4

After the Schrems II decision, data transfers to US data processors are increasingly risky at best, for example to public cloud providers such as GCP, Azure, and AWS.

A very common suggestion is to store your data in EU-based data centers of these cloud providers if your application isn't too latency-sensitive, for example in this answer.

I fail to see how this makes a significant difference. All of the major public cloud providers are US companies, and their servers in Europe are still under their control, and so the US government can just as easily demand to hand over data hosted on EU servers as they can on US servers.

In a strict sense of the word, data transfer to the US is indeed avoided, as the data physically remains on EU servers. But in a broader sense of the word, and really in the spirit of the Schrems II arrest and GDPR in general, the data is de facto transferred to a US controlled company the moment when it's stored on any GCP, Azure or AWS server, regardless of where that server is located.

Thus, I feel as though hosting on EU-based servers of US-based public cloud providers doesn't solve anything at all, and simply provides a false sense of security and compliance. Is this correct, or am I missing something?

Improve this question
2
  • Can you explaon the part with the 'latency-sensitive'? GDPR is primarily for data of European consumers (it does apply in some other cases as well) and for these storing the data in the EU instead of the US should reduce latency not increase it. So latency (if relevant) should be an argument pro EU data storage not against it.
    – quarague
    Jul 10, 2022 at 7:17
  • 1
    @quarague I'm speaking from the perspective of a EU-company. If I understood it correctly, I need to process all user data in accordance to the GDPR, even for non EU-residents (see linked answer), and thus what I meant was storing all data, even that of US customers, on EU servers, which would increase latency for those US customers. But even if that wasn't the case, it's often quite tricky to store (often relational) data for users of different countries in different regions reliably without anything 'leaking' to a US server.
    – Ben
    Jul 10, 2022 at 20:59

3 Answers 3

Reset to default
2

Kind of.

A relevant question here is: has an international transfer of data occurred? And if so, who is the controller for that transfer?

  • When you store data in US-based servers, then yes, you have made a transfer.

  • When you store data in EU-based servers, the no, you have not made a transfer.

    • When the cloud provider breaches their duty as a data processor and transfers the data into the US against your instructions, they would have made a transfer.

This suggests that using EU-based servers is generally OK from a data transfer perspective, even if they are provided by a company that is subject to US jurisdiction. You are not making a transfer. If a transfer occurs, it's because that cloud provider is breaking the GDPR.

So instead of a Chapter V international data transfer problem, I'd see this as a Chapter IV security problem.

  • You as the controller are required to implement appropriate technical and organizational measures to ensure the security and compliance of processing (Art 42, Art 32). If you identify a risk, you have to take appropriate measures. But you can use a risk-based approach here: if a risk is very unlikely, it may be appropriate to do nothing.

  • You as the controller are required to legally bind your data processors per Art 28 to only use the data as instructed by you. If you are convinced that a potential processor is not legally able to enter into that contract, for example if they are subject to conflicting foreign laws, then you can't engage them as a processor and will have to look for a different company.

Because of the US' CLOUD Act, there is a real concern when using EU-based IT services that are still under US control. Some providers try to address this issue with a trustee solution where the tech is provided by the US company but the data centre is legally under the control of an EU company. But I think of the large cloud providers only Microsoft Azure seriously attempted this, and their Azure Germany service has now been shut down.

In practice, no one cares. Regulators seem to be aware of the massive impact of Schrems II enforcement and are treading lightly – especially since this isn't necessarily a data transfer issue, as outlined above. Businesses will not want to miss out on industry-standard tools for the hypothetical possibility that the US might invoke their CLOUD Act. If businesses are concerned, they can use the many EU cloud and hosting companies, or use supplemental measures such as end-to-end encryption to secure the data.

Improve this answer
2
  • Great answer! I'm not so convinced that the massive impacts is enough to stop enforcement, especially after the Google Analytics decision by the Austrian DPA, followed by decisions by other nations DPAs confirming this, which has an enormous impact, as the majority of websites use Google Analytics. In this instance, there is an actual data transfer to the US, but the high impact of enforcement doesn't seem to stop it anymore.
    – Ben
    Jul 10, 2022 at 21:08
  • @Ben As you point out, the enforcement against use of GA is based on the actually occurring transfers. Schrems II is clear, so that courts and DPAs don't really have any leeway when the matter is put before them. This is completely different from the matter of US-controlled but EU-based cloud services, where there is concern about hypothetical transfers. No country has an interest in proactively adopting an interpretation that would kneecap domestic industry by cutting it off from industry-leading IT services.
    – amon
    Jul 11, 2022 at 8:49
4

The tricky bit from a GDPR standpoint is that the US has a law that says a US-based company must hand over data to US government agencies even if the data is stored outside the US. This is US specific and a case where the US government gives itself jurisdiction outside the US but the EU can't directly do anything against it (outside of international negotiations).

As you noticed this means if you store data at a US data processor there is no real difference whether the data is physically stored in the US or the EU. So to avoid transferring EU consumer data to the US several steps are needed. First the servers have to be physically located in the EU and second the company needs to be non-US based, EU based seems the obvious choice. AFAIK constructions of a US-based company creating a fully owned EU-based subsidary are currently used to achieve the second part. Whether this is sufficient may have to be decided in court.

Improve this answer
1
  • 1
    Ah yes, the venerable Amazon SARL, daughter of Amazon...
    – Trish
    Jul 10, 2022 at 8:39
2

EU servers don't make you compliant by themselves

There are many other rules you have to abide by beyond storing the data in the EU - and just not transferring the data to the US just isn't sufficient to make you GDPR compliant.

For example, you have to delete data on request by Data Subjects, and that is only the tip of the iceberg.

Improve this answer
1
  • I am aware of this; I suspect the title was perhaps slightly misleading in this regard, but my question really is about the body of the text regarding data transfers to US controlled public clouds.
    – Ben
    Jul 9, 2022 at 18:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .