3 ms·

The EU solution for that is specific 'data processor' agreements where (a) they process the data on your behalf; (b) they don't gain any permission whatsoever t

The EU solution for that is specific 'data processor' agreements where (a) they process the data on your behalf; (b) they don't gain any permission whatsoever to use that data for their own purposes, only what you ask them to do; (c) they only have the right to do with that data the same things you are permitted to do; (d) you have to inform users (but not necessarily get consent) of all the processors which are handling their data; (e) you're fully responsible for what the processor does with that data. Reasonable cloud providers like Saleforce, Splunk (and pretty much all others which do business in EU) all have adapted to GDPR and will give contractual guarantees that they'll do everything properly but it's up to you to pick providers which will actually uphold that contract.

flakeoil 3y ago
It sounds nice in theory and in legal words, but in practice it's very hard to control that it works and that everyone follows this. You can just think of how complex it is from a technical perspective to implement this. Sync all those systems, databases and vendors if a user on my website deletes his data or account. And in case one of those vendors or sub vendors fail to delete (let's say their API responds with an error or I had implemented it wrong or it stopped working due to an API change). It gets hairy quite fast.
- PeterisP 3y ago
  It's not simple, but also from the technical and business process perspective it's mostly a solved problem, all the international cloud B2B services know how to handle that for their customers. I mean, that's not theory or some hypothetical proposal, that's the established practice of how handling private data works for more than 5 years for almost half a billion people and all the businesses in EU; that's how (for example) Salesforce works with all the many EU companies handling data in Salesforce systems. In general, the process for handling actual business data for all kinds of companies from manufacturing to retail is quite clear, and the only disputes we see are for the (relatively few) global online consumer service companies handling the exploitation of online customer data. If you're e.g. a flower shop (even with online ordering) or a dental clinic (even with online appointments) and you don't want to explicitly stretch the limits with some shenanigans, then you just follow the same standard practices as all other shops in your country, all while using whatever online services you need - it's very rare that some global B2B service doesn't handle GDPR compliance, all that I wrote above is what almost every cloud company will do for you because they do that for so many customers for years already.
johndhi 3y ago
Point d is not true. If you hire Salesforce you generally disclose to your users that you use Salesforce. But you don't tell them all of Salesforce's processors, and all of their professors, and so on down the infinite loop. Edit: also the original comment was seeking consent, presumably affirmative. The GDPR system is a model that only provides (some but not all) notice, not affirmative consent.

flakeoil 3y ago

It sounds nice in theory and in legal words, but in practice it's very hard to control that it works and that everyone follows this. You can just think of how complex it is from a technical perspective to implement this. Sync all those systems, databases and vendors if a user on my website deletes his data or account. And in case one of those vendors or sub vendors fail to delete (let's say their API responds with an error or I had implemented it wrong or it stopped working due to an API change). It gets hairy quite fast.

PeterisP 3y ago
It's not simple, but also from the technical and business process perspective it's mostly a solved problem, all the international cloud B2B services know how to handle that for their customers. I mean, that's not theory or some hypothetical proposal, that's the established practice of how handling private data works for more than 5 years for almost half a billion people and all the businesses in EU; that's how (for example) Salesforce works with all the many EU companies handling data in Salesforce systems. In general, the process for handling actual business data for all kinds of companies from manufacturing to retail is quite clear, and the only disputes we see are for the (relatively few) global online consumer service companies handling the exploitation of online customer data. If you're e.g. a flower shop (even with online ordering) or a dental clinic (even with online appointments) and you don't want to explicitly stretch the limits with some shenanigans, then you just follow the same standard practices as all other shops in your country, all while using whatever online services you need - it's very rare that some global B2B service doesn't handle GDPR compliance, all that I wrote above is what almost every cloud company will do for you because they do that for so many customers for years already.

johndhi 3y ago

Point d is not true. If you hire Salesforce you generally disclose to your users that you use Salesforce. But you don't tell them all of Salesforce's processors, and all of their professors, and so on down the infinite loop. Edit: also the original comment was seeking consent, presumably affirmative. The GDPR system is a model that only provides (some but not all) notice, not affirmative consent.