4 ms·

I'm fairly confident that data encrypted over the wire and only decrypted locally on the user's machine, shared willingly with the intended recipient, would not

I'm fairly confident that data encrypted over the wire and only decrypted locally on the user's machine, shared willingly with the intended recipient, would not violate anything of interest (clearly, European companies can serve pages to the US). Of course, there are many more ambiguous cases than that (like, where exactly can metadata about which Europeans are allowed to view an American's posts be stored? Is that PII?), but the specific case of serving a post is not really all that complicated. For those downvoting me, I'd love to hear why you think it's more complicated than that. Contrary to popular belief, the people who wrote the GDPR are pretty technically sophisticated and understand that data on the internet has to move between countries from time to time.

stickfigure 5y ago
I live in the US, I have several friends that live in the EU. "Who our friends are" is unquestionably PII. Is this friendship graph something that must reside in the US or EU?
- Jweb_Guru 5y ago
  Yes, that was the example I brought up as something more complicated. This does not really have anything to do with the fact that data has to eventually be transferred to the US though, which is what the majority of this thread seems to be about. I suspect that a good answer to this is quite complicated, but it's worth looking at the work Signal has been doing to protect this sort of data in a reasonably privacy-conscious way.
jefftk 5y ago
Let's take a more complicated example, that is one of the main things that happens on Facebook: 1. Sam makes a post. 2. FB predicts Pat will comment on this post if they see it. 3. Pat sees the post, and writes a comment. 4. FB predicts Alex will reply to Pat's comment if they see it. 5. Alex sees the comment, and writes a reply. To show why data transfer is such an issue, assume Sam, Pat, and Alex are all in jurisdictions with EU-style privacy regulations and that don't have data transfer agreements with each other. How would you build a system that supports 1-5, a user journey that is core to Facebook's usage, in a way compliant with these regulations? For example, where is the discussion stored? Where do the models in (2) and (4) run?
- Jweb_Guru 5y ago
  Insofar far as I understand GDPR, models (2) and (4) can run anywhere, provided that the data are ephemeral, encrypted in transit, and their output decision cannot be queried later (e.g. by logging a relationship between the input to the model and the eventual message delivery that includes PII like IP). The question of "where is the discussion stored?" would indeed be problematic if it were not possible for it to be encrypted in such a way that a key from both countries was needed in order to reveal the conversation plaintext, but I don't see a clear reason why that should not be possible (it may not be how Facebook actually stores conversations now, of course, but it is not a technical barrier). As far as I can tell, the really difficult aspect here is how and where to permanently store the fact that the two users are talking to each other once the comments are actually made, since the mere fact that they are talking to each other demonstrates a relationship between them which may be considered PII in some contexts. Or at least, it would be difficult if the US also had privacy laws like the EU's, and IMO any coherent solution should be able to work if the US adopts something like GDPR. Unlike the message contents, this is quite difficult to store in a privacy-preserving way. I think the discussion would be more interesting and feel less like attacking a strawman if people were to focus on the interesting questions like this one, rather than the extremely uninteresting question of whether Facebook can serve posts to the US at all (which it obviously can).

stickfigure 5y ago

I live in the US, I have several friends that live in the EU. "Who our friends are" is unquestionably PII. Is this friendship graph something that must reside in the US or EU?

Jweb_Guru 5y ago
Yes, that was the example I brought up as something more complicated. This does not really have anything to do with the fact that data has to eventually be transferred to the US though, which is what the majority of this thread seems to be about. I suspect that a good answer to this is quite complicated, but it's worth looking at the work Signal has been doing to protect this sort of data in a reasonably privacy-conscious way.

jefftk 5y ago

Let's take a more complicated example, that is one of the main things that happens on Facebook: 1. Sam makes a post. 2. FB predicts Pat will comment on this post if they see it. 3. Pat sees the post, and writes a comment. 4. FB predicts Alex will reply to Pat's comment if they see it. 5. Alex sees the comment, and writes a reply. To show why data transfer is such an issue, assume Sam, Pat, and Alex are all in jurisdictions with EU-style privacy regulations and that don't have data transfer agreements with each other. How would you build a system that supports 1-5, a user journey that is core to Facebook's usage, in a way compliant with these regulations? For example, where is the discussion stored? Where do the models in (2) and (4) run?

Jweb_Guru 5y ago
Insofar far as I understand GDPR, models (2) and (4) can run anywhere, provided that the data are ephemeral, encrypted in transit, and their output decision cannot be queried later (e.g. by logging a relationship between the input to the model and the eventual message delivery that includes PII like IP). The question of "where is the discussion stored?" would indeed be problematic if it were not possible for it to be encrypted in such a way that a key from both countries was needed in order to reveal the conversation plaintext, but I don't see a clear reason why that should not be possible (it may not be how Facebook actually stores conversations now, of course, but it is not a technical barrier). As far as I can tell, the really difficult aspect here is how and where to permanently store the fact that the two users are talking to each other once the comments are actually made, since the mere fact that they are talking to each other demonstrates a relationship between them which may be considered PII in some contexts. Or at least, it would be difficult if the US also had privacy laws like the EU's, and IMO any coherent solution should be able to work if the US adopts something like GDPR. Unlike the message contents, this is quite difficult to store in a privacy-preserving way. I think the discussion would be more interesting and feel less like attacking a strawman if people were to focus on the interesting questions like this one, rather than the extremely uninteresting question of whether Facebook can serve posts to the US at all (which it obviously can).