5 ms·

a randomised unique ID and username/password are not personal data if they can't be used to identify a person. IF you associate that uniqueID or username with s

by cowl 5y ago

a randomised unique ID and username/password are not personal data if they can't be used to identify a person. IF you associate that uniqueID or username with something that can identify the user (like IP/ Personal name etc) than yes it's illegal for you to store that data in US even with the consent of the user.

themanmaran 5y ago
I feel like this is either a mis-interpretation, or the scope of this law would prevent 95% of websites from existing in the EU (including hackernews which stores your email). So any US company cannot store PII on an EU citizen? If someone from the EU comes to my site to make a purchase, I can't allow them to do that?
- cowl 5y ago
  Yes that is my interpretation of it. The whole point being that any data stored in US can not be guaranteed to respect GDPR because the US government can request access to that data and the EU citizens don't have a recourse to that. any US buisness that want to have EU citizens PI needs to have a host in EU.
  - judge2020 5y ago
    Not just a host, but the corporation in control of the data can't be controlled by a US corporation at all, lest the US corporation be able to pressure the EU subsidiary into handing over that data.
    - themanmaran 5y ago
      So every US company needs to have a separate, non-controlled, entity in the EU? Seems pretty unrealistic to me. In this scenario, I feel like the US company would be better off blocking traffic from the EU.
      - judge2020 5y ago
        Exactly. Maybe it was intentional in an attempt to get the US to claw back the CLOUD act, which is the point of contention here. Until that happens, US websites (see: big businesses with a legal department) are likely going to block storing any EU citizen data, which might (but probably not measurably) help prop up local EU services.
- theptip 5y ago
  The key is consent and right to deletion. GDPR is ok with you storing data if the user consents, you list all the data, you list who you share it with, and you have a contract with anyone you share data with so you can comply with a deletion request. The US government won’t honor deletion requests for any IPs it requests from GA, therefore you can’t comply with GDPR if you use GA. If you don’t share data it’s much simpler. You collect just what you need to do the processing the user consented to. And you delete it when a user asks. Edited to add: I should say the 2nd paragraph seems to be the regulator's position. It seems a bit extreme to me and I don’t fully endorse it. But my main point was to try to highlight why most essential and consented processing is unaffected by this ruling.

by cowl 5y ago

themanmaran 5y ago

I feel like this is either a mis-interpretation, or the scope of this law would prevent 95% of websites from existing in the EU (including hackernews which stores your email). So any US company cannot store PII on an EU citizen? If someone from the EU comes to my site to make a purchase, I can't allow them to do that?

cowl 5y ago
Yes that is my interpretation of it. The whole point being that any data stored in US can not be guaranteed to respect GDPR because the US government can request access to that data and the EU citizens don't have a recourse to that. any US buisness that want to have EU citizens PI needs to have a host in EU.
- judge2020 5y ago
  Not just a host, but the corporation in control of the data can't be controlled by a US corporation at all, lest the US corporation be able to pressure the EU subsidiary into handing over that data.
  - themanmaran 5y ago
    So every US company needs to have a separate, non-controlled, entity in the EU? Seems pretty unrealistic to me. In this scenario, I feel like the US company would be better off blocking traffic from the EU.
    - judge2020 5y ago
      Exactly. Maybe it was intentional in an attempt to get the US to claw back the CLOUD act, which is the point of contention here. Until that happens, US websites (see: big businesses with a legal department) are likely going to block storing any EU citizen data, which might (but probably not measurably) help prop up local EU services.
theptip 5y ago
The key is consent and right to deletion. GDPR is ok with you storing data if the user consents, you list all the data, you list who you share it with, and you have a contract with anyone you share data with so you can comply with a deletion request. The US government won’t honor deletion requests for any IPs it requests from GA, therefore you can’t comply with GDPR if you use GA. If you don’t share data it’s much simpler. You collect just what you need to do the processing the user consented to. And you delete it when a user asks. Edited to add: I should say the 2nd paragraph seems to be the regulator's position. It seems a bit extreme to me and I don’t fully endorse it. But my main point was to try to highlight why most essential and consented processing is unaffected by this ruling.