0

Scenario: My service that is storing customer files is hosted on my own personal physical server, “on-prem”. It is then using one of the popular cloud storage services (Azure blob storage, AWS S3) to store these customer files. They may or may not contain personal data.

Before the data is sent from my server to the cloud service the data is encrypted with my secret keys that are only ever stored on the on-prem-server.

Since I am using an encryption algorithm that is considered secure and the keys never goes to the cloud, would the data I send to Azure/AWS be considered personal data under GDPR? Would I for example have to include the storage service as a sub-processor in my published list of sub-processors?

2
  • I suggest to move this question to the Law SE.
    – mentallurg
    Apr 13, 2021 at 1:47
  • The definition of PII is not affected by how it is processed or encrypted. The definition of the data depends on the data. If you are trying to say "but the data is actually just seemingly random strings (encrypted)" then you can imagine that the regulation has already accounted for that and you don't get that "out".
    – schroeder
    Apr 13, 2021 at 7:18

1 Answer 1

1

Since you are able to encrypt the data, the data is clearly personal data for you. That means you will have to comply with the GDPR regarding how you process and store this data. This involves disclosing recipients of this data per Art 13(1)(e), and only engaging data processors in line with Art 28.

Your storage provider such as Azure and AWS cannot decrypt this data, so it would not be personal data if processed by them for their own purposes. There is an argument that they did not receive personal data, especially considering the definition of a recipient in Art 4: a person/entity “to which the personal data are disclosed”.

However, this is not necessarily relevant when talking about sub-processors. A processor is anyone who “processes personal data on behalf of the controller”. As processors, they're not using the data for their own purposes but are just acting on your behalf. Storage is a kind processing, and they are storing data on your behalf. This data is personal data for you. Thus, I'd consider the storage providers to be your processors.

Due to your use of strong client-side encryption, your remaining compliance obligations are mostly boilerplate (signing a data processing agreement per Art 28, sorting out international transfers if necessary, and getting agreement for adding a sub-processor from your controllers). Note that encryption is mandatory whenever appropriate (Art 32(1)(a)).

Such client-side encryption could even serve as a legal basis for storing the data in jurisdictions that don't offer an adequate level of data protection, such as a data center in the US. Per the draft EDPB recommendations on measures that supplement transfers tools (published as a response to Schrems II / the invalidation of Privacy Shield):

Use Case 1: Data storage for backup and other purposes that do not require access to data in the clear

79. A data exporter uses a hosting service provider in a third country to store personal data, e.g., for backup purposes.

If

  1. the personal data is processed using strong encryption before transmission,
  2. the encryption algorithm and its parameterization (e.g.,key length, operating mode, if applicable) conform to the state-of-the-art and can be considered robust against cryptanalysis performed by the public authorities in the recipient country taking into account the resources and technical capabilities (e.g.,computing power for brute-force attacks) available to them,
  3. the strength of the encryption takes into account the specific time period during which the confidentiality of the encrypted personal data must be preserved,
  4. the encryption algorithm is flawlessly implemented by properly maintained software the conformity of which to the specification of the algorithm chosen has been verified, e.g., by certification,
  5. the keys are reliably managed (generated, administered, stored, if relevant, linked to the identity of an intended recipient, and revoked), and 6.the keys are retained solely under the control of the data exporter, or other entities entrusted with this task which reside in the EEA or a third country, territory or one or more specified sectors within a third country, or at an international organisation for which the Commission has established in accordance with Article 45 GDPR that an adequate level of protectionis ensured,

then the EDPB considers that the encryption performed provides an effective supplementary measure.

1
  • Thank you so much Amon, this is just the answer I was hoping to get! 😊
    – Peter
    Apr 14, 2021 at 5:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .