4 ms·

> you don't really have to transfer anything out of EU in order to keep your service running If a user in Florida tries to view a post by a user in Germany, do

• raverbashing 5y ago
  Yes (and this is fine - because you're sharing that post with a certain audience). But the issue is all the metadata that comes and goes with it.
  • mrweasel 5y ago
    Right, the people at Meta aren't stupid. They understand fully will that users posts aren't the issue, but steering the debate in that direction would make the EU look unreasonable. Meta could be more accommodating to the wishes of the EU and place a greater focus on privacy, but that would mean changing how they do business. Meta clearly don't believe that it's possibly for their businesses to be profitable without data mining the crap out of their users. I know it's not a popular opinion, but business like Facebook and Instagram are the direct reason why the EU feel the need to step in and regulate.
• ratg13 5y ago
  Data on the internet always travels all over the globe. It's where the data is stored and kept that is at issue.
  • endisneigh 5y ago
    Inherently isn’t the data stored and kept everywhere it’s accessed? If you’re in Germany and are a German your message sent to me just now also now is being stored where I’m located to even read it, no?
    • 0des 5y ago
      That is correct, as well as caching.
      • benreesman 5y ago
        I'm sure we'd all benefit from hearing the TurtleCoin guy expound on how one goes about multi-national regulation of terrabits/s of multi-layered write-through caching ranging from extremely cold storage on custom hardware to the POP sitting in a Munich suburb and where exactly the line should be drawn on data custody in that setting. Enlighten us?
    • b112 5y ago
      In terms of this discussion, stored doesn't mean on an end user device, nor in ram on servers, or temp caching, while serving content. You guys are just playing with semantics. In terms of this context, easiest way would be to shard db infrastructure. Not even a remotely big deal for Facebook, with their size. Hell, they should already want this, to avoid costly, and high ping time, intercontinental links. But oh nooos, so hard to do. Absurd.
      • endisneigh 5y ago
        It’s not semantics, though. If I saved everything I ever read onto a database, indexed uniquely by website schema, how does anything change? The point is the same.
        • b112 5y ago
          I don't get what you are saying. DB schema is irrelevant in terms of where the database backend is stored.
          • endisneigh 5y ago
            My point is I could just as well have a local database and permanently persist everything I see on the web, no? The same point applies. Think about internet archive, BitTorrent dumps of Facebook, etc.
    • barbazoo 5y ago
      Not on their servers though. If the data is in your browser, it's not trivial for e.g. Facebook to then go an do nefarious things with that data at scale. This is how I understand it.
      • endisneigh 5y ago
        My point isn’t Facebook in particular, but more generally around data residency. Inherently data must be saved and stored to all who access, no? Wouldn’t the true solution simply be for those who don’t want other regions to save to simply not have access, e.g firewall?
        • barbazoo 5y ago
          My understanding was that it's about where the data resides. That assumption may or may not be true. But if it is it's feasible for EU data to be stored in the EU and US users request that data from the EU server. Again, my understanding was that this would be a valid way to handle that data but I might be wrong.
          • endisneigh 5y ago
            Your understanding is correct, but my point is that inherently if US people can access EU profiles inherently some EU data will be stored in the US. It would then been trivial for someone to crawl EU pages and rebuild the corpus of data. The only real solution is to firewall off regions and prevent those users from accessing anything other than their own. This is already what some countries like China do, for instance
            • barbazoo 5y ago
              I don't think this is what the EU is requiring even though it is possible to scrape EU data. Facebook is pretty good at preventing scraping though.
    • benreesman 5y ago
      This is where lawyers, regulators, and engineers can reasonably disagree with very serious consequences for governments, shareholders, and ultimately citizens. If you're in a given geography/regulatory regime, and you read something on your smart phone, technically you were served that via some cell tower or ISP, those bits transited that infrastructure. In the US there's a massive clot of regulatory blockage working it's way slowly through the bowels of government around the term of art: "common carrier". As with many things that devolve into nitpicking, there is a deeper issue: the EU is increasingly regretting becoming the host to, ironically, European-style colonialism on large-scale consumer Internet platforms. The PRC has its own Google, Twitter, Facebook, etc. The EU has Google, Twitter, Facebook, etc. and doesn't love that US companies and regulators are kind of driving the digital lives of the citizens. The proximate tussle is about the durability of the storage involved. As a European regulator I might be much more comfortable with a write-through cache like TAO holding messages, or FBIDs of messages, including a German in the chat than I am with all such chats being held on a DFS in Prineville among other places, and having them ground over by a Spark or Hadoop job in Forest City among other places. They'll kick it around and come up with some compromise that will serve end-users by accident at best. Europe won't develop a homegrown consumer Internet industry in our lifetimes. The odds are both US and EU legislators and regulators will miss a step and it'll be ByteDance everywhere by the time anyone reads this :)
  • Fargren 5y ago
    That's one issue. Another more complicated issue is which country's legal authority does the owner of the data have to respond to. If the answer is USA, then the data can be requested by this government regardless of where it's stored...
• 0des 5y ago
  Yes, however, as in China, if EU wants their own internet, having their own internet is an option, however extreme.
• V__ 5y ago
  One option would be to serve this data directly from the European server. However, it's not the public profile data which most people object to be shared, it's the tracking/user-profile data which FB collects in the background.
  • axiosgunnar 5y ago
    > If a user in Florida tries to view a post by a user in Germany, doesn't the German user's data have to leave the EU? > One option would be to serve this data directly from the European server. What do you think happens with the data when you "serve it directly from the European server" to a user in Florida? Exactly, it leaves the EU to go to Florida. ;-)
    • V__ 5y ago
      Yeah, to the user who requested it. Also, it's just the user's post, not the user's tracking/advertisement data. So the only thing the US government could get, are the public facing posts/images which the user posted but nothing more. If the profile is private, even less. No messenger data (except when send to users in the US).
    • Retric 5y ago
      People in the EU can explicitly share data with other people, they aren’t trying to take down the phone system.
    • erispoe 5y ago
      You can access EU-served data from all over the world, that's not a problem. What's in question is bringing data from EU residents outside of the EU to process it.
• croes 5y ago
  It doesn't need to be on a US FB server
• deleted 5y ago
  [deleted]
• Jweb_Guru 5y ago
  I'm fairly confident that data encrypted over the wire and only decrypted locally on the user's machine, shared willingly with the intended recipient, would not violate anything of interest (clearly, European companies can serve pages to the US). Of course, there are many more ambiguous cases than that (like, where exactly can metadata about which Europeans are allowed to view an American's posts be stored? Is that PII?), but the specific case of serving a post is not really all that complicated. For those downvoting me, I'd love to hear why you think it's more complicated than that. Contrary to popular belief, the people who wrote the GDPR are pretty technically sophisticated and understand that data on the internet has to move between countries from time to time.
  • stickfigure 5y ago
    I live in the US, I have several friends that live in the EU. "Who our friends are" is unquestionably PII. Is this friendship graph something that must reside in the US or EU?
    • Jweb_Guru 5y ago
      Yes, that was the example I brought up as something more complicated. This does not really have anything to do with the fact that data has to eventually be transferred to the US though, which is what the majority of this thread seems to be about. I suspect that a good answer to this is quite complicated, but it's worth looking at the work Signal has been doing to protect this sort of data in a reasonably privacy-conscious way.
  • jefftk 5y ago
    Let's take a more complicated example, that is one of the main things that happens on Facebook: 1. Sam makes a post. 2. FB predicts Pat will comment on this post if they see it. 3. Pat sees the post, and writes a comment. 4. FB predicts Alex will reply to Pat's comment if they see it. 5. Alex sees the comment, and writes a reply. To show why data transfer is such an issue, assume Sam, Pat, and Alex are all in jurisdictions with EU-style privacy regulations and that don't have data transfer agreements with each other. How would you build a system that supports 1-5, a user journey that is core to Facebook's usage, in a way compliant with these regulations? For example, where is the discussion stored? Where do the models in (2) and (4) run?
• _fizz_buzz_ 5y ago
  Just for clarification, GDPR does not prohibit in any way that privat personal data leaves the EU (obviously). However, if you want to transfer privat personal data out of the EU you have to certify it still conforms with GDPR (this can be self certified).