.com/gp/w/u/1/home/settings it looks like I had set a UK address once and completely forgot about it (I don't have any Android devices since 2014, that's why I forgot). Let's see if this will change anything.
- asdfasgasdgasdg 7y agoHow misinformation spreads on the internet 101. In future, it might be best to word this as a question. "Why does Google think I live in the UK?" Less click-baity and more faithful to the level of investigation you had conducted. Phrasing it as a question rather than an accusation might have even led you to the answer, something along the lines of, "well, have I explicitly told them I live in the UK? Let me check."
- andreagrandi 7y agoI wouldn't classify this as misinformation. Facts: 1) I don't live in UK 2) They threated me at UK resident 3) It's not possible to change the country directly from Google account, you have to go to Play Store (which I don't use it anymore) 4) It was impossible to contact them
- asdfasgasdgasdg 7y agoYou accused them of illegal behavior when they acted correctly on information you explicitly gave them. You seem to expect them to divine your implicit intent from non-payments related product usage data. But for all we know you have search history turned off, and anyway most privacy advocates would consider a join like that suspect at best. Then you publicized this false information about illegal behavior as broadly as you could. If that's not misinformation I don't know what is. To be clear, I'm not saying you did so maliciously. Seems like an honest mistake on your part. Well, it did until you started digging in.
- Aeolun 7y ago