Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Do I have to host all data in the EU to comply with GDPR?

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 74 posts

Re: Ask HN: Do I have to host all data in the EU to comply with GDPR?

#41

Post by paxys »

If your engineering patterns can support isolated customer instances in different data centers around the world then there is absolutely no reason to go for the centralized approach. Regardless of data laws, it is beneficial for so many other reasons - better performance for international customers, easier scaling, more redundancy.

Also remember that GDPR isn't the only law of its kind out there. Different countries, industry sectors, regulators and even companies themselves have their own laws and policies around data storage and processing, and as a service provider it is going to be impossible to stay on top of all of them. So, if a potential customer asks you for this feature the ideal response isn't "well actually GDPR doesn't require us to do that", but "yes we will accommodate you in whatever way you want".

Re: Ask HN: Do I have to host all data in the EU to comply with GDPR?

#42

Post by johannes1234321 »

zeroflow wrote: post #3

IANAL. You can store them outside the EU and/or with US companies, but that provider/country needs to provide the same level of data protection as they would have in the EU. Practically, this excludes anything related to the US due to the CLOUD Act. They've tried making this whole with the Safe Harbor and later Privacy Shield framework, but that was overturned by the European Court of Justice.

Note that this is not (only) about the physical location, but also on the legal side who can access the data.

Even if the US company runs the servers in Europe it doesn't matter. U.S. government can request compliance with the CLOUD Act.

Larger companies try to Dona little legal firewalling, by having European customers being customers of an Irish company, not the American HQ. However there are doubts whether such a setup is enough.

On the extreme there are attempts like the Microsoft-T-Systems cooperation, where Deutsche Telekom / T-Systems was running a Azure Cloud Region in Germany, however too few customers where willing to pay the premium and accept the restrictions of being bound to a single region.

Everybody is playing the waiting game, how privacy agencies, courts, ... are going to deal with that and whether there will be a new attempt of a privacy agreement between EU and US.

Re: Ask HN: Do I have to host all data in the EU to comply with GDPR?

#43

Post by toshk »

eqvinox wrote: post #11

With all the "IANAL" answers here, let me give you a different one: if it's viable, I would try to host all data in the EU for all your EU customers regardless of the legal situation. Because the legal situation is likely to change further - just plain and simple, it's a risk, and if your cost in avoiding that risk is sufficiently low, that might be worth it. And you can advertise it as a benefit to your customers.

The whole situation is confusing for me. We set up a few project with kubernetes clusters for local governments in the Netherlands. They denied DigitalOcean because even though they have servers in Amsterdam, the company is in the US, so we went with a much higher priced custom K8s cluster from a local provider.

So not really sure if they were right, but according to them even just having your servers run by a US company is a potential legal risk with GDPR.

But at the same time other departments in the same organization run on Azure.

Re: Ask HN: Do I have to host all data in the EU to comply with GDPR?

#44

Post by tlarkworthy »

It's a problem using US services, coz customer IP which is protected gets leaked to an organization subject to Cloud Act.

Encrypt your network logs and storage with a customer managed key and keep that in your control. It matters less where the data is then.

Re: Ask HN: Do I have to host all data in the EU to comply with GDPR?

#45

Post by eternityforest »

The really scary thing with this is that bandwidth isn't free. There may be privacy preserving CDNs now that comply, but will there still be in 10 years? How would they make money besides spying?

P2P tech is also hard under the GDPR. Isn't this eventually going to cause more services to become paid?

Re: Ask HN: Do I have to host all data in the EU to comply with GDPR?

#46

Post by hobo_mark »

paxys wrote: post #41

If your engineering patterns can support isolated customer instances in different data centers around the world then there is absolutely no reason to go for the centralized approach. Regardless of data laws, it is beneficial for so many other reasons - better performance for international customers, easier scaling, more redundancy. Also remember that GDPR isn't the only law of its kind out there. Different countries,…

In this case (data in google cloud) would it be enough to use a GCP region in the EU?

Re: Ask HN: Do I have to host all data in the EU to comply with GDPR?

#47

Post by Gasp0de »

toshk wrote: post #43
eqvinox wrote: post #11

With all the "IANAL" answers here, let me give you a different one: if it's viable, I would try to host all data in the EU for all your EU customers regardless of the legal situation. Because the legal situation is likely to change further - just plain and simple, it's a risk, and if your cost in avoiding that risk is sufficiently low, that might be worth it. And you can advertise it as a benefit to your customers.

The whole situation is confusing for me. We set up a few project with kubernetes clusters for local governments in the Netherlands. They denied DigitalOcean because even though they have servers in Amsterdam, the company is in the US, so we went with a much higher priced custom K8s cluster from a local provider. So not really sure if they were right, but according to them even just having your servers run by a US com…

Any US based company can be forced to give up the data of European customers and be silent about it (see CLOUD act) so as far as I see it any US based company that adheres to the CLOUD act can not be GDPR compliant.

Re: Ask HN: Do I have to host all data in the EU to comply with GDPR?

#48

Post by oliv__ »

jollybean wrote: post #36
oliv__ wrote: post #22

Earlier quoted context omitted.

Yeah, this is probably the most pragmatic answer. It's a pain to implement and only adds more complexity to my setup for a tiny percentage of customers; but on the other hand the more I dig into the answers, the more unclear things get with recent rulings overturning common practices. It's unfortunate that finding the answer to such a simple question seems to require lawyers, especially for a small business like mine…

Spending a lot of money on something you don't need to do is not 'pragamatic'. "It's unfortunate that finding the answer to such a simple question seems to require lawyers, " Yes, and it's the a problem for the EU. While there is definitely a need to have some kind of regulatory elements in place, the degree of complexity involved creates considerable constraints and overhead for ultimately very little gain. There is…

Whether I "need" it or not depends on how much of my future customer base I estimate will be EU-based.

Believe me, I don't think these laws are very well structured (they're not even clear enough that you have to dig through 15 different sources and recent court rulings to figure out what to do) and I don't want to add complexity to my setup, but I am trying to grow my business: if it works out financially with enough new EU customers, then the headache could be worth it.

Re: Ask HN: Do I have to host all data in the EU to comply with GDPR?

#49

Post by j16sdiz »

johannes1234321 wrote: post #42
zeroflow wrote: post #3

IANAL. You can store them outside the EU and/or with US companies, but that provider/country needs to provide the same level of data protection as they would have in the EU. Practically, this excludes anything related to the US due to the CLOUD Act. They've tried making this whole with the Safe Harbor and later Privacy Shield framework, but that was overturned by the European Court of Justice.

Note that this is not (only) about the physical location, but also on the legal side who can access the data. Even if the US company runs the servers in Europe it doesn't matter. U.S. government can request compliance with the CLOUD Act. Larger companies try to Dona little legal firewalling, by having European customers being customers of an Irish company, not the American HQ. However there are doubts whether such a…

If this is true, then no American company can do business in EU.

Because the US government can always request compliance with CLOUD act.

Re: Ask HN: Do I have to host all data in the EU to comply with GDPR?

#50

Post by fooblat »

As someone currently working at a German startup I can tell you that there is a growing movement away from using any provider that moves data outside the EU.

Our largest customer, a German enterprise, just told us that if we don't remove all US based providers from our stack they will leave us, regardless of where the data is hosted. They gave us 90 days.

Thankfully I saw this coming and we have been moving to EU providers already.

Post reply on HN