-1

Some regions and territories have data sovereignty and localisation laws that prevent, for example, personal data from being transferred outside of that jurisdiction. Do such laws, if they even discuss this explicitly, refer only to the final destination, or must data remain within the jurisdiction throughout its transit?

How can the latter be enforced? If we assume IP routing, then (AFAIK) this can't be guaranteed without control over the infrastructure/physical layer.

Improve this question
6
  • Forgive the naiveté of my question. If there's some background knowledge that I'm missing, please let me know and I'll edit accordingly...
    – Xophmeister
    Nov 14 at 17:26
  • 1
    google.com/…
    – BlueDogRanch
    Nov 14 at 19:20
  • At least for GDPR: no, because the definition of a "data transfer" requires the purpose of subsequent processing at the destination. However, any personal data processing activity requires appropriate security measures. Nowadays, all traffic over public networks should use state of the art encryption (such as TLS-1.3 connections to protect the data and nearly all metadata).
    – amon
    Nov 14 at 20:08
  • Would the publication of IP routing information necessarily fall to a national ISP residing within the jurisdiction? Enforcement would then fall within local laws. The question whether publication of IP routing exposes personal information would also need to be addressed - does a routing table that exposes my home IP to a network segment delivered by Comcast in a particular region of the eastern US expose personal information?
    – doneal24
    Nov 14 at 20:09
  • @doneal24 yes it does. Your IP by itself is personal information
    – Dale M ♦
    Nov 14 at 22:14

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .