Give this scenario...

A user in Germany, a user in US. Each one decides to create an account on Facebook and facebook is located in US...

According with GDPR, US cannot store data from EU Citizens. So, what does Facebook do (or supposed to do) to comply with regulations?

I am involved in a global project and we don't know exactly what to do in this sense. Can we have a single global server storing user information? If the answer is no: Can we have a single global server storing only usernames and passwords and all the other data such as first name, last name, phone number, etc be stored in each region?

For this I suggested to my team: Let's try to find out what big techs are doing... What happens when Facebook, Apple, LinkedIn, etc earn a new user on the database?

  • "I am involved in a global project and we don't know exactly what to do in this sense." This site is not for legal advice; ask the legal dept of your company. Feb 2, 2022 at 17:08
  • I am looking for informal opinion, @BlueDogRanch
    – Marco Jr
    Feb 2, 2022 at 17:10

1 Answer 1


What Big Tech is doing is spending a lot of money on lawyers and appeals – doesn't matter if it costs millions if you can make money in the meanwhile.

Facebook stores a lot of user data in the US. Initially, this was allowed because the US was recognized as offering an adequate level of data protection under the Safe Harbor and later the Privacy Shield Framework. Then Schrems I and Schrems II happened and the adequacy recognition was ruled to be invalid.

Does Facebook pull back their user data? No. The GDPR offers alternative reasons why you might process data in foreign countries, such as “standard contractual clauses” (SCCs) or “binding corporate rules” (BCRs). Now, Facebook claims that they are using SCCs. Is this valid? Almost certainly not due to the issues of US law analyzed in the Schrems II case, but it can take years for the next round of court cases to work its way through the system. And when Facebook's use of SCCs is ruled invalid they will probably try BCRs next, and once that is over a decade will have passed and the US might actually have achieved an adequate privacy level by then.

You do not have Facebook-style money to spend on lawyers and endless rounds of appeals, so you should avoid legally risky things such as outsourcing data processing activities to companies in the US (this doesn't mean you can't be compliant if you are a US entity).

I mentioned adequacy decision previously. There is a list of countries that the EU considers to be sufficiently safe. Currently, the more notable countries involve Canada, Israel, Japan, New Zealand, Republic of Korea, Switzerland, and the United Kingdom, in addition to EU/EEA countries of course. If you want to process data in a location that is OK for both the UK and the US, then looking at companies in one of these countries is a good idea. For example, if most of your users are in the US but you would like your servers to be in a country with an EU adequacy decision, then looking at Canada could make sense.

Even outside of this list, you can process data if you implement additional safeguards via SCCs. However, this requires a case by case analysis of the legal environment in that country. One problem with the US is that it has national security laws that impose requirements on companies in a manner that is incompatible with SCCs. A company bound by these US laws cannot enter into such a contract where it guarantees the privacy of your user's data.

Countries other than the EU have much more tedious data residency laws. The GDPR does not impose any data residency requirements in the sense that data must not leave a particular country – you just have to ensure that the data is properly protected. In contrast, Russia and China have real data residency requirements that are fundamentally incompatible with the GDPR.

  • and the US might actually have achieved an adequate privacy level by then => or... the EU just changes their laws to be more relaxed. Nov 28, 2022 at 16:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .