Law Stack Exchange is a question and answer site for legal professionals, students, and others with experience or interest in law. It only takes a minute to sign up.
Sign up to join this community
We are a company based in India and are frequently being visited by people from overseas.
Due to the recent safe harbour developments, are we allowed store data of EU-citizens on a cloud server located in the US? (like passport copies and other sensitive data)
Your comments wonder if it's also illegal for an Indian company. The answer is simple: EU rules do not have any exception that would make it legal for you.
This isn't a big surprise as it would open a trivial loophole; any company would be able to escape the ruling via an Indian subsidiary.
Now the EU rules only apply to export of data originating in the EU. If you collected all data outside the EU and it remains outside the EU, it is not subject to EU rules. (Exempting specific treaties, contracts, etc which say otherwise). You example of EU visitors suggest they visit you in India. That means you did not export their passport data. Indian laws regarding the treatment of personal data of course still apply.
The European privacy laws are only relevant for companies operating in Europe. If you are placed in India (and all customers are aware of this fact), the Indian rules apply.
If you have a branch office operating your business in Europe, the situation changes. The exact answer depends on the country you are operating in. I can give some general informations about the legal situation tough.
In general, the privacy rules of the country where data is stored (also implies stored) has to be equal to the European ones. This is the case for all countries in the European Economic Area. Other additional exceptions may be (depending on country and it's privacy laws):
Scenario 1: If your business relationship is directly with the EU citizens as private individuals, then your Indian company is the Data Controller in this arrangement and the EU citizens are Data Subjects.
At the present time, Indian laws apply in this scenario for your company and there is no question of illegality. To ensure your customer is aware it is wise to be clear about where your business is based and specify in the terms of business that the laws of India apply.
Scenario 2: If your business relationship is with a company/business based (including self-employed individuals) within the EU then your customer is the Data Controller in this arrangement and your Indian company is a Data Processor.
Similarly, at the present time this would also be legal and Indian laws would apply to you. The current EU Data Protection directives as implemented in European countries place legal obligations on the Data Controller only and not on the Data Processor, therefore it is the data controller's responsibility to ensure they comply with their country's national data protection legislation (which will be an implementation of the EU data protection directive). While this shifts the liability from you, it does mean that if you want to accept European companies as customers and the services you provide involve the processing of personal data, then it makes sense to help make sure that it is legal for them to use your Indian company to process their personal data. They will be required by law to ensure they only use data processors that:
(a) are located in a country included in the EU's pre-approved countries list of countries where the EU has made Adequacy Decisions recognising that these countries offer adequate protection and compatible legislation. India is not currently on this list (included in this answer to help other users that may not be based in India):
"The Commission has so far recognized Andorra, Argentina, Canada (commercial organisations), Faeroe Islands, Guernsey, Israel, Isle of Man, Jersey, New Zealand, Switzerland and Uruguay as providing adequate protection." (Source: http://ec.europa.eu/justice/data-protection/international-transfers/adequacy/index_en.htm)
(b) have opted-in to an EU-recognised scheme which places binding rules on the their data processing practices and promises equivalent data protection controls, such as the E.U.-U.S. Privacy Shield (which doesn't apply to you because your company is not based in the U.S., but included in this answer to help other users that may not be based in India):
"The Commission adopted on 12 July 2016 its decision on the EU-U.S. Privacy Shield. This new framework protects the fundamental rights of anyone in the EU whose personal data is transferred to the United States as well as bringing legal clarity for businesses relying on transatlantic data transfers. The new arrangement includes: strong data protection obligations on companies receiving personal data from the EU safeguards on U.S. government access to data; effective protection and redress for individuals; annual joint review to monitor the implementation. The new arrangement lives up to the requirements of the European Court of Justice. On 6 October 2015, the Court of Justice of the European Union had declared the Commission’s 2000 Decision on EU-US Safe Harbour invalid." (Source: http://ec.europa.eu/justice/data-protection/international-transfers/eu-us-privacy-shield/index_en.htm)
(c) have incorporated the Standard Contractual Clauses as specified by the EU (either Set I or Set II, but you can't modify or combine these) into their contracts to ensure they can be held legally liable and accountable for the protection of personal data and any breaches when/if applicable:
"The Council and the European Parliament have given the Commission the power to decide, on the basis of Article 26 (4) of directive 95/46/EC that certain standard contractual clauses offer sufficient safeguards as required by Article 26 (2), that is, they provide adequate safeguards with respect to the protection of the privacy and fundamental rights and freedoms of individuals and as regards the exercise of the corresponding rights. The Commission has so far issued two sets of standard contractual clauses for transfers from data controllers to data controllers established outside the EU/EEA and one set for the transfer to processors established outside the EU/EEA." (Source: http://ec.europa.eu/justice/data-protection/international-transfers/transfer/index_en.htm)
This will change however from May 2018 with the introduction of the EU General Data Protection Regulations (GDPR) which additionally require Data Processors to comply and Data Controllers located outside the EU but processing data on behalf of European citizens to comply:
"EU rules for non-EU companies — companies based outside the EU must apply the same rules when offering services or goods, or monitoring behaviour of individuals within the EU" (Source: http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=LEGISSUM:310401_2&from=EN&isLegissum=true)
See http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN for full GDPR text. Article 3(2a) is where it states "This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union".
According to what I have read about a subject, a company holding data on a server in the USA cannot guarantee that the data will be safe. (They can "guarantee" in the sense that a car manufacturer guarantees that they will pay if your new car breaks down, but they cannot "guarantee" like a car manufacturer cannot give a guarantee that your car won't break down).
Since that company cannot guarantee that the data will be safe, you cannot guarantee that the data will be safe, which may make it illegal for a European company to let you store that data.
Now if you store data for an airport in India, for example, that was collected completely in India, that would probably be a different matter. That would be a matter of Indian law. Whether India allows you to store data of Indian citizens in an unsafe way, I don't know.
Your comment: The EU would not have any power to prosecute a company in India. If the European company didn't know what you were doing, it's quite possible that you would be in breach of contract if you look at the contracts that you have with them. If they knew what you were doing, any contracts with them might be void if you both agreed to do things that would be illegal, and that would create an almighty mess.
