I was reading about data transfer implications for those of us who live in EU. Apparently transferring any user's personal info outside of EU is not strictly legal, unless you go through some paperwork which I definitely will not.

So the questions is, does this mean that it's illegal to host your website in USA if you're located in EU? My website stores personal info like e-mail address, password and nickname (this info is stored on a server outside of EU). Does this fall under personal data transfer? Or did I misunderstand the whole thing?

Perhaps someone with experience with the web legalities could help me out better understand this.


I'm not a lawyer and lots has been done about this during the first part of this year. Your version of events (EU data outside EU) is a little behind the curve. An agreement was put in place, given a new name which I cannot remember, but putting the "Safe Harbour" agreement that was previously law, to rest.

My understanding is where you store the data is less important when compared to how you store the data. This is the prime concern (hacks and unauthorised use of the data).

Sending plain text over the wire between your client device and the server is likely to be frowned upon if the data is hacked and the law catches up with you.

| improve this answer | |
  • So should I bcrypt e-mail address inputs? Because users have to write their e-mail into login form in order to sign in on my website. By the way, my website is pretty basic, the only info that's sent by the user is e-mail, password, nickname and comments. That's all it stores. – Saul Tigh Apr 12 '16 at 12:22
  • If you need this data, it is valuable. If you don't need it, don't ask for it. – fiprojects Apr 12 '16 at 13:40
  • Define "bcrypt email address input". If your website is hosted on HTTP, then all data sent is in plain text. The most common way to secure data between server and client is via HTTPS which requires an SSL certificate which I'm guessing you don't have. Without prejudice, you under-estimate the effort needed to prevent your service being used to hack others and/or your data being stolen and/or thrashed. – fiprojects Apr 12 '16 at 13:43
  • Don't under estimate your responsibility for peoples private data. Research stackoverflow.com/questions/884927/… – fiprojects Apr 12 '16 at 13:47
  • I need user e-mail address only for the purpose of preventing users from having multiple accounts. I know this doesn't rule out multiple accounts, but it makes it more complicated as far as I know. I've checked your link and I understand all this. I will definitely have HTTPS once it goes live. But you know, you can't rule out database breach no matter how good your security measures are. So for that reason, maybe bcrypting the addresses stored isn't such a bad idea. – Saul Tigh Apr 12 '16 at 15:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.