6 ms·

Legally or due to your privacy concerns? Just looking for clarification on your statement of "Can't" if that is a personal preference or legal obligation for g

by mey 13y ago

Legally or due to your privacy concerns? Just looking for clarification on your statement of "Can't" if that is a personal preference or legal obligation for government/corporations doing business locally.

SpikeGronim 13y ago
Legally, due to the EU Data Protection Directive. It's a legal obligation.
nisa 13y ago
Legal concerns. I'm not a lawyer but there are quite strict rules. Here is an example based on Google Analytics (first Google hit): http://www.searchlaboratory.com/blog/2013/06/germanys-data-protection-laws/ http://www.searchlaboratory.com/blog/2013/06/germanys-data-p...
Silhouette 13y ago
There is a general, Europe-wide restriction on exporting personal data outside of the EEA to somewhere that doesn't provide an acceptable level of protection (which by default the United States does not). There is also a Safe Harbor scheme that is intended to overcome this problem so working with US businesses is still possible if they provide additional safeguards. However, it's now clear that no business operating in the United States can actually offer the required guarantees, no matter how sincerely they might wish to. It is therefore unclear whether a European business relying on Safe Harbor to cover its rear would actually have much of a case in court if one of its customers were actually damaged as a result. I've seen a lot of businesses at least considering pulling out of US services, cloud or otherwise, for this reason in recent months. Some are sticking with it, on the grounds that there is safety in numbers: no government regulator really wants to damage global trade by making examples of businesses who are just trying to do their work and acting in good faith, and if you're dealing with a similarly honest business from the US then the odds of an actual customer complaint are probably low enough that it might be considered an acceptable business risk. Others seem to have lawyers who are more wary and fear the penalties of something like a mass leak across the pond that would come back to bite their clients back home. In addition, some nations in Europe are a lot more concerned about privacy both legally and culturally than the US, for obvious historical reasons if nothing else, and they may have stronger laws still.
- res0nat0r 13y ago
  eu-west-1 is hosted in Dublin.
  - kyrra 13y ago
    My understand is that since Amazon is a US-based company, they could be forced, by the US government, to turn over data that is hosted in other countries. So using an Amazon cloud, even if its based in the EU, is still not possible. EDIT: well, I guess I'm sorta wrong. The whole thing looks complicated. Making sure you don't violate German data protection laws is confusing [0][1]. [0] http://www.thomashelbing.com/en/analysis-data-protection-authority-use-non-eu-cloud-might-violate-german-data-protection-law http://www.thomashelbing.com/en/analysis-data-protection-aut... [1] http://blogs.computerworlduk.com/cloud-vision/2012/04/cloud-computing-and-eu-data-protection-law-part-two/index.htm http://blogs.computerworlduk.com/cloud-vision/2012/04/cloud-...
    - toyg 13y ago
      You are not wrong: Amazon now agrees not to move data from EU servers... unless compelled by authorities. US authorities can force Amazon to open their data centres wide open, regardless of location, at any time under Patriot Act provisions. Before Snowden, this was considered a far-fetched scenario, unlikely to ever pan out in practice. We now know that it happens pretty much every day. The Safe Harbour program is a weak attempt at saving face: as long as the Patriot Act exists, no US-based company will ever be able to comply with EU privacy laws as they stand. Being "compliant with Safe Harbour provisions" only means that they're making promises they won't be able to keep.
  - toomuchtodo 13y ago
    The company, directors, ands staff must reside outside of US jurisdiction, not just the equipment.
- bdunbar 13y ago
  > There is also a Safe Harbor scheme that is intended to overcome this problem so working with US businesses is still possible if they provide additional safeguards. However, it's now clear that no business operating in the United States can actually offer the required guarantees, no matter how sincerely they might wish to. Can you provide more data on that? I'm 'only' a system administrator, but I'm working for a company that is doing business in the both US and UK. Real Soon now we're going to be standing up a stack in the UK .. but I'd like to know what safeguards I can't guarantee so when I'm dealing with _two_ data sets and _two_ code bases and squared complexity I know _why_. It will help at 3 a.m.

by mey 13y ago

SpikeGronim 13y ago

Legally, due to the EU Data Protection Directive. It's a legal obligation.

nisa 13y ago

Legal concerns. I'm not a lawyer but there are quite strict rules. Here is an example based on Google Analytics (first Google hit): http://www.searchlaboratory.com/blog/2013/06/germanys-data-protection-laws/ http://www.searchlaboratory.com/blog/2013/06/germanys-data-p...

Silhouette 13y ago

There is a general, Europe-wide restriction on exporting personal data outside of the EEA to somewhere that doesn't provide an acceptable level of protection (which by default the United States does not). There is also a Safe Harbor scheme that is intended to overcome this problem so working with US businesses is still possible if they provide additional safeguards. However, it's now clear that no business operating in the United States can actually offer the required guarantees, no matter how sincerely they might wish to. It is therefore unclear whether a European business relying on Safe Harbor to cover its rear would actually have much of a case in court if one of its customers were actually damaged as a result. I've seen a lot of businesses at least considering pulling out of US services, cloud or otherwise, for this reason in recent months. Some are sticking with it, on the grounds that there is safety in numbers: no government regulator really wants to damage global trade by making examples of businesses who are just trying to do their work and acting in good faith, and if you're dealing with a similarly honest business from the US then the odds of an actual customer complaint are probably low enough that it might be considered an acceptable business risk. Others seem to have lawyers who are more wary and fear the penalties of something like a mass leak across the pond that would come back to bite their clients back home. In addition, some nations in Europe are a lot more concerned about privacy both legally and culturally than the US, for obvious historical reasons if nothing else, and they may have stronger laws still.

res0nat0r 13y ago
eu-west-1 is hosted in Dublin.
- kyrra 13y ago
  My understand is that since Amazon is a US-based company, they could be forced, by the US government, to turn over data that is hosted in other countries. So using an Amazon cloud, even if its based in the EU, is still not possible. EDIT: well, I guess I'm sorta wrong. The whole thing looks complicated. Making sure you don't violate German data protection laws is confusing [0][1]. [0] http://www.thomashelbing.com/en/analysis-data-protection-authority-use-non-eu-cloud-might-violate-german-data-protection-law http://www.thomashelbing.com/en/analysis-data-protection-aut... [1] http://blogs.computerworlduk.com/cloud-vision/2012/04/cloud-computing-and-eu-data-protection-law-part-two/index.htm http://blogs.computerworlduk.com/cloud-vision/2012/04/cloud-...
  - toyg 13y ago
    You are not wrong: Amazon now agrees not to move data from EU servers... unless compelled by authorities. US authorities can force Amazon to open their data centres wide open, regardless of location, at any time under Patriot Act provisions. Before Snowden, this was considered a far-fetched scenario, unlikely to ever pan out in practice. We now know that it happens pretty much every day. The Safe Harbour program is a weak attempt at saving face: as long as the Patriot Act exists, no US-based company will ever be able to comply with EU privacy laws as they stand. Being "compliant with Safe Harbour provisions" only means that they're making promises they won't be able to keep.
- toomuchtodo 13y ago
  The company, directors, ands staff must reside outside of US jurisdiction, not just the equipment.
bdunbar 13y ago
> There is also a Safe Harbor scheme that is intended to overcome this problem so working with US businesses is still possible if they provide additional safeguards. However, it's now clear that no business operating in the United States can actually offer the required guarantees, no matter how sincerely they might wish to. Can you provide more data on that? I'm 'only' a system administrator, but I'm working for a company that is doing business in the both US and UK. Real Soon now we're going to be standing up a stack in the UK .. but I'd like to know what safeguards I can't guarantee so when I'm dealing with _two_ data sets and _two_ code bases and squared complexity I know _why_. It will help at 3 a.m.