5 ms·

Sadly, ads are not the only thing that is problematic. It's almost impossibke to find something as mundane as an e-mail service that will sign a data processing

Sadly, ads are not the only thing that is problematic. It's almost impossibke to find something as mundane as an e-mail service that will sign a data processing agreement with its customers.

SpicyLemonZest 4y ago
An email service seems like one of the businesses that would be most hesitant to sign such an agreement, given that the service involves sending personal messages with metadata attached in plaintext over the public Internet.
- janosdebugs 4y ago
  Let's put it this way: I've read a whole lot of privacy policies over the last month and, except for one law firm, none of them even mention e-mail. If I was in the questionable business of suing people for this, I'd have a lot to do. E-mail can contain a whole lot of PII and almost nobody gives two flying MIME headers about safeguarding it.
seanhunter 4y ago
I'm not sure it's almost impossible. Let's look at the two biggest email providers out there. 1) GSuite. Here's their data processing terms https://cloud.google.com/terms/data-processing-addendum/index-20220630 https://cloud.google.com/terms/data-processing-addendum/inde... 2) Office365. Here you go https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA?lang=1 https://www.microsoft.com/licensing/docs/view/Microsoft-Prod... So both of them will absolutely sign one. Maybe you don't like google and microsoft. Let's look at some others. What about Fastmail? https://www.fastmail.help/hc/en-us/articles/6049922252943-Fastmail-Data-Protection-Policy https://www.fastmail.help/hc/en-us/articles/6049922252943-Fa... Basically any legitimate email service will sign a gdpr-compliant data processing agreement as far as I can see. Certainly all the ones I have ever used do.
- janosd 4y ago
  All of these are US companies, in which case the GDPR explicitly states that I need to have additional contractual clauses to transfer the data to the US, which would be nice to avoid. Furthermore, recent court decisions have stated that I, as the data controller, need to take additional technical measures to protect the data being transfered... which I'm supposed to do how exactly with e-mail?
okamiueru 4y ago
What kind of agreement are you after? Does not the likes of protonmail suit your needs?
- janosdebugs 4y ago
  It's called a data processing agreement, where the data controller and data processor have an agreement how personally identifiable data is to be handled exactly. Protonmail is no exception to this as they still have access to unencrypted PII when they receive mail over SMTP.

Sadly, ads are not the only thing that is problematic. It's almost impossibke to find something as mundane as an e-mail service that will sign a data processing agreement with its customers.

SpicyLemonZest 4y ago

An email service seems like one of the businesses that would be most hesitant to sign such an agreement, given that the service involves sending personal messages with metadata attached in plaintext over the public Internet.

janosdebugs 4y ago
Let's put it this way: I've read a whole lot of privacy policies over the last month and, except for one law firm, none of them even mention e-mail. If I was in the questionable business of suing people for this, I'd have a lot to do. E-mail can contain a whole lot of PII and almost nobody gives two flying MIME headers about safeguarding it.

seanhunter 4y ago

I'm not sure it's almost impossible. Let's look at the two biggest email providers out there. 1) GSuite. Here's their data processing terms https://cloud.google.com/terms/data-processing-addendum/index-20220630 https://cloud.google.com/terms/data-processing-addendum/inde... 2) Office365. Here you go https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA?lang=1 https://www.microsoft.com/licensing/docs/view/Microsoft-Prod... So both of them will absolutely sign one. Maybe you don't like google and microsoft. Let's look at some others. What about Fastmail? https://www.fastmail.help/hc/en-us/articles/6049922252943-Fastmail-Data-Protection-Policy https://www.fastmail.help/hc/en-us/articles/6049922252943-Fa... Basically any legitimate email service will sign a gdpr-compliant data processing agreement as far as I can see. Certainly all the ones I have ever used do.

janosd 4y ago
All of these are US companies, in which case the GDPR explicitly states that I need to have additional contractual clauses to transfer the data to the US, which would be nice to avoid. Furthermore, recent court decisions have stated that I, as the data controller, need to take additional technical measures to protect the data being transfered... which I'm supposed to do how exactly with e-mail?

okamiueru 4y ago

What kind of agreement are you after? Does not the likes of protonmail suit your needs?

janosdebugs 4y ago
It's called a data processing agreement, where the data controller and data processor have an agreement how personally identifiable data is to be handled exactly. Protonmail is no exception to this as they still have access to unencrypted PII when they receive mail over SMTP.