6 ms·

I think the main thing for GDPR is that US based employees should not have access to manage EU datacenters remotely.

by ptman 5y ago

jrochkind1 5y ago
That surprises me (not that I'm particularly educated on this), any links to more info on why GDPR requires that?
- mol4711 5y ago
  The Schrems II judgement might be applicable. I know that in the EU-based company I work for we have strict requirement for all cloud providers to comply with Schrems II, and not send/store any personal data to outside EU. https://www.gdprsummary.com/schrems-ii/ https://www.gdprsummary.com/schrems-ii/
  - jrochkind1 5y ago
    i was asking specifically about "US based employees should not have access to manage", which isn't necessarily the same thing as "not send/store any personal data outside the EU". You could have data stored inside the EU, but then saying no US-based employees can have access to it seems like another further requirement? Although it may be one under GDPR? But that's what I meant asking for more info about, sorry!
tmikaeld 5y ago
Why would an US employee leak personal data just because they’re in the US? It would be a clear violation of employment and probably criminal.
- martin8412 5y ago
  US court says hand over the data. German court says that's illegal to do. Complying is illegal and so is not complying.
  - nix23 5y ago
    Not Complying with US law is also illegal, now imagine who has more to say in that regard. Hetzner should split up in two Company's. BTW: The CLOUD Act applies to all electronic communication service or remote computing service providers that operate in the U.S, whether those providers are established in the United States or another country.
- rsynnott 5y ago
  So one concern (and it's not just a theoretical concern; it has happened) is that a US court forces the US branch to use access it has to data held by the EU branch to exfiltrate data. Companies with the highest standards on this stuff will want either a pure-EU host or a host structured such that this can't happen.
  - spaniard89277 5y ago
    Hmm, this is definitely worrying.
- zibzab 5y ago
  Fully legal thanks to "cloud act": https://en.m.wikipedia.org/wiki/CLOUD_Act https://en.m.wikipedia.org/wiki/CLOUD_Act

I think the main thing for GDPR is that US based employees should not have access to manage EU datacenters remotely.

by ptman 5y ago

I think the main thing for GDPR is that US based employees should not have access to manage EU datacenters remotely.

jrochkind1 5y ago

That surprises me (not that I'm particularly educated on this), any links to more info on why GDPR requires that?

mol4711 5y ago
The Schrems II judgement might be applicable. I know that in the EU-based company I work for we have strict requirement for all cloud providers to comply with Schrems II, and not send/store any personal data to outside EU. https://www.gdprsummary.com/schrems-ii/ https://www.gdprsummary.com/schrems-ii/
- jrochkind1 5y ago
  i was asking specifically about "US based employees should not have access to manage", which isn't necessarily the same thing as "not send/store any personal data outside the EU". You could have data stored inside the EU, but then saying no US-based employees can have access to it seems like another further requirement? Although it may be one under GDPR? But that's what I meant asking for more info about, sorry!

tmikaeld 5y ago

Why would an US employee leak personal data just because they’re in the US? It would be a clear violation of employment and probably criminal.

martin8412 5y ago
US court says hand over the data. German court says that's illegal to do. Complying is illegal and so is not complying.
- nix23 5y ago
  Not Complying with US law is also illegal, now imagine who has more to say in that regard. Hetzner should split up in two Company's. BTW: The CLOUD Act applies to all electronic communication service or remote computing service providers that operate in the U.S, whether those providers are established in the United States or another country.
rsynnott 5y ago
So one concern (and it's not just a theoretical concern; it has happened) is that a US court forces the US branch to use access it has to data held by the EU branch to exfiltrate data. Companies with the highest standards on this stuff will want either a pure-EU host or a host structured such that this can't happen.
- spaniard89277 5y ago
  Hmm, this is definitely worrying.
zibzab 5y ago
Fully legal thanks to "cloud act": https://en.m.wikipedia.org/wiki/CLOUD_Act https://en.m.wikipedia.org/wiki/CLOUD_Act