5 ms·

Could someone explain to me how this should work? For example, if user A living in France makes a post and a user B living in America comments on it. Where shou

Could someone explain to me how this should work? For example, if user A living in France makes a post and a user B living in America comments on it. Where should the data of this post + comment reside, ideally? What if it’s cached by a CDN close to users in a third country, say Japan? Is that illegal?

eointierney 5y ago
Data is stored on servers, connected by networks, in various jurisdictions all over the world. If a company wants to operate in a jurisdiction it _must_ comply with the laws of said jurisdiction. If the company chooses not to comply the jurisdiction can impose fines, seek injunctions, pursue criminal trials, etc. That's how it works. As a scientist I find regulatory over-reach tedious. As a citizen I find corporate illegality unjustifiable. This is not regulatory over-reach this is corporate illegality.
- gowld 5y ago
  How can a corporation "protect European data from US access" when a European intentionally requests the corporation to publish the data to a US audience? How can anyone be legal, when the laws of different countries are in conflict?
  - dathinab 5y ago
    If you ask specific data to be transferred to the US it can be transferred to the US. But the profile a companies creates about you, your phone number for 2FA, (group) chats local to the EU, etc. do not fall under this. Though I'm not sure about public profiles, probably you also should probably be able to select to not share you public profile with the US.
BrentOzar 5y ago
In the case of a thick client app: > if user A living in France makes a post The post data would be stored on a server in France. > a user B living in America comments on it The user B's thick client app would have to query all servers all over the world that might hold data they're allowed to see, and then render it. It's up to the servers in each country to decide whether the post should be sent to the viewer in question. When User B comments, their comment would be stored on a server in the US. For User A to see the comment, like User B, they would need to connect to all servers in all countries to fetch what data they're allowed to see. Is this cheap and practical? Of course not. But it's possible, just not in the sense we've come to know social media apps.
- TekMol 5y ago
  When User B comments, their comment would be stored on a server in the US. For User A to see the comment, like User B, they would need to connect to all servers in all countries to fetch what data they're allowed to see. Since A is in France, how would the server of User B - who is in the USA - know what A is allowed to see? If no data about user A is allowed to be stored in the USA, the server in the USA can not know who A is and what they are allowed to see.
  - egeozcan 5y ago
    > If no data about user A is allowed to be stored in the USA, the server in the USA can not know who A is IANAL, but to my best knowledge, holding one-off data in memory is repeatedly defended in European courts as not storing data. This is from the top of my head, so treat it as "probably wrong". All in all, the whole thing is a bit of a circus, really.
    - TekMol 5y ago
      How does "one-off data in memory" come into play here?
- sandworm101 5y ago
  It doesn't need to be nearly that complicated. You never need to query every server. The post stays on the server for the poster's country. Every comment attached to that post gets an anonymous number/tag (this already exists). So each post is stored as a post and an associated list of numbers/tags for comments. When rendering, the user's system fetches the post, gets the list of comment numbers, and pulls the comments from the various country-specific servers. The servers in each country take the incoming request and decide whether the data can be sent to the requesting country according to their own local rules/laws. This need not be complicated. It can all be handled as basic HTML stuff.
  - treis 5y ago
    I don't think this passes. Anonymized post IDs still are information about a person. You can piece together posts & likes and conclude with good accuracy that a specific person is making the post. As an example, if me, My Mom, and my brother's girlfriend all like a post it's likely that my brother made it. That makes those anonymized IDs personal information based on the GPRD definition: “any information” “relating to” “an identified or identifiable” “natural person” https://gdpr.eu/eu-gdpr-personal-data/ https://gdpr.eu/eu-gdpr-personal-data/ Ultimately the problem is that the GDPR is written broadly enough to encompass basically everything.
anonymousab 5y ago
> Could someone explain to me how this should work? I think the general idea is that Facebook and co. will need to spend their lobbying influence and dollars on getting FISA and the CLOUD act changed to allow them to make the necessary privacy and integrity guarantees for the European user data. And/or for the US to make those changes to get or keep the same kind of market access. The former is unlikely at best and the latter would require the kind of "giving in" that the US gov does not like to do. I think continual can kicking or eventual EU capitulation is more likely.
- Grollicus 5y ago
  How do you think the EU can give in here? They've tried it twice and European courts have decided twice that it's impossible.
  - Macha 5y ago
    I mean, the courts have decided it's impossible in the context of current EU laws. The EU could always change those laws. But I think the likelihood of that is low, both because they're for relatively popular (in Europe) goals, even if the malicious compliance outcomes themselves are somewhat unpopular, and just the EU's makeup in general makes it a very slow moving body and it'd be relatively hard to get the agreement to reverse here.
    - Grollicus 5y ago
      Schrems II is based on the argument that there is no due process for EU citizens to even check if data collection in the US is legal. That's a constitutional argument, it doesn't help to change laws. Or, well, as "constitutional" as it can get with the EU.
simion314 5y ago
FB needs to find a reputable country with privacy laws that are valid in EU and that does not have data funnels into state agencies or giant companies, then FB can move everyone data there including US citizens to be always protected. I think Microsoft, Apple and others have done similar think to obtain approval for some of their products so is not something new but FB can decide they can pull out or try to work with the other giants to demand that non-US citizens deserve privacy and basic rights.
- lmkg 5y ago
  That country is the UK. The EU has an "Adequacy Decision" for the UK, meaning that GDPR does not restrict data transfers to the UK. And the UK's Adequacy Decision for the United States still exists (Schrems II happened after Brexit).
  - simion314 5y ago
    EU and other non EU countries will have to check if there is no loophold, I personally don't trust UK , the last shitty thing that comes to mind is their illegal treatment of Assange - it shows to me that UK gov loves(or maybe needs) to sucking up to US.
  - petschge 5y ago
    If the UK company leaks all user data to the US, the EU is going to revoke the Adequacy Decision in a couple of years.
  - johannes1234321 5y ago
    This depends on how things in UK will develop. There are some powerful actors in the UK who want to weaken those laws. The current legal framework between EU and UK won't work forever (see especially Ireland) and will need changes, one direction or the other.
gowld 5y ago
There is no "should" work. Law is full of contradictions, because law is not science.
kmeisthax 5y ago
Within the EU would be the safest bet. That being said, GDPR isn't purely a data localization law - that's merely an implication of broader data export rules. If a court were to interpret public posts as private information under GDPR, then the solution would be that the user in America doesn't even see the post, because retrieval would count as a data export. However, I'm not sure if this interpretation would fly in court. Most of the Schrems II cases focus around analytics, CDNs, and ad-tracking - i.e. the sort of things that just happen automatically and users don't get a say in[0]. Presumably, if a French user wanted to DM an American[1], whatever data transfers are necessary to send that message along would be legal, but nothing further. So we wouldn't be banning Americans off of Facebook, but Facebook couldn't use US/EU messaging as an excuse to ignore GDPR entirely. GDPR data export rules are not specifically targeted at Americans. They apply to all third countries, America just being one of them. If you pass GDPR in your local law, then unlimited data exports are permitted[4]. However, that would probably require you also have the same data export rules, which would also mean you can't export data to other third countries that don't have them. Furthermore, while I postulated scenarios in which a data export would be necessary in order for the service to work at all, you probably couldn't use those justifications to ship data to arbitrary non-GDPR third-countries. i.e. DMs can flow between America and the EU, but the CDNs probably need to remain in the GDPR-o-sphere or America. That being said, there is the potential for further legal hijinx. If the US absolutely insisted on "privacy is for US citizens only"[2], they could pass contradictory privacy rules that made compliance with GDPR illegal. This would cut the Internet[3] in half, and make it illegal to offer any sort of service in which Americans and Europeans interact. And the US is the king of making economic sanctions watertight - it's our primary engine of soft imperialism. We don't roll tanks, we just make it very painful for any country to trade with you. [0] Unless you maintain a really, really victim-blamey definition of the word "User-Agent" [1] Despite France's stereotypical anglohostility, such people do exist! [2] This is the current operating mode of most intelligence agencies and trade representatives. Internationalism without international citizenship is a recipe for the erosion of democracy. [3] Or, at least, the Internet of countries that don't have restrictive national censorship policies [4] In your specific example, the EU Commission ruled that Japan's data protection law is adequate... but it's not entirely GDPR. And the EU Commission are the same people who thought US Privacy Shield was OK. So at this point I'm going to say get a bunch of lawyers if you really need to know the answer to the question of "can I export data here".
phantom784 5y ago
What if an American is traveling in Europe and makes a post? Or a European is in America? What if they actually moved and aren't just traveling?

eointierney 5y ago

Data is stored on servers, connected by networks, in various jurisdictions all over the world. If a company wants to operate in a jurisdiction it _must_ comply with the laws of said jurisdiction. If the company chooses not to comply the jurisdiction can impose fines, seek injunctions, pursue criminal trials, etc. That's how it works. As a scientist I find regulatory over-reach tedious. As a citizen I find corporate illegality unjustifiable. This is not regulatory over-reach this is corporate illegality.

gowld 5y ago
How can a corporation "protect European data from US access" when a European intentionally requests the corporation to publish the data to a US audience? How can anyone be legal, when the laws of different countries are in conflict?
- dathinab 5y ago
  If you ask specific data to be transferred to the US it can be transferred to the US. But the profile a companies creates about you, your phone number for 2FA, (group) chats local to the EU, etc. do not fall under this. Though I'm not sure about public profiles, probably you also should probably be able to select to not share you public profile with the US.

BrentOzar 5y ago

In the case of a thick client app: > if user A living in France makes a post The post data would be stored on a server in France. > a user B living in America comments on it The user B's thick client app would have to query all servers all over the world that might hold data they're allowed to see, and then render it. It's up to the servers in each country to decide whether the post should be sent to the viewer in question. When User B comments, their comment would be stored on a server in the US. For User A to see the comment, like User B, they would need to connect to all servers in all countries to fetch what data they're allowed to see. Is this cheap and practical? Of course not. But it's possible, just not in the sense we've come to know social media apps.

TekMol 5y ago
When User B comments, their comment would be stored on a server in the US. For User A to see the comment, like User B, they would need to connect to all servers in all countries to fetch what data they're allowed to see. Since A is in France, how would the server of User B - who is in the USA - know what A is allowed to see? If no data about user A is allowed to be stored in the USA, the server in the USA can not know who A is and what they are allowed to see.
- egeozcan 5y ago
  > If no data about user A is allowed to be stored in the USA, the server in the USA can not know who A is IANAL, but to my best knowledge, holding one-off data in memory is repeatedly defended in European courts as not storing data. This is from the top of my head, so treat it as "probably wrong". All in all, the whole thing is a bit of a circus, really.
  - TekMol 5y ago
    How does "one-off data in memory" come into play here?
sandworm101 5y ago
It doesn't need to be nearly that complicated. You never need to query every server. The post stays on the server for the poster's country. Every comment attached to that post gets an anonymous number/tag (this already exists). So each post is stored as a post and an associated list of numbers/tags for comments. When rendering, the user's system fetches the post, gets the list of comment numbers, and pulls the comments from the various country-specific servers. The servers in each country take the incoming request and decide whether the data can be sent to the requesting country according to their own local rules/laws. This need not be complicated. It can all be handled as basic HTML stuff.
- treis 5y ago
  I don't think this passes. Anonymized post IDs still are information about a person. You can piece together posts & likes and conclude with good accuracy that a specific person is making the post. As an example, if me, My Mom, and my brother's girlfriend all like a post it's likely that my brother made it. That makes those anonymized IDs personal information based on the GPRD definition: “any information” “relating to” “an identified or identifiable” “natural person” https://gdpr.eu/eu-gdpr-personal-data/ https://gdpr.eu/eu-gdpr-personal-data/ Ultimately the problem is that the GDPR is written broadly enough to encompass basically everything.

anonymousab 5y ago

> Could someone explain to me how this should work? I think the general idea is that Facebook and co. will need to spend their lobbying influence and dollars on getting FISA and the CLOUD act changed to allow them to make the necessary privacy and integrity guarantees for the European user data. And/or for the US to make those changes to get or keep the same kind of market access. The former is unlikely at best and the latter would require the kind of "giving in" that the US gov does not like to do. I think continual can kicking or eventual EU capitulation is more likely.

Grollicus 5y ago
How do you think the EU can give in here? They've tried it twice and European courts have decided twice that it's impossible.
- Macha 5y ago
  I mean, the courts have decided it's impossible in the context of current EU laws. The EU could always change those laws. But I think the likelihood of that is low, both because they're for relatively popular (in Europe) goals, even if the malicious compliance outcomes themselves are somewhat unpopular, and just the EU's makeup in general makes it a very slow moving body and it'd be relatively hard to get the agreement to reverse here.
  - Grollicus 5y ago
    Schrems II is based on the argument that there is no due process for EU citizens to even check if data collection in the US is legal. That's a constitutional argument, it doesn't help to change laws. Or, well, as "constitutional" as it can get with the EU.

simion314 5y ago

FB needs to find a reputable country with privacy laws that are valid in EU and that does not have data funnels into state agencies or giant companies, then FB can move everyone data there including US citizens to be always protected. I think Microsoft, Apple and others have done similar think to obtain approval for some of their products so is not something new but FB can decide they can pull out or try to work with the other giants to demand that non-US citizens deserve privacy and basic rights.

lmkg 5y ago
That country is the UK. The EU has an "Adequacy Decision" for the UK, meaning that GDPR does not restrict data transfers to the UK. And the UK's Adequacy Decision for the United States still exists (Schrems II happened after Brexit).
- simion314 5y ago
  EU and other non EU countries will have to check if there is no loophold, I personally don't trust UK , the last shitty thing that comes to mind is their illegal treatment of Assange - it shows to me that UK gov loves(or maybe needs) to sucking up to US.
- petschge 5y ago
  If the UK company leaks all user data to the US, the EU is going to revoke the Adequacy Decision in a couple of years.
- johannes1234321 5y ago
  This depends on how things in UK will develop. There are some powerful actors in the UK who want to weaken those laws. The current legal framework between EU and UK won't work forever (see especially Ireland) and will need changes, one direction or the other.

gowld 5y ago

There is no "should" work. Law is full of contradictions, because law is not science.

kmeisthax 5y ago

Within the EU would be the safest bet. That being said, GDPR isn't purely a data localization law - that's merely an implication of broader data export rules. If a court were to interpret public posts as private information under GDPR, then the solution would be that the user in America doesn't even see the post, because retrieval would count as a data export. However, I'm not sure if this interpretation would fly in court. Most of the Schrems II cases focus around analytics, CDNs, and ad-tracking - i.e. the sort of things that just happen automatically and users don't get a say in[0]. Presumably, if a French user wanted to DM an American[1], whatever data transfers are necessary to send that message along would be legal, but nothing further. So we wouldn't be banning Americans off of Facebook, but Facebook couldn't use US/EU messaging as an excuse to ignore GDPR entirely. GDPR data export rules are not specifically targeted at Americans. They apply to all third countries, America just being one of them. If you pass GDPR in your local law, then unlimited data exports are permitted[4]. However, that would probably require you also have the same data export rules, which would also mean you can't export data to other third countries that don't have them. Furthermore, while I postulated scenarios in which a data export would be necessary in order for the service to work at all, you probably couldn't use those justifications to ship data to arbitrary non-GDPR third-countries. i.e. DMs can flow between America and the EU, but the CDNs probably need to remain in the GDPR-o-sphere or America. That being said, there is the potential for further legal hijinx. If the US absolutely insisted on "privacy is for US citizens only"[2], they could pass contradictory privacy rules that made compliance with GDPR illegal. This would cut the Internet[3] in half, and make it illegal to offer any sort of service in which Americans and Europeans interact. And the US is the king of making economic sanctions watertight - it's our primary engine of soft imperialism. We don't roll tanks, we just make it very painful for any country to trade with you. [0] Unless you maintain a really, really victim-blamey definition of the word "User-Agent" [1] Despite France's stereotypical anglohostility, such people do exist! [2] This is the current operating mode of most intelligence agencies and trade representatives. Internationalism without international citizenship is a recipe for the erosion of democracy. [3] Or, at least, the Internet of countries that don't have restrictive national censorship policies [4] In your specific example, the EU Commission ruled that Japan's data protection law is adequate... but it's not entirely GDPR. And the EU Commission are the same people who thought US Privacy Shield was OK. So at this point I'm going to say get a bunch of lawyers if you really need to know the answer to the question of "can I export data here".

phantom784 5y ago

What if an American is traveling in Europe and makes a post? Or a European is in America? What if they actually moved and aren't just traveling?