4 ms·

If that were the case, how would any global communication medium be allowed to operate? Can't you provide the same service while not moving PII out of the EU? A

If that were the case, how would any global communication medium be allowed to operate? Can't you provide the same service while not moving PII out of the EU? As far as I know this is not about a user in the US viewing a EU citizen's facebook page, this is about where the original data resides, is it not? Playing devil's advocate here, can't you just figure out what jurisdiction the user belongs to and route the request to the right server?

deleted 5y ago
[deleted]
emaginniss 5y ago
A facebook feed doesn't just show data from one user. When I look at my feed, I am seeing posts from 100 people distributed over 7 countries on 3 continents. Stitching that data together from multiple data sources is an extremely difficult thing to accomplish.
- deepsun 5y ago
  Not difficult at all, I did that on a much smaller case.
- barbazoo 5y ago
  Probably not too difficult for a company like Facebook, don't you think?
  - bdonlan 5y ago
    Much harder for a large company than a small one, actually. The coordination overhead to get a bunch of disparate teams in a large company to rearchitect the fundamental structure of the service should not be overlooked.
    - barbazoo 5y ago
      Personally I'd be happy to accept that given Facebook's impact on society and their technical ability and capacity.
- peoplefromibiza 5y ago
  they are already doing it. The issue is not your feed, that's what Facebook wants you to believe, you agreed to share that data with other FB users. the issue is they transfer personal data of EU citizens to the US to process them and sell them or use them to improve their adv war machine. Or give it to their US government.
deleted 5y ago
[deleted]
sophrocyne 5y ago
Aside from the difficulties in operating effectively without passing any PII (which includes identifiers) across international/org lines, the reality is that recent EU regulatory action has come down not on where the data is stored, but whether the parent company is in the US. The reality that the EU government has recognized is that a FISA order of the parent company could compel a US organization to pull data from the EU servers to provide to the US government; and it’s a valid critique.
- radicalbyte 5y ago
  And hashes - legally a hash of PII is PII. The definition is literally: IF [thing] be used to identify [person] from any arbitrary set of [persons] THEN [thing] is PII.
- barbazoo 5y ago
  > passing any PII (which includes identifiers) across international/org lines My understanding was that it's not about that. > the reality is that recent EU regulatory action has come down not on where the data is stored, but whether the parent company is in the US Interesting, do you have any source on this particular aspect? I haven't heard this before.
  - ascar 5y ago
    Search for Schrems here on HN. There were a couple of articles recently that in effect have this implication. I was surprised too.
    - barbazoo 5y ago
      Thanks, will do!
  - number6 5y ago
    The cloud act allows US agencies to gain access to all data a US Company has access to regardless the physical location. This in turn means that a EU Company can't guarantee that the data isn't transferred out of the EU. To transfer data out of the EU one either needs a legal framework or consent. Consent has to be given in an informed manner, but since the company does not know for what reasons an US agencie can access the data they can not inform the person correctly under gdpr. A legal framework has to comply with the EU Charta. Indiscriminate access to information is not in compliance with the EU Charta so a framework cannot exist. It's a legal deadlock.
mminer237 5y ago
That wouldn't solve anything. The EU treats all US services as being in the US, regardless of where the physical servers are, as Facebook is still subject to the US subpeonas and they are legally required to give data to the US even if it's on a European server. You are right that the same logic would make any American communication website illegal. I think the end goal for the EU here is to require all communication platforms used by EU citizens to be entirely run by the EU.
- barbazoo 5y ago
  > regardless of where the physical servers are, as Facebook is still subject to the US subpeonas and they are legally required to give data to the US even if it's on a European server Is that so? I'd like to know more about this then, I don't see how that would be practical at all then.
  - roywiggins 5y ago
    This is explicitly authorized by the CLOUD Act: > Principally, it asserts that U.S. data and communication companies must provide stored data for a customer or subscriber on any server they own and operate when requested by warrant, but provides mechanisms for the companies or the courts to reject or challenge these if they believe the request violates the privacy rights of the foreign country the data is stored in. https://en.wikipedia.org/wiki/CLOUD_Act https://en.wikipedia.org/wiki/CLOUD_Act.
    - barbazoo 5y ago
      > when requested by warrant I think that's the difference. Facebook could be forced to keep all PII in the EU for the purpose of protecting peoples data from unlawful (EU) use but still have to surrender it to US law enforcement. Would that violate the EU law?
      - philistine 5y ago
        It does. A US warrant is incompatible with the EU privacy garanties.
likpok 5y ago
There are a lot of edge cases that people don't think about. A lot of communication data has two people associated, and a lot of it is highly sensitive. If a US person and a French person chat how does each get the messages? Message data is obviously highly sensitive and shouldn't be shared. Does the US person need to hit the French servers to see new messages, and vice versa? What about quoting? Message metadata (i.e. the fact that these two people are talking at all) is also pretty valuable -- the classic pen register is just a record of which calls were made to which numbers. Where do you store the metadata of the thread? It arguably belongs to and is private to both people.
- dataflow 5y ago
  > Does the US person need to hit the French servers to see new messages, and vice versa? What about quoting? I would imagine each user has a copy of the other's messages in their own account, and that's what they would be hitting.
  - kasey_junk 5y ago
    How does it get to their account?
    - dataflow 5y ago
      A server in the sender's jurisdiction sends it to a server in the receiver's jurisdiction? How do SMS or email work in Europe?
      - kasey_junk 5y ago
        Sending data to the US and storing it there, is the very point that is being contested. People are acting like this is a trivial problem both technically & legally but it’s not. I don’t have sympathy for Facebook but if you are a small company handling data in the EU and other data outside it I have sympathy as it’s going to cost a lot in architectural complexity and compliance costs.
bdonlan 5y ago
If you are sending a message to a person in another country, you are consenting to that communication traveling to the location of that person. See article 6: 1. Processing shall be lawful only if and to the extent that at least one of the following applies: (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; (b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract [.. other permissible purposes snipped ..] Generally, the GDPR issues with sending to another country boil down to whether the EU accepts that the other country's government will allow the company protect the data in ways compatible with the GDPR. When sending that data to another company happens for reasons incidental to the permissible purpose of your data (eg EU-to-EU data processed in the US) this becomes an issue, as you've not consented to that risk. If you are specifically requesting that your data be sent to, say, the US, however, then processing that data in the US becomes necessary and thus much more justified. From a technical perspective, you can certainly silo your data and transfer only as needed. This is however way more complicated, as you need to now deal with the fact that you're potentially performing joins across high-latency datastores, where you might need to be careful about what query data you're sending across the wire, and where your different silos need to apply access controls against each other. If you didn't engineer for this from the start, it's a big shift in architecture.
otherme123 5y ago
This is about data sending without consent, which has to be explicit. E.g. if I, as european, create a Gmail account and my mails reside in an US server, I give explicit permission for all my emails to be transferred between Europe and the US. Namely: I'm informed of the extent of data collection (all my mails incoming our outgoing), the duration (forever), the storage (Google servers) and algorithms used (I consent the scanning of my emails to create adds). But if I visit a web page hosted in Europe, and that page uses the FB cookies, Google analytics, etc. maybe I'm unaware what and how the data is being collected. They relied on the cookie banners as explicit consents (i.e. if you click this "OK" button, you give explicit consent to all our data gathering and sending), but that might be not fully compliant with GDPR.
- tyrfing 5y ago
  > E.g. if I, as european, create a Gmail account and my mails reside in an US server, I give explicit permission for all my emails to be transferred between Europe and the US. NOYB has used this as an example of something that would be illegal.
  - otherme123 5y ago
    Do you have a link? AFAIK they are fighting against analytics, cookies and advertising ids.
    - tyrfing 5y ago
      Sure, here: https://noyb.eu/sites/default/files/2020-03/ag_prep_en.pdf https://noyb.eu/sites/default/files/2020-03/ag_prep_en.pdf The main issue is differences between EU and US law.

deleted 5y ago

[deleted]

emaginniss 5y ago

A facebook feed doesn't just show data from one user. When I look at my feed, I am seeing posts from 100 people distributed over 7 countries on 3 continents. Stitching that data together from multiple data sources is an extremely difficult thing to accomplish.

deepsun 5y ago
Not difficult at all, I did that on a much smaller case.
barbazoo 5y ago
Probably not too difficult for a company like Facebook, don't you think?
- bdonlan 5y ago
  Much harder for a large company than a small one, actually. The coordination overhead to get a bunch of disparate teams in a large company to rearchitect the fundamental structure of the service should not be overlooked.
  - barbazoo 5y ago
    Personally I'd be happy to accept that given Facebook's impact on society and their technical ability and capacity.
peoplefromibiza 5y ago
they are already doing it. The issue is not your feed, that's what Facebook wants you to believe, you agreed to share that data with other FB users. the issue is they transfer personal data of EU citizens to the US to process them and sell them or use them to improve their adv war machine. Or give it to their US government.

deleted 5y ago

[deleted]

sophrocyne 5y ago

Aside from the difficulties in operating effectively without passing any PII (which includes identifiers) across international/org lines, the reality is that recent EU regulatory action has come down not on where the data is stored, but whether the parent company is in the US. The reality that the EU government has recognized is that a FISA order of the parent company could compel a US organization to pull data from the EU servers to provide to the US government; and it’s a valid critique.

radicalbyte 5y ago
And hashes - legally a hash of PII is PII. The definition is literally: IF [thing] be used to identify [person] from any arbitrary set of [persons] THEN [thing] is PII.
barbazoo 5y ago
> passing any PII (which includes identifiers) across international/org lines My understanding was that it's not about that. > the reality is that recent EU regulatory action has come down not on where the data is stored, but whether the parent company is in the US Interesting, do you have any source on this particular aspect? I haven't heard this before.
- ascar 5y ago
  Search for Schrems here on HN. There were a couple of articles recently that in effect have this implication. I was surprised too.
  - barbazoo 5y ago
    Thanks, will do!
- number6 5y ago
  The cloud act allows US agencies to gain access to all data a US Company has access to regardless the physical location. This in turn means that a EU Company can't guarantee that the data isn't transferred out of the EU. To transfer data out of the EU one either needs a legal framework or consent. Consent has to be given in an informed manner, but since the company does not know for what reasons an US agencie can access the data they can not inform the person correctly under gdpr. A legal framework has to comply with the EU Charta. Indiscriminate access to information is not in compliance with the EU Charta so a framework cannot exist. It's a legal deadlock.

mminer237 5y ago

That wouldn't solve anything. The EU treats all US services as being in the US, regardless of where the physical servers are, as Facebook is still subject to the US subpeonas and they are legally required to give data to the US even if it's on a European server. You are right that the same logic would make any American communication website illegal. I think the end goal for the EU here is to require all communication platforms used by EU citizens to be entirely run by the EU.

barbazoo 5y ago
> regardless of where the physical servers are, as Facebook is still subject to the US subpeonas and they are legally required to give data to the US even if it's on a European server Is that so? I'd like to know more about this then, I don't see how that would be practical at all then.
- roywiggins 5y ago
  This is explicitly authorized by the CLOUD Act: > Principally, it asserts that U.S. data and communication companies must provide stored data for a customer or subscriber on any server they own and operate when requested by warrant, but provides mechanisms for the companies or the courts to reject or challenge these if they believe the request violates the privacy rights of the foreign country the data is stored in. https://en.wikipedia.org/wiki/CLOUD_Act https://en.wikipedia.org/wiki/CLOUD_Act.
  - barbazoo 5y ago
    > when requested by warrant I think that's the difference. Facebook could be forced to keep all PII in the EU for the purpose of protecting peoples data from unlawful (EU) use but still have to surrender it to US law enforcement. Would that violate the EU law?
    - philistine 5y ago
      It does. A US warrant is incompatible with the EU privacy garanties.

likpok 5y ago

There are a lot of edge cases that people don't think about. A lot of communication data has two people associated, and a lot of it is highly sensitive. If a US person and a French person chat how does each get the messages? Message data is obviously highly sensitive and shouldn't be shared. Does the US person need to hit the French servers to see new messages, and vice versa? What about quoting? Message metadata (i.e. the fact that these two people are talking at all) is also pretty valuable -- the classic pen register is just a record of which calls were made to which numbers. Where do you store the metadata of the thread? It arguably belongs to and is private to both people.

dataflow 5y ago
> Does the US person need to hit the French servers to see new messages, and vice versa? What about quoting? I would imagine each user has a copy of the other's messages in their own account, and that's what they would be hitting.
- kasey_junk 5y ago
  How does it get to their account?
  - dataflow 5y ago
    A server in the sender's jurisdiction sends it to a server in the receiver's jurisdiction? How do SMS or email work in Europe?
    - kasey_junk 5y ago
      Sending data to the US and storing it there, is the very point that is being contested. People are acting like this is a trivial problem both technically & legally but it’s not. I don’t have sympathy for Facebook but if you are a small company handling data in the EU and other data outside it I have sympathy as it’s going to cost a lot in architectural complexity and compliance costs.

bdonlan 5y ago

If you are sending a message to a person in another country, you are consenting to that communication traveling to the location of that person. See article 6: 1. Processing shall be lawful only if and to the extent that at least one of the following applies: (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; (b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract [.. other permissible purposes snipped ..] Generally, the GDPR issues with sending to another country boil down to whether the EU accepts that the other country's government will allow the company protect the data in ways compatible with the GDPR. When sending that data to another company happens for reasons incidental to the permissible purpose of your data (eg EU-to-EU data processed in the US) this becomes an issue, as you've not consented to that risk. If you are specifically requesting that your data be sent to, say, the US, however, then processing that data in the US becomes necessary and thus much more justified. From a technical perspective, you can certainly silo your data and transfer only as needed. This is however way more complicated, as you need to now deal with the fact that you're potentially performing joins across high-latency datastores, where you might need to be careful about what query data you're sending across the wire, and where your different silos need to apply access controls against each other. If you didn't engineer for this from the start, it's a big shift in architecture.

otherme123 5y ago

This is about data sending without consent, which has to be explicit. E.g. if I, as european, create a Gmail account and my mails reside in an US server, I give explicit permission for all my emails to be transferred between Europe and the US. Namely: I'm informed of the extent of data collection (all my mails incoming our outgoing), the duration (forever), the storage (Google servers) and algorithms used (I consent the scanning of my emails to create adds). But if I visit a web page hosted in Europe, and that page uses the FB cookies, Google analytics, etc. maybe I'm unaware what and how the data is being collected. They relied on the cookie banners as explicit consents (i.e. if you click this "OK" button, you give explicit consent to all our data gathering and sending), but that might be not fully compliant with GDPR.

tyrfing 5y ago
> E.g. if I, as european, create a Gmail account and my mails reside in an US server, I give explicit permission for all my emails to be transferred between Europe and the US. NOYB has used this as an example of something that would be illegal.
- otherme123 5y ago
  Do you have a link? AFAIK they are fighting against analytics, cookies and advertising ids.
  - tyrfing 5y ago
    Sure, here: https://noyb.eu/sites/default/files/2020-03/ag_prep_en.pdf https://noyb.eu/sites/default/files/2020-03/ag_prep_en.pdf The main issue is differences between EU and US law.