4 ms·

With all the "IANAL" answers here, let me give you a different one: if it's viable, I would try to host all data in the EU for all your EU customers regardless

With all the "IANAL" answers here, let me give you a different one: if it's viable, I would try to host all data in the EU for all your EU customers regardless of the legal situation. Because the legal situation is likely to change further - just plain and simple, it's a risk, and if your cost in avoiding that risk is sufficiently low, that might be worth it. And you can advertise it as a benefit to your customers.

oliv__ 5y ago
Yeah, this is probably the most pragmatic answer. It's a pain to implement and only adds more complexity to my setup for a tiny percentage of customers; but on the other hand the more I dig into the answers, the more unclear things get with recent rulings overturning common practices. It's unfortunate that finding the answer to such a simple question seems to require lawyers, especially for a small business like mine. I wish we could protect data and privacy without opening Pandora's box.
- jollybean 5y ago
  Spending a lot of money on something you don't need to do is not 'pragamatic'. "It's unfortunate that finding the answer to such a simple question seems to require lawyers, " Yes, and it's the a problem for the EU. While there is definitely a need to have some kind of regulatory elements in place, the degree of complexity involved creates considerable constraints and overhead for ultimately very little gain. There is probably a version of this legislation, or even better, some kind of 'data treaty' between WTO or OECD nations that makes this work out with a lot less overhead.
  - oliv__ 5y ago
    Whether I "need" it or not depends on how much of my future customer base I estimate will be EU-based. Believe me, I don't think these laws are very well structured (they're not even clear enough that you have to dig through 15 different sources and recent court rulings to figure out what to do) and I don't want to add complexity to my setup, but I am trying to grow my business: if it works out financially with enough new EU customers, then the headache could be worth it.
    - jollybean 5y ago
      "I don't think these laws are very well structured (they're not even clear enough that you have to dig through 15 different sources and recent court rulings to figure out what to do) " "The headache will be worth it" Those are contradictory, which is my point. What if it turns out you really don't need to host your data in the EU? Then it definitely 'will not have been worth it'. Unless there is some timing risk whereby you risk actually damaging your business because you're under threat of service degradation or litigation because you're 'behind the ball' in which case there might be some rationale for doing it ahead of time. We don't even know for sure what bits of data might need to be moved to be compliant, or that the 're-architecture' itself may not be sufficient and will require 'another rearchitecture' ... Do something when it's clear that it needs to be done, otherwise, I don't see how there is any upside at all.
jollybean 5y ago
This is a bit fantastical. Splitting up operations from a single data centre (vast majority of situations) is quite costly and adds a lot of complexity. 'You can advertise to your customers' - except that nobody really cares that much, or at least care enough to the point it makes a difference in terms of purchasing behaviour. I mean - everyone would 'like to know that their data is local' but that does not translate into purchasing behaviour or pricing intent in most cases. Aside from 'real costs' of doing such a thing, opportunity costs are always high. There are always '10 critical things' to work on right now, who has an extra team of Engineers to work on 'maybe it will be useful someday features?'. Finally - it's not a hugely helpful exercise in the end: it doesn't mater that-that much 'where' the data is. People want to know that their data is protected and that's that. So just do that, which everyone should do.
- cuu508 5y ago
  How do you protect customer data from US government if you process it (not just store) in AWS/GCP/Azure?
- eqvinox 5y ago
  > This is a bit fantastical. That's a very generic statement on a situation that can have a zillion factors ;) > 'You can advertise to your customers' - except that nobody really cares that much, I do know quite a bunch of people who care, so "nobody" is demonstrably wrong. That said, the people I associate with tend to be tech-savvy, privacy conscious and have disposable income, so I'll agree it's probably not a large percentage. But I don't know what OP's target audience is either...
  - jollybean 5y ago
    "That's a very generic statement on a situation that can have a zillion factors ;" There is 'one factor' that's relevant, and that is there is no apparent need to move data to the EU, and even not that basis it's not clear if that would be sufficient. The 'factor' is that it's a fuzzy requirement at best that definitely will require investment and opportunity cost. " so "nobody" is demonstrably wrong. " It's besides the point, there are almost 0 products on the market for which 'hosted in EU' will move the needle on customer acquisition. Maybe some SaaS here and there, but even in that case, it would be a feature that could be researched and then one could write a material business case around 'moving it to the EU to acquire customer segment X which is worth $Y in revenue. And that's definitely something that would start coming back from the sales team i.e. 'Big EU Co. asked about this, it's going to be key in the sale' - which is how regular product operations are done. But without needing to do it, it makes little sense.
spiffytech 5y ago
I agree. It makes for good marketing, and it means lower-latency access for European customers. I interpret the law as requiring it anyway, but I view this as carrot-and-stick.
moltke 5y ago
Yup. The spirit of GDPR is "do the right thing."
- IMTDb 5y ago
  The spirit of the GDPR is "do what we think is right even if we don't really understand what you really are doing - we have very fancy principles but no idea how to implement those, so we'll impose a ton of crazy measures hoping to move the needle, and failing miserably". As a European, I don't really care of the spacetime position of the magnetic moment encoding if I clicked in the big red button or not. It does not change anything to my life. What I do care is that my sensitive data are kept securely. And even my government if failing to do that, so before they impose anything to the latest SAAS I subscribed to, they have a ton of work to do in-house. I also care about what people post about me, but GDPR has an exemption for public data, so I am not more protected today than I was yesterday. I am sure someone, somewhere feels all warms and fuzzy about "protecting" the European citizen, but boy did he miss the mark.
  - moltke 5y ago
    >the spacetime position of the magnetic moment encoding if I clicked in the big red button or not. That's not what it's about, it's about weather you consent to third party cookies or not.
toshk 5y ago
The whole situation is confusing for me. We set up a few project with kubernetes clusters for local governments in the Netherlands. They denied DigitalOcean because even though they have servers in Amsterdam, the company is in the US, so we went with a much higher priced custom K8s cluster from a local provider. So not really sure if they were right, but according to them even just having your servers run by a US company is a potential legal risk with GDPR. But at the same time other departments in the same organization run on Azure.
- Gasp0de 5y ago
  Any US based company can be forced to give up the data of European customers and be silent about it (see CLOUD act) so as far as I see it any US based company that adheres to the CLOUD act can not be GDPR compliant.
  - toshk 5y ago
    Yeah that's there arguing as well. Although local govs for some reason have no problem working with Azure. EU cloud hosting companies however are not as mature as the big US players so makes it more of a pain.
devn0ll 5y ago
As I have understood it from a lawyer: US laws require a company to hand over the data wherever the data is located. EU, Japan, whatever. You are a US company, so hand it over. EU law states: EU data shall not leave the EU. Those two bite each other, and the result is that a company can _never_ bow to both laws. So, if EU data must be kept in the EU, choose a (hosting) company with no ties to the US. Vice versa is no problem, the EU law _does_ respect data locality. It is the reason why we had to move away from Hetzner, when they opened a US office/branch. (https://docs.hetzner.com/general/general-terms-and-conditions/data-privacy-faq/#information-about-data-protection-and-our-new-ashburn-location https://docs.hetzner.com/general/general-terms-and-condition... If you require a web hosting company that has absolutely no connections to the USA, then unfortunately, we may no longer be the best choice for you)

oliv__ 5y ago

Yeah, this is probably the most pragmatic answer. It's a pain to implement and only adds more complexity to my setup for a tiny percentage of customers; but on the other hand the more I dig into the answers, the more unclear things get with recent rulings overturning common practices. It's unfortunate that finding the answer to such a simple question seems to require lawyers, especially for a small business like mine. I wish we could protect data and privacy without opening Pandora's box.

jollybean 5y ago
Spending a lot of money on something you don't need to do is not 'pragamatic'. "It's unfortunate that finding the answer to such a simple question seems to require lawyers, " Yes, and it's the a problem for the EU. While there is definitely a need to have some kind of regulatory elements in place, the degree of complexity involved creates considerable constraints and overhead for ultimately very little gain. There is probably a version of this legislation, or even better, some kind of 'data treaty' between WTO or OECD nations that makes this work out with a lot less overhead.
- oliv__ 5y ago
  Whether I "need" it or not depends on how much of my future customer base I estimate will be EU-based. Believe me, I don't think these laws are very well structured (they're not even clear enough that you have to dig through 15 different sources and recent court rulings to figure out what to do) and I don't want to add complexity to my setup, but I am trying to grow my business: if it works out financially with enough new EU customers, then the headache could be worth it.
  - jollybean 5y ago
    "I don't think these laws are very well structured (they're not even clear enough that you have to dig through 15 different sources and recent court rulings to figure out what to do) " "The headache will be worth it" Those are contradictory, which is my point. What if it turns out you really don't need to host your data in the EU? Then it definitely 'will not have been worth it'. Unless there is some timing risk whereby you risk actually damaging your business because you're under threat of service degradation or litigation because you're 'behind the ball' in which case there might be some rationale for doing it ahead of time. We don't even know for sure what bits of data might need to be moved to be compliant, or that the 're-architecture' itself may not be sufficient and will require 'another rearchitecture' ... Do something when it's clear that it needs to be done, otherwise, I don't see how there is any upside at all.

jollybean 5y ago

This is a bit fantastical. Splitting up operations from a single data centre (vast majority of situations) is quite costly and adds a lot of complexity. 'You can advertise to your customers' - except that nobody really cares that much, or at least care enough to the point it makes a difference in terms of purchasing behaviour. I mean - everyone would 'like to know that their data is local' but that does not translate into purchasing behaviour or pricing intent in most cases. Aside from 'real costs' of doing such a thing, opportunity costs are always high. There are always '10 critical things' to work on right now, who has an extra team of Engineers to work on 'maybe it will be useful someday features?'. Finally - it's not a hugely helpful exercise in the end: it doesn't mater that-that much 'where' the data is. People want to know that their data is protected and that's that. So just do that, which everyone should do.

cuu508 5y ago
How do you protect customer data from US government if you process it (not just store) in AWS/GCP/Azure?
eqvinox 5y ago
> This is a bit fantastical. That's a very generic statement on a situation that can have a zillion factors ;) > 'You can advertise to your customers' - except that nobody really cares that much, I do know quite a bunch of people who care, so "nobody" is demonstrably wrong. That said, the people I associate with tend to be tech-savvy, privacy conscious and have disposable income, so I'll agree it's probably not a large percentage. But I don't know what OP's target audience is either...
- jollybean 5y ago
  "That's a very generic statement on a situation that can have a zillion factors ;" There is 'one factor' that's relevant, and that is there is no apparent need to move data to the EU, and even not that basis it's not clear if that would be sufficient. The 'factor' is that it's a fuzzy requirement at best that definitely will require investment and opportunity cost. " so "nobody" is demonstrably wrong. " It's besides the point, there are almost 0 products on the market for which 'hosted in EU' will move the needle on customer acquisition. Maybe some SaaS here and there, but even in that case, it would be a feature that could be researched and then one could write a material business case around 'moving it to the EU to acquire customer segment X which is worth $Y in revenue. And that's definitely something that would start coming back from the sales team i.e. 'Big EU Co. asked about this, it's going to be key in the sale' - which is how regular product operations are done. But without needing to do it, it makes little sense.

spiffytech 5y ago

I agree. It makes for good marketing, and it means lower-latency access for European customers. I interpret the law as requiring it anyway, but I view this as carrot-and-stick.

moltke 5y ago

Yup. The spirit of GDPR is "do the right thing."

IMTDb 5y ago
The spirit of the GDPR is "do what we think is right even if we don't really understand what you really are doing - we have very fancy principles but no idea how to implement those, so we'll impose a ton of crazy measures hoping to move the needle, and failing miserably". As a European, I don't really care of the spacetime position of the magnetic moment encoding if I clicked in the big red button or not. It does not change anything to my life. What I do care is that my sensitive data are kept securely. And even my government if failing to do that, so before they impose anything to the latest SAAS I subscribed to, they have a ton of work to do in-house. I also care about what people post about me, but GDPR has an exemption for public data, so I am not more protected today than I was yesterday. I am sure someone, somewhere feels all warms and fuzzy about "protecting" the European citizen, but boy did he miss the mark.
- moltke 5y ago
  >the spacetime position of the magnetic moment encoding if I clicked in the big red button or not. That's not what it's about, it's about weather you consent to third party cookies or not.

toshk 5y ago

The whole situation is confusing for me. We set up a few project with kubernetes clusters for local governments in the Netherlands. They denied DigitalOcean because even though they have servers in Amsterdam, the company is in the US, so we went with a much higher priced custom K8s cluster from a local provider. So not really sure if they were right, but according to them even just having your servers run by a US company is a potential legal risk with GDPR. But at the same time other departments in the same organization run on Azure.

Gasp0de 5y ago
Any US based company can be forced to give up the data of European customers and be silent about it (see CLOUD act) so as far as I see it any US based company that adheres to the CLOUD act can not be GDPR compliant.
- toshk 5y ago
  Yeah that's there arguing as well. Although local govs for some reason have no problem working with Azure. EU cloud hosting companies however are not as mature as the big US players so makes it more of a pain.

devn0ll 5y ago

As I have understood it from a lawyer: US laws require a company to hand over the data wherever the data is located. EU, Japan, whatever. You are a US company, so hand it over. EU law states: EU data shall not leave the EU. Those two bite each other, and the result is that a company can _never_ bow to both laws. So, if EU data must be kept in the EU, choose a (hosting) company with no ties to the US. Vice versa is no problem, the EU law _does_ respect data locality. It is the reason why we had to move away from Hetzner, when they opened a US office/branch. (https://docs.hetzner.com/general/general-terms-and-conditions/data-privacy-faq/#information-about-data-protection-and-our-new-ashburn-location https://docs.hetzner.com/general/general-terms-and-condition... If you require a web hosting company that has absolutely no connections to the USA, then unfortunately, we may no longer be the best choice for you)