Storing EU PIIs in US located servers

Question

I have a business based in Romania and I am about to launch an iOS mobile application that will be available all over the world. The application will communicate with a backend server, which is used to process and store data, including PII (email, name, date of birth, gender, location, and maybe more in the future).

My target audience lives mainly in the US (specifically NYC), reason why I want to create the server in that region, for better performance, but I have read that storing EU data on US servers is no longer compliant with GDPR. For reference, I use DigitalOcean droplets, if you are familiar with them.

I don't want to limit the accessibility only to US users, as some European users may still sign up. Having the server hosted in EU is also not a good option, as the latency for US users would be too high, and the user base will be mainly from US.

I was thinking about how other businesses handle this situation. Having separate databases which handle PIIs from different regions is not applicable in my situation, as the application is similar to a social network and the latency problem would not be solved in this way.

Answer 1

As you, the data controller, are from the EU, all your processing activities must comply with the GDPR, regardless of where the users are from. Since the EU–US Privacy Shield was invalidated in the 2020 Schrems II decision, it is no longer straightforward to use US-based services as your data processors.

You have a variety of options to consider.

• Accept the ~77ms latency from an EU data center. This is the easiest solution from a compliance perspective. Depending on the application, this really might not be a problem.

• Use services based in a nearby country that is covered by an EU adequacy decision, such as Canada. E.g. the AWS Canada-Central region near Montreal is about 10ms away from NYC. Digital Ocean's Toronto region is about 20ms away. I would choose this approach if you're very concerned about latency and want GDPR compliance with reasonable effort.

• Handle non-EU data processing activities through a non-EU subsidiary entity. However, that entity would have to actually determine the purposes and means of processing. Setting up a non-EU office with non-EU staff would be costly. You couldn't work remotely for that entity from within the EU without defeating its purpose.

• Sign standard contractual clauses (SCCs) that serve as a legal basis for data processing activities in the US, after performing an analysis that indicates that the specific concerns as in the Schrems II case do not apply in your case, and potentially after identifying and implementing measures such as end-to-end encryption as explained by the EDPB Recommendations 01/2020 on supplementary transfer measures.

  Most companies end up relying on SCCs, since otherwise the use of US-based services is impossible. But it's doubtful whether the necessary analysis has been properly performed. The supplementary measures suggested by the EDPB are sometimes feasible in specific use cases (e.g. encrypted backups), but are generally impossible to fulfill for typical cloud services. So even though this is a popular option, it comes with substantial risk for your compliance efforts.