4 ms·
A recent ruling about Cookiebot and their use of Akamai indicates that even EU-located servers run by a US company run afoul of GDPR. The core issue is that the
by lmkg 5y ago
A recent ruling about Cookiebot and their use of Akamai indicates that even EU-located servers run by a US company run afoul of GDPR. The core issue is that the US CLOUD Act gives US law enforcement access to data on those servers.
- cassianoleal 5y agoHuh, interesting. Thanks for the info. Do you have any links to this?
- lmkg 5y agoIt's a decision from a German court. Here's a link to an English analysis of the ruling, which includes links to the decision itself: https://iapp.org/news/a/new-eu-data-blockage-as-german-court-would-ban-many-cookie-management-providers/ https://iapp.org/news/a/new-eu-data-blockage-as-german-court...
- cassianoleal 5y agoThanks. Do you know if this covers other kinds of services, such as global load balancers (Akamai, Google Load Balancer, etc), for instance? They do know about source IP (which is considered PII), destination hosts and in many instances (where they terminate TLS, or unencrypted connections) pretty much all the information being transmitted.
- lmkg 5y agoI don't know for sure, and this ruling is likely to get appealed so don't take it as final yet. But the Akamai service in question was a CDN. I have a hard time imagining an argument that would sanction CDNs but not apply to load balancers.
- estaseuropano 5y agoIt was about the use of personal data specifically, not jus tin general a use of US services. From the linked article (which seems to draw some broader fear-mongering conclusions not evidenced by the case it discusses): It held that the mere use of a U.S.-based provider to collect IP addresses and user key data was an unlawful “transfer” because: Per the Court of Justice of the European Union, IP addresses are personal data (the court also considered Cookiebot’s “user key” to be personal data). Under the Clarifying Lawful Overseas Use of Data Act, a U.S. cloud provider can be obligated to produce all data in its possession, custody, or control to U.S. agencies, irrespective of whether the data is stored in or outside the U.S. This decision has a number of noteworthy implications. Among the more salient are: The court never evaluated whether a “transfer” actually occurred. The decision assumes a “transfer” occurs even if data never leaves the EU, so long as the recipient of data may formally be subject to requests by non-EU authorities.
- estaseuropano 5y agoIt is limited to personal data though. So (if this decision holds) you cannot pass datatl outside the EU without explicit consent.