GDPR and global load balancing

Question

Given the recent ruling in regards to the EU-US Privacy Shield and GDPR [1] would it still be possible to implement a global system with regional data sources? Specifically can you request a user email and process it in a location that may be outside EU with the explicit purpose of determining whether that the user should use a EU tenant or not for the rest of their session?

[1] https://techcrunch.com/2020/08/11/eu-us-privacy-shield-is-dead-long-live-privacy-shield/

Example:

I have a software-as-a-service product with a global footprint. Most data is not classified as PII and so is stored in all regions. For data deemed PII I would like to store it in the appropriate region only. So when a user logs in to their account, the idea was to have them enter their email address, look up their region in a mapping table of a hashed value of the email address to a region, available globally and use that information to send all PII related browser requests to the regional servers only.

Follow up example:

Let’s say I still have a global software-as-a-service company. I set up two different data centres, one in EU, and one outside. When new clients are onboarded the select their region. How do I handle authentication in this case? One option is to give the clients different urls depending on region e.g. us.my-saas.com/login and eu.my-saas.com/login but that would not be an ideal user experience. Under GDPR, is there no way of having something like login.my-saas.com and depending on metadata associated with their profile or username automatically determine where to send them?

Answer 1

The ruling didn't prohibit data transfers to third countries. It clarified that there must be appropriate safeguards essentially equivalent to the level of protection required by EU law. The data exporter (you) and the data importer (the third party) must make that assessment.

From the Frequently Asked Questions on the judgment of the Court of Justice of the European Union in Case C-311/18 - Data Protection Commissioner v Facebook Ireland Ltd and Maximillian Schrems:

The Court highlighted that it is the responsibility of the data exporter and the data importer to assess whether the level of protection required by EU law is respected in the third country concerned in order to determine if the guarantees provided by the SCCs or the BCRs can be complied with in practice. If this is not the case, you should assess whether you can provide supplementary measures to ensure an essentially equivalent level of protection as provided in the EEA, and if the law of the third country will not impinge on these supplementary measures so as to prevent their effectiveness.

It seems to me that if your users might be EU data subjects you must determine a user is not an EU data subject before transferring personal data to a place without "appropriate safeguards" or ensure that all personal data receives protection equivalent to that required by EU law until/unless you determine that protection isn't required for the specific user (by determining the user is not an EU data subject) or just make sure all personal data receives "appropriate safeguards".

Article 49 of the GDPR provides for "Derogations for specific situations". I suspect that isn't useful in your scenario but nevertheless worth reading in conjunction with section 8 of the FAQs.