2

I work for a small non-EU company1 on projects of a British company2 which rents out houses.

All the live databases3 are located in the UK on their premises and we access those databases and servers only for deploying new codebase.

The data that they collect (With consent of their employees and customers) contains:

  1. Firstname, lastname, phone numbers, emails, gender, sexual orientation, race, religion etc
  2. Criminal and/or Abusive records
  3. Disability records
  4. Employment Records
  5. Income

Also, they do not delete the data of previous customers. The former customers remain in the records as "Prospective Customers".

We could access all that data on the live server if we wanted to, using our deployment accounts but we usually don't unless there's a live issue and we have to access the logs etc for debugging. The bottomline is, we don't collect any data that we store in Asia or our local databases. All the data that's gathered is collected by a British firm and saved in British Databases located in Britain.

We get paid for deploying our codebase to the live server but now they have cut off our access to Live Server, citing GDPR which means we can no longer deploy the code on live servers and won't get paid for it.

Are there any provisions in the GDPR for collaboration between EU and non EU companies on projects which handle data of EU citizens? Are there any conditions, meeting which would make us eligible to access the live server with real data of EU citizens?


1. Our 'headquarters' is in VA, USA, quotes because it isn't really our HQ, it's just our Marketing and Business department who get the projects which are then developed in Asia. Our British clients are aware of this arrangement and have been working with us for 11 years now.

2. Semi-Public? They do receive public funding and are owned in part by the government

3. The ones with real data, not the ones with dummy data for testing

Disclaimer: This is an anon account I created specifically for this question. My main profile has information that can be traced back to my workplace and given the government involvement in our partner company, that might be troublesome. Rest assured, I won't be upvoting this via my main profile which doesn't even have a Law SE account.

  • 1
    Better get the financial dept prepared, expect a big fine. Sexual orientation? How the hell did anyone expect that to be legal? – MSalters May 28 '18 at 7:56
  • @MSalters Doubt that we will get fined given that EU has no jurisdiction over us, nor are we the ones who collect and store the data. It's a semi-Public company, the orientation is filled out by prospective tenants themselves when they register because some neighbourhoods aren't just a good match for some orientations. I believe they have similar reasons for recording race and nationality. – EUTouchedMyBaguette May 28 '18 at 8:00
  • And just a disclaimer: I do not support this kind of sexual or ethnic quasi-Apartheid. It's just the way things are in the UK apparently. – EUTouchedMyBaguette May 28 '18 at 8:01
  • The EU has jurisdiction since you store data of EU residents. And the fines can be enforced as you're paid by an EU company; that money can be seized. – MSalters May 28 '18 at 8:57
  • 1
    @MSalters As I said, we are not storing the Data of EU residents. EU nationals are. We neither collect nor store their information, both of which are done by our European partners, in Europe. If they get fined, they will get fined for their own practises, not ours, it won't affect us or our agreement with them at all. They bear the liability for legal consequences of their requirements and practices, not us. This is off-topic anyways, the Question is, if we meet GDPR compliance obligations ourselves, should that be enough for EU authorities? – EUTouchedMyBaguette May 28 '18 at 9:09
1

The GDPR doesn't talk about specific technologies used to access data. You are processing data of EU citizens, which is controlled by a UK company. They of course have their own obligations (as mentioned in the comments). But as a processor, your company needs to follow the GDPR rules. The chief bit here is article 28, which defines what a processor is under GDPR rules.

For instance, the contract with a processor must be subject to the laws of an EU Member State. You stated in the comments you believed you were not subject to those laws. If that indeed is the case, then the UK company is correct, you are not GDPR compliant, and may not access the live server.

To address the specific part of the question about working with non-EU companies: under article 45, it's noted that the EU can designate certain countries which have compatible data protection laws (adequacy decision), but otherwise you'd need article 46 - are there appropriate legal safeguards in your (Asian) country? This is not a question you can answer yourself, it must be answered by the supervisory authority (in the UK: ICO).

  • Cheers for the response (Can't UV, not enough rep), So TLDR Even if we make ourselves GDPR compliant, that won't matter given that our base country doesn't have a shining record on Privacy or Privacy laws. So we won't be able to remotely access the data but that brings us to another point, in order to be GDPR compliant our partners have to introduce proper user control. If they make it so that our Dev can only deploy the code but can't access the data (like they can right now), that would make it legal right given that we are neither collecting, storing, accessing, processing EU data then? – EUTouchedMyBaguette May 28 '18 at 11:01
  • @EUTouchedMyBaguette: Not really off-topic, since the GDPR requires good IT practice, but the best practice is to have multiple environments such as dev, test, acceptance and production. In all environments but production, you run on fake data. Your company would prove the software works by deploying to acceptance environment, where the UK company runs the acceptance tests. Thus, the hand-over point is still using fake data. Since fake data isn't subject to GDPR, you would be entirely safe. – MSalters May 28 '18 at 12:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.