4 ms·

As far as I understand it, it currently can't be hosted in the UK anyways. As the requirement is to store the data within the EU.

Blikkentrekker 6y ago
I thought the data could be exported to any country whose laws offer the same level of protection.
- theelous3 6y ago
  You can store it wherever you want, so long as you're in compliance.
  - jeroenhd 6y ago
    > You can store it wherever you want, as long as you're in compliance. From a GDPR standpoint, compliance means that the country where the data is stored has an agreement with the EU AND you must have enforceable and strong, negative consequences for the foreign party in your contract. The EU can only make such an agreement for a foreign country if the data protection laws are sufficient. I do not know whether or not the UK laws are considered sufficient, but without any such agreement, you cannot assume that you can just store EU personal data in the UK. With the death of Privacy Shield and its siblings, this first requirement isn't even the case for the US anymore as the US will not guarantee the safety of EU citizens' information from things like the patriot act. However, I haven't seen any country complain about storing data with Google, Amazon or Facebook yet so I don't think this rule will be enforced any time soon. Technically, though, storing PII in a foreign, non-EU country without the necessary requirements is still very much illegal with the full suite of fines available to the data processing agencies.
    - 02thoeva 6y ago
      There is a draft adequacy agreement between the two which should be signed before the end of June when the transition period ends: https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661 https://ec.europa.eu/commission/presscorner/detail/en/ip_21_...
  - romanovcode 6y ago
    This is not true. For example sensitive data for German company must be stored in Germany, not Ireland.
    - theelous3 6y ago
      It is true. If this is the case for Germany, it is Germany's own doing and outside the scope of gdpr.
andy_ppp 6y ago
If we were able to agree to those rules I'm sure we could strike a deal with the EU. This has always been the name of the game right - if you play by each set of rules and align the EU probably sees that as a net benefit and lets countries align, for eaxample Switzerland can still host EU personal data, from the article: "Fortunately, Switzerland, along with 12 other non-EEA countries, has received an "adequacy decision" from the European Commission. An adequacy decision is a recognition of the strength of Switzerland's data protection law." https://www.termsfeed.com/blog/gdpr-switzerland/ https://www.termsfeed.com/blog/gdpr-switzerland/

Blikkentrekker 6y ago

I thought the data could be exported to any country whose laws offer the same level of protection.

theelous3 6y ago
You can store it wherever you want, so long as you're in compliance.
- jeroenhd 6y ago
  > You can store it wherever you want, as long as you're in compliance. From a GDPR standpoint, compliance means that the country where the data is stored has an agreement with the EU AND you must have enforceable and strong, negative consequences for the foreign party in your contract. The EU can only make such an agreement for a foreign country if the data protection laws are sufficient. I do not know whether or not the UK laws are considered sufficient, but without any such agreement, you cannot assume that you can just store EU personal data in the UK. With the death of Privacy Shield and its siblings, this first requirement isn't even the case for the US anymore as the US will not guarantee the safety of EU citizens' information from things like the patriot act. However, I haven't seen any country complain about storing data with Google, Amazon or Facebook yet so I don't think this rule will be enforced any time soon. Technically, though, storing PII in a foreign, non-EU country without the necessary requirements is still very much illegal with the full suite of fines available to the data processing agencies.
  - 02thoeva 6y ago
    There is a draft adequacy agreement between the two which should be signed before the end of June when the transition period ends: https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661 https://ec.europa.eu/commission/presscorner/detail/en/ip_21_...
- romanovcode 6y ago
  This is not true. For example sensitive data for German company must be stored in Germany, not Ireland.
  - theelous3 6y ago
    It is true. If this is the case for Germany, it is Germany's own doing and outside the scope of gdpr.

andy_ppp 6y ago

If we were able to agree to those rules I'm sure we could strike a deal with the EU. This has always been the name of the game right - if you play by each set of rules and align the EU probably sees that as a net benefit and lets countries align, for eaxample Switzerland can still host EU personal data, from the article: "Fortunately, Switzerland, along with 12 other non-EEA countries, has received an "adequacy decision" from the European Commission. An adequacy decision is a recognition of the strength of Switzerland's data protection law." https://www.termsfeed.com/blog/gdpr-switzerland/ https://www.termsfeed.com/blog/gdpr-switzerland/