20

The fine: https://www.theguardian.com/technology/2023/may/22/facebook-fined-mishandling-user-information-ireland-eu-meta

Like any website, we have an account system where people log in to access their orders and activate their software. So we have usernames, passwords, real names, recent IP addresses (for abuse protection), as well as the data of people's orders.

This is stored in the AWS East-1 datacenter in N. Virginia. Our users are mainly EU and US, and being in N. Virginia gives users the best overall latency.

We're about to incorporate in Europe, and I seem unable to interpret the recent rulings in any other way than that having a single account system is illegal, unless the account system in its entirety is hosted in the EU.

The engineering challenge is unfathomable, and it seems it would be for any business from a WordPress blog to a Google account system. If an EU user has a Google login, and the account system contains their first name, and Google's account system is global, how is this not just as illegal? Aren't all account systems illegal now?

Improve this question
12
  • 3
    Do you give unlimited access of your collected data to US spy agencies, like Facebook does?
    – nvoigt
    Commented May 23, 2023 at 6:21
  • 4
    It's a wrong question to ask whether we voluntarily give spy agencies access, because a US host like AWS has no choice in the matter.
    – Per
    Commented May 23, 2023 at 8:49
  • 3
    Going to assume you meant to say "password hashes" not "passwords", right?
    – Richard
    Commented May 23, 2023 at 18:34
  • 4
    @Per you voluntarily do that, in the sense that you voluntarily host your data in a country that has such provisions
    – njzk2
    Commented May 23, 2023 at 20:58
  • 2
    I hope you're not storing passwords. There are better techniques to validate passwords.
    – Harper - Reinstate Monica
    Commented May 23, 2023 at 21:48

2 Answers 2

Reset to default
19

Basically yes, but

  1. It is not really since the fine, but since the ruling in 2020 that the EU-U.S. Privacy Shield fails to protect Europeans' rights to data privacy when companies are transferring those data to the U.S.
  2. You can still do it, but you have to be really careful.

What this fine does is demonstrate that Meta has failed in doing this. One could take that as evidence that it is a hard problem to solve and it would be easier to move your data to the EU. The best summary I have come across is this from the International Association of Privacy Professionals which says:

The CJEU reaffirmed the validity of SCCs but stated that companies must verify, on a case-by-case basis, whether the law in the recipient country ensures adequate protection, under EU law, for personal data transferred under SCCs and, where it doesn’t, that companies must provide additional safeguards or suspend transfers. The ruling placed the same requirement on EU data protection authorities to suspend such transfers on a case-by-case basis where equivalent protection can not be ensured.

This is where it gets tricky, particularly in the U.S. context.

The CJEU itself assessed the sufficiency of protections with regard to U.S. government access to data and found them lacking. The question regulators and companies now face is whether the concerns raised by the court are applicable in the context of particular transfers and can be remedied through additional protections — again, not only in the U.S., but also in all countries without an adequacy determination.

Privacy professionals may need to consider whether relevant surveillance programs and authorities apply in particular contexts. If they do, they could then assess whether those authorities include proportional limitations in the given context, as well as whether effective judicial remedies exist. Alternatively, they might consider ways to limit the context itself through additional safeguards. Encryption, for instance, might be a consideration.

Improve this answer
1
  • Considering the Patriot Act and its substitutes that changed the name, but not the substance. I suspect that it will be very difficult for a US business to comply with the EU regulations.
    – FluidCode
    Commented May 24, 2023 at 18:16
22

I assume this refers to the case covered here: https://www.theguardian.com/technology/2023/may/22/facebook-fined-mishandling-user-information-ireland-eu-meta

The gist is: Under GDPR you can only transfer personal data from inside the European Union to the outside if you have procedures in place that ensures it is still protected to European standards. Facebook was found to have failed in that regards, specifically when it came to access by US spy agencies. It seems indeed quite plausible that it is not possible to transfer personal data from the EU to the US in a way that is compatible with both EU and US law. The EU and the US are in negotiations to find a way to make this legally possible.

But until then, it seems that if you do have a European subsidary and want to keep all of your account data in the same place, it needs to be a place with robust privacy protections. That doesn't require it to be in the EU, but something like US, Russia or China would be illegal.

Improve this answer
6
  • Yes, we're kind of resigned to just moving our whole cluster to the EU. The reality is that the data can't be protected in the US in the way requested, because we need to work with the data in order to calculate people's activation status etc. The data needs to actually be readable by the servers.
    – Per
    Commented May 23, 2023 at 9:41
  • 11
    @Per Worth noting that you don't have to choose between the US and EU, there are more options. The EU GDPR expects that data transfers into other countries are adequately protected, and some countries have been explicitly attested such adequacy. For example, Canada, South Korea, or Israel. It could be easier for compliance to use vendors or hosting providers in those countries. In this context, it primarily matters where your data processor are, not so much where your own company is established or where it is managed from.
    – amon
    Commented May 23, 2023 at 14:45
  • 4
    @Per of course another option for example is the EU users buy the software from the EU subsidiary; the whole transaction happens in the EU. You might be surprised how many companies operate this way (not just in the EU but in every country where they do business)
    – user20574
    Commented May 23, 2023 at 16:56
  • 1
    @per At my work, we dealt with this by duplicating the US cluster to EU, so our two American DCs have counterparts in two AWS regions inside the EU. Depending how much automation you have/are comfortable with, it may be easy or hard to duplicate everything. And then you need to migrate EU customers' data over.
    – Criggie
    Commented May 24, 2023 at 4:58
  • 1
    Also, you don't have to move the whole account system. One option is to have one account system per "region", and then just use locks to affirm that each username is unique.
    – Mooing Duck
    Commented May 24, 2023 at 15:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .