4 ms·

I don’t think you’re right about that? What I got from the article is that customer data is processed and stored in the EU, it doesn’t go through America. Howev

by yashap 4y ago

I don’t think you’re right about that? What I got from the article is that customer data is processed and stored in the EU, it doesn’t go through America. However, static assets are downloaded from CDNs operated by American companies (CloudFlare/Amazon/Fastly). > The data protection authority justified this with the fact that US authorities could access personal data (probably primarily the IP address) for criminal purposes on the basis of the CLOUD Act, among other things. This occurs regardless of whether data is stored on servers in the USA or Europe. I have to imagine the particular bureaucrats the author was dealing with are somehow wrong here? Otherwise this implies that a European business cannot use basically any American software (directly or even indirectly, like this case), even if that software fully conforms with processing and storing all data in Europe. The fact that American authorities could coerce any American company into turning data over, even if it’s stored in Europe, is enough?

luckylion 4y ago
> I don’t think you’re right about that? What I got from the article is that customer data is processed and stored in the EU, it doesn’t go through America. However, static assets are downloaded from CDNs operated by American companies (CloudFlare/Amazon/Fastly). From what I can tell, Shopify itself uses Cloudflare, so your domain that is connected to Shopify is passing all the traffic through Cloudflare, e.g. one of the other examples in the screenshot: https://www.distortedpeople.com/ https://www.distortedpeople.com/ The site is on CF (and it sets like 10 cookies, including tracking cookies, pre consent, so any dreams of compliance are gone either way), and, as far as I can tell, that's the case with all Shopify shops (but I've only ever looked into that from an outsider's perspective, maybe that's optional).
- abliefern 4y ago
  The article quotes Shopify explicitly saying otherwise.
  - luckylion 4y ago
    Maybe they're doing something special on checkout? The main sites (including their own) are obviously using CF as a CDN not just for static assets, but for document requests as well.
formerly_proven 4y ago
> I don’t think you’re right about that? What I got from the article is that customer data is processed and stored in the EU, it doesn’t go through America. However, static assets are downloaded from CDNs operated by American companies (CloudFlare/Amazon/Fastly). This doesn't matter, EU sites have been getting fined for some time now for using CDNs like this, most popularly Google Fonts.
- dmix 4y ago
  Regulators focusing on the important stuff once again. I guess if you fear Quantum inserts it might have some privacy/security gains.
  - nolok 4y ago
    You are allowed to dismiss your right to privacy is you so desire but the majority of EU citizens have decided not to.
    - nickpp 4y ago
      We've actually never been asked. Some unelected bureaucrats decided "for our own good".
      - nolok 4y ago
        They're elected representative. You were asked in the most official way possible, with elections. Both in your national election which then decided the government which chose your country EU representative for the council and commission, which then created the law and decided to put it to a vote and where your government had a direct veto right, and in the European election where you elected the parliament that voted on the GDPR. I recommend you inform yourself on the institution that govern you and how you can influence them, you seem to be deeply uneducated about them.
        deleted 4y ago
        [deleted]
Hanschri 4y ago
It is correct that the CLOUD Act complicates things, the issue is that servers located within the EU operated by American companies have some form of remote access to the hypervisor, meaning US intelligence agencies can compel these companies to hand over data and encryption keys for the data, even if it's physically located within the EU/EEA. Before the Schrems II judgement[0] by the European Court of Justice, companies in the US could use the EU-US Privacy Shield[1] to ensure adequate protection of EU personal data. The Privacy Shield agreement replaced and improved upon it's predecessor, the Safe Harbor agreement, which was invalidated by the Schrems 1 case. Transfers between the EU and US can still be legal, as long as standard contractual clauses (SCC), although this requires more effort after the Schrems II case than before. Companies are now required to verify the privacy protection in the recipient country in order to use the SCCs. The first source provided gives insight into what is required by US companies to comply with GDPR when tranferring personal data to third countries. As an anecdote, a guest lecturer for a masters course I took this semester mentioned in passing that transfers to the US are almost as bad as transferring personal data into China. [0]: https://www.gdprsummary.com/schrems-ii/ https://www.gdprsummary.com/schrems-ii/ [1]: https://www.gdprsummary.com/gdpr-definitions/privacy-shield/ https://www.gdprsummary.com/gdpr-definitions/privacy-shield/

by yashap 4y ago

luckylion 4y ago

> I don’t think you’re right about that? What I got from the article is that customer data is processed and stored in the EU, it doesn’t go through America. However, static assets are downloaded from CDNs operated by American companies (CloudFlare/Amazon/Fastly). From what I can tell, Shopify itself uses Cloudflare, so your domain that is connected to Shopify is passing all the traffic through Cloudflare, e.g. one of the other examples in the screenshot: https://www.distortedpeople.com/ https://www.distortedpeople.com/ The site is on CF (and it sets like 10 cookies, including tracking cookies, pre consent, so any dreams of compliance are gone either way), and, as far as I can tell, that's the case with all Shopify shops (but I've only ever looked into that from an outsider's perspective, maybe that's optional).

abliefern 4y ago
The article quotes Shopify explicitly saying otherwise.
- luckylion 4y ago
  Maybe they're doing something special on checkout? The main sites (including their own) are obviously using CF as a CDN not just for static assets, but for document requests as well.

formerly_proven 4y ago

dmix 4y ago
Regulators focusing on the important stuff once again. I guess if you fear Quantum inserts it might have some privacy/security gains.
- nolok 4y ago
  You are allowed to dismiss your right to privacy is you so desire but the majority of EU citizens have decided not to.
  - nickpp 4y ago
    We've actually never been asked. Some unelected bureaucrats decided "for our own good".
    - nolok 4y ago
      They're elected representative. You were asked in the most official way possible, with elections. Both in your national election which then decided the government which chose your country EU representative for the council and commission, which then created the law and decided to put it to a vote and where your government had a direct veto right, and in the European election where you elected the parliament that voted on the GDPR. I recommend you inform yourself on the institution that govern you and how you can influence them, you seem to be deeply uneducated about them.
      - deleted 4y ago
        [deleted]

Hanschri 4y ago

It is correct that the CLOUD Act complicates things, the issue is that servers located within the EU operated by American companies have some form of remote access to the hypervisor, meaning US intelligence agencies can compel these companies to hand over data and encryption keys for the data, even if it's physically located within the EU/EEA. Before the Schrems II judgement[0] by the European Court of Justice, companies in the US could use the EU-US Privacy Shield[1] to ensure adequate protection of EU personal data. The Privacy Shield agreement replaced and improved upon it's predecessor, the Safe Harbor agreement, which was invalidated by the Schrems 1 case. Transfers between the EU and US can still be legal, as long as standard contractual clauses (SCC), although this requires more effort after the Schrems II case than before. Companies are now required to verify the privacy protection in the recipient country in order to use the SCCs. The first source provided gives insight into what is required by US companies to comply with GDPR when tranferring personal data to third countries. As an anecdote, a guest lecturer for a masters course I took this semester mentioned in passing that transfers to the US are almost as bad as transferring personal data into China. [0]: https://www.gdprsummary.com/schrems-ii/ https://www.gdprsummary.com/schrems-ii/ [1]: https://www.gdprsummary.com/gdpr-definitions/privacy-shield/ https://www.gdprsummary.com/gdpr-definitions/privacy-shield/