1

Given the recent ruling in regards to the EU-US Privacy Shield and GDPR [1] would it still be possible to implement a global system with regional data sources? Specifically can you request a user email and process it in a location that may be outside EU with the explicit purpose of determining whether that the user should use a EU tenant or not for the rest of their session?

[1] https://techcrunch.com/2020/08/11/eu-us-privacy-shield-is-dead-long-live-privacy-shield/

Example:

I have a software-as-a-service product with a global footprint. Most data is not classified as PII and so is stored in all regions. For data deemed PII I would like to store it in the appropriate region only. So when a user logs in to their account, the idea was to have them enter their email address, look up their region in a mapping table of a hashed value of the email address to a region, available globally and use that information to send all PII related browser requests to the regional servers only.

Follow up example:

Let’s say I still have a global software-as-a-service company. I set up two different data centres, one in EU, and one outside. When new clients are onboarded the select their region. How do I handle authentication in this case? One option is to give the clients different urls depending on region e.g. us.my-saas.com/login and eu.my-saas.com/login but that would not be an ideal user experience. Under GDPR, is there no way of having something like login.my-saas.com and depending on metadata associated with their profile or username automatically determine where to send them?

  • Please don't link to amp pages, they are destroying the open web and are a bad thing - please link to the original source. – Moo Aug 11 at 20:44
  • Agreed, my mistake – Anvar Aug 11 at 21:05
  • 1. I don't think I understand your scenario. An email address doesn't seem a reliable means of determining whether a user is in the EU. 2. What do you mean by "EU tenant"? – Lag Aug 12 at 7:13
  • 1
    I added an example that hopefully clarifies a bit – Anvar Aug 12 at 9:22
1

The ruling didn't prohibit data transfers to third countries. It clarified that there must be appropriate safeguards essentially equivalent to the level of protection required by EU law. The data exporter (you) and the data importer (the third party) must make that assessment.

From the Frequently Asked Questions on the judgment of the Court of Justice of the European Union in Case C-311/18 - Data Protection Commissioner v Facebook Ireland Ltd and Maximillian Schrems:

The Court highlighted that it is the responsibility of the data exporter and the data importer to assess whether the level of protection required by EU law is respected in the third country concerned in order to determine if the guarantees provided by the SCCs or the BCRs can be complied with in practice. If this is not the case, you should assess whether you can provide supplementary measures to ensure an essentially equivalent level of protection as provided in the EEA, and if the law of the third country will not impinge on these supplementary measures so as to prevent their effectiveness.

It seems to me that if your users might be EU data subjects you must determine a user is not an EU data subject before transferring personal data to a place without "appropriate safeguards" or ensure that all personal data receives protection equivalent to that required by EU law until/unless you determine that protection isn't required for the specific user (by determining the user is not an EU data subject) or just make sure all personal data receives "appropriate safeguards".

Article 49 of the GDPR provides for "Derogations for specific situations". I suspect that isn't useful in your scenario but nevertheless worth reading in conjunction with section 8 of the FAQs.

| improve this answer | |
  • Thank you for this. Reading the last bit my interpretation is that it would not be possible to do what I suggested as the email address might be processed in the US, which given the Privacy Shield ruling, would not have appropriate safeguards. – Anvar Aug 12 at 18:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.