Ask HN: Do I have to host all data in the EU to comply with GDPR?

However, according to a relatively recent European Court of Justice ruling you're not allowed to transfer any personally identifiable information to companies that are in any way affiliated with a US-based entity (e.g., by virtue of having a US-based parent company) anymore. Just being physically located in the EU isn't sufficient according to this ruling.

The reason for this is that with FISA US law enforcement can force US-based companies to hand over any data, even if that data is stored with an international subsidiary under a completely different jurisdiction.

This basically invalidates all of the provisions and legal frameworks for interacting with non-EU entities that used to be acceptable under GDPR before (e.g., Privacy Shield).

However, not interacting with any US-based or US-related entities at all anymore would be tantamount to ceasing almost all economic activity. So, until (or more pessimistically: unless) the US and the EU come to terms on a new agreement regarding privacy rules, there probably isn't anything a business can do on its own to completely address this issue. At this point, merely hosting data on servers physically located in the EU perhaps amounts to little more than window dressing.

Realistically, as of now your best option probably is to continue to put in your best effort to protect customer data (which might include hosting data exclusively in the EU) and document everything in the process.

That's a very generic statement on a situation that can have a zillion factors ;)

> 'You can advertise to your customers' - except that nobody really cares that much,

I do know quite a bunch of people who care, so "nobody" is demonstrably wrong. That said, the people I associate with tend to be tech-savvy, privacy conscious and have disposable income, so I'll agree it's probably not a large percentage. But I don't know what OP's target audience is either...

https://www.whitecase.com/publications/alert/court-confirms-...

  What makes a dynamic IP address personal data?

there is another party (such as an ISP) that can link the dynamic IP address to the identity of an individual; and the website operator has a "legal means" of obtaining access to the information held by the ISP in order to identify the individual. On the facts, if the BRD has the legal power to compel the relevant ISP to disclose sufficient information to identify Mr Breyer, then Mr Breyer's IP address will be personal data in the hands of the BRD.

The CJEU also did not ask the specific question in that case - Were the BRD LIKELY to identify Mr Breyer? If this is something that you have never done before or will do in the future then it is not likely that you will try to identify someone by their IP.

Be very careful with this - the GDPR is not just about PII. It covers any data related to someone who could be identified directly (e.g., a name) or indirectly (several anonymous traits that realistically could only be one person).

Any data related to such a person is covered, even if that data itself isn't PII. The data they've uploaded, your logs of their system activity, the support tickets they've filed, it's all covered.

The wording in GDPR Article 4.1 is "‘personal data’ means any information relating to an identified or identifiable natural person ‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person"