3 ms·

Can it be explained, why “data is encrypted at rest using your own key” isn’t acceptable to regulator? Google might be compelled to hand data over, but data is

Can it be explained, why “data is encrypted at rest using your own key” isn’t acceptable to regulator? Google might be compelled to hand data over, but data is encrypted and useless.

pfg 5y ago
There's no mention of encryption at rest using your own key. To quote the ruling: > If the second respondent (Google) subsequently refers to encryption technologies - such as the encryption of "data at rest" in the data centers - he must again be countered with recommendations 01/2020 of the EDSA. Namely, it states that a data importer (such as the Second Respondent) who is subject to 50 US Code § 1881a (“FISA 702”) has a direct obligation with regard to the imported data that is in his possession, custody or control to grant access to or release them. This obligation can expressly also apply to the cryptographic key without which the data cannot be read (ibid. margin no. 76). > As long as the second respondent has the opportunity to access data in the Plain text access, the technical measures taken cannot be regarded as effective in the sense of the above considerations. The last paragraph suggests true end-to-end encryption may be acceptable, but that's not how Google Analytics works.
- zxienin 5y ago
  > but that's not how Google Analytics works Yes. I made the question, given the discussion is being treated as much wider, beyond GA. This also tells me, using own key can still be used by Google to operate as is (US company with EU owned entity and EU located DC)
floatingatoll 5y ago
As long as you proxy^ all requests to Google for that data through your own servers, and do not include X-Forwarded-For: <gdpr-protected-client-ip> or any other identifying details in the request you transmit to Google on their behalf, and your crypto implementation is deemed sound, then that would likely be found not to be a GDPR violation. This runs counter to the tendency of websites to offload the burden of "go fetch and evaluate XYZ" to the useragent, and requires a server under your control that is not under US jurisdiction^^ to host or proxy all internet traffic of any kind necessary to deliver the service. (I am not your lawyer, this is not legal advice.) ^ some services may ban you for proxying in this manner without a contract ^^ proxy must not be hosted by or operated within AWS, GCP, Heroku, or any other US-controlled services provider
- CasperDern 5y ago
  > or any other identifying details in the request you transmit You can definitely still use GA if you really wanted to, just not in any way that uses PII (the default).

Can it be explained, why “data is encrypted at rest using your own key” isn’t acceptable to regulator? Google might be compelled to hand data over, but data is encrypted and useless.

pfg 5y ago

There's no mention of encryption at rest using your own key. To quote the ruling: > If the second respondent (Google) subsequently refers to encryption technologies - such as the encryption of "data at rest" in the data centers - he must again be countered with recommendations 01/2020 of the EDSA. Namely, it states that a data importer (such as the Second Respondent) who is subject to 50 US Code § 1881a (“FISA 702”) has a direct obligation with regard to the imported data that is in his possession, custody or control to grant access to or release them. This obligation can expressly also apply to the cryptographic key without which the data cannot be read (ibid. margin no. 76). > As long as the second respondent has the opportunity to access data in the Plain text access, the technical measures taken cannot be regarded as effective in the sense of the above considerations. The last paragraph suggests true end-to-end encryption may be acceptable, but that's not how Google Analytics works.

zxienin 5y ago
> but that's not how Google Analytics works Yes. I made the question, given the discussion is being treated as much wider, beyond GA. This also tells me, using own key can still be used by Google to operate as is (US company with EU owned entity and EU located DC)

floatingatoll 5y ago

As long as you proxy^ all requests to Google for that data through your own servers, and do not include X-Forwarded-For: <gdpr-protected-client-ip> or any other identifying details in the request you transmit to Google on their behalf, and your crypto implementation is deemed sound, then that would likely be found not to be a GDPR violation. This runs counter to the tendency of websites to offload the burden of "go fetch and evaluate XYZ" to the useragent, and requires a server under your control that is not under US jurisdiction^^ to host or proxy all internet traffic of any kind necessary to deliver the service. (I am not your lawyer, this is not legal advice.) ^ some services may ban you for proxying in this manner without a contract ^^ proxy must not be hosted by or operated within AWS, GCP, Heroku, or any other US-controlled services provider

CasperDern 5y ago
> or any other identifying details in the request you transmit You can definitely still use GA if you really wanted to, just not in any way that uses PII (the default).