3 ms·

I've been looking into this for my app. There's a lot of outdated or misinformed opinions out there (any info from before Schrems II in July 2020 should be igno

I've been looking into this for my app. There's a lot of outdated or misinformed opinions out there (any info from before Schrems II in July 2020 should be ignored), but here's what I've concluded: At this time, it looks like it's probably not legal to routinely store European data in the US under GDPR. There are limited exceptions (see below), but I don't think you can just host everything in the US. GDPR requires you to only transfer (i.e., hosting, also viewing) European data to places with GDPR-equivalent data rights. Initially, the US qualified under Safe Harbor, but that was invalidated with the Schrems I ruling. Then the US qualified under Privacy Shield, but that was invalidated in Schrems II. The guidance from the European Data Protection Board following Schrems II is more or less this: - You may transfer data to the a country not officially recognized as GDPR-compliant (a "third country") if the transfer is necessary to do what your customers asked you to do. But only if the transfer is occasional, and objectively necessary. - You can transfer if the user gives you consent, but consent can only be granted for specific transfers. You can't ask for perpetual consent to host everything in the US. Consent must also be explicit (an obvious, opt-in checkbox, not a EULA), and the user must be informed about the risks of sending data to America. - Transfers under SCCs & BCRs are still valid in principle, but only if you confirm the destination country has GDPR-equivalent data rights. If they don't (which America doesn't right now), you can transfer only if you take measures to counter the risk of government interference, and only if the government can't subvert those measures (including by court order). Schrems II is also widely interpreted as forbidding "sign & forget" - you can't delegate your responsibility to certify the safety customer data to your cloud vendors. EDPB FAQ on Schrems II: https://edpb.europa.eu/sites/default/files/files/file1/20200724_edpb_faqoncjeuc31118_en.pdf https://edpb.europa.eu/sites/default/files/files/file1/20200... Article describing the impact of Schrems II: https://www.lexology.com/library/detail.aspx?g=86e3448e-2f32-4614-9190-8cf2e6a6d8e8 https://www.lexology.com/library/detail.aspx?g=86e3448e-2f32...

squinta 5y ago
This is one of the best answers I've read to this question. It's not only the Cloud act but also the FISA act and the executive order nr.12333 The EU data protection head has made it clear that Standard Contractual Clauses do not suffice, as a workaround. EU and US administrations are trying to work out a working compromise, but no progress yet (and frankly, not likely to happen soon, as there are more relevant priorities) Courts are slow, but they are starting to affirm the EU law. For example, the Austrian Data Protection Authority (DSB) ruled that the use of Google Analytics and thetransfer of personal data to the US violates the GDPR. the French data protection authority (CNIL) also confirmed that these personal data transfers to the US are a violation of the GDPR. These are the first decisions from EU data protection authorities in response to 101 complaints filed by https://noyb.eu/en https://noyb.eu/en , so more to follow... Quite obviously, the same principle applies to any service that sends data to the US. (for example, fonts can be used to track user; IMHO push notifications might be next, because, even if encrypted, provide data^Hmetadata that combined with other data reveal a lot about users behaviour...) The Portuguese Data Protection Authority ruled re. data processing carried out by Cloudflare for the Portuguese National Statistics Institute. Cloudflare declared to use its own servers in the European Union, but CNPD noted that Cloudflare had data centers all over the world and there was no evidence that, in the event of an emergency situation or legal order, personal data could not be transferred outside the EU in jurisdictions that don't provide equivalent protections. The CNPD had ordered the immediate suspension of data flows to the United States despite the adoption of the standard contractual clauses. Expect more of these decisions in the coming months.

squinta 5y ago

This is one of the best answers I've read to this question. It's not only the Cloud act but also the FISA act and the executive order nr.12333 The EU data protection head has made it clear that Standard Contractual Clauses do not suffice, as a workaround. EU and US administrations are trying to work out a working compromise, but no progress yet (and frankly, not likely to happen soon, as there are more relevant priorities) Courts are slow, but they are starting to affirm the EU law. For example, the Austrian Data Protection Authority (DSB) ruled that the use of Google Analytics and thetransfer of personal data to the US violates the GDPR. the French data protection authority (CNIL) also confirmed that these personal data transfers to the US are a violation of the GDPR. These are the first decisions from EU data protection authorities in response to 101 complaints filed by https://noyb.eu/en https://noyb.eu/en , so more to follow... Quite obviously, the same principle applies to any service that sends data to the US. (for example, fonts can be used to track user; IMHO push notifications might be next, because, even if encrypted, provide data^Hmetadata that combined with other data reveal a lot about users behaviour...) The Portuguese Data Protection Authority ruled re. data processing carried out by Cloudflare for the Portuguese National Statistics Institute. Cloudflare declared to use its own servers in the European Union, but CNPD noted that Cloudflare had data centers all over the world and there was no evidence that, in the event of an emergency situation or legal order, personal data could not be transferred outside the EU in jurisdictions that don't provide equivalent protections. The CNPD had ordered the immediate suspension of data flows to the United States despite the adoption of the standard contractual clauses. Expect more of these decisions in the coming months.