3 ms·
Are you saying there is no way to use AWS and be GDPR compliant? Or the way that OP is using AWS isn't GDPR compliant?
by neom 4y ago
Are you saying there is no way to use AWS and be GDPR compliant? Or the way that OP is using AWS isn't GDPR compliant?
- arlcode 4y agoIANAL but as I understand it there is, currently, no way to legally use a service for personal data handling that falls under the US CLOUD act. In theory Amazon could license their brand and software to an independent (!) European company to offer a EU-AWS. Basically if an American judge/agency can order Amazon to hand over European private data and they have the ability to comply without involving a European court the service is not GDPR compliment. Now in practice this isn't how things are done but to the best of my knowledge the law hasn't changed (yet) and national dpas are starting to tighten the screws (slowly). If I recall correctly there are EU-US talks to create Privacy Shield #3.
- openplatypus 4y agoThere is a way to use AWS assuming you can assure no Personal Data is processed in plain text on AWS. There was a case of Doctolib in the EU. French authority investigated Doctlib for using AWS. They got off the hook because data was encrypted in the EU, outside of AWS and the encryption keys were inaccessible to AWS. Similarly Sendinblue uses GCP and AWS as dumb storage of externally encrypted backups. There are valid use cases. But these are very limited.
- ochrist 4y agoAula - a system used for communication between parents and schools in Denmark - is using AWS. They use encryption and ensures that only European datacenters are used. Source (in Danish): https://aulainfo.dk/guide-til-projektledere/sikkerhed-i-aula/ https://aulainfo.dk/guide-til-projektledere/sikkerhed-i-aula...