Ask HN: Do I have to host all data in the EU to comply with GDPR? • Hacker News Board

Re: Ask HN: Do I have to host all data in the EU to comply with GDPR?

#71

Post by AnthonyUK » Tue, Mar 15, 2022, 2:40 PM UTC

treis wrote: post #70

AnthonyUK wrote: post #67

Earlier quoted context omitted.

This was the finding of the case Patrick Breyer vs Germany in 2016 https://www.whitecase.com/publications/alert/court-confirms-... What makes a dynamic IP address personal data? The CJEU decided that a dynamic IP address will be personal data in the hands of a website operator if: there is another party (such as an ISP) that can link the dynamic IP address to the identity of an individual; and the website operator ha…

From your cite: >Where a piece of information (such as an IP address) does not directly identify a person, that piece of information will nevertheless be personal data in the hands of any party that can lawfully obtain sufficient additional data to link the information to a person's real world identity In a world of data brokers that makes IP addresses PII. The only way it's not is if you verify that there is no way…

In UK it is not even a requirement for an ISP to keep those records but that is not the topic to address, so who is able to legally obtain that data and is it something that you are reasonably likely to do?

You can see why people err on the side of caution.

Re: Ask HN: Do I have to host all data in the EU to comply with GDPR?

#72

Post by treis » Tue, Mar 15, 2022, 4:53 PM UTC

AnthonyUK wrote: post #71

treis wrote: post #70

Earlier quoted context omitted.

From your cite: >Where a piece of information (such as an IP address) does not directly identify a person, that piece of information will nevertheless be personal data in the hands of any party that can lawfully obtain sufficient additional data to link the information to a person's real world identity In a world of data brokers that makes IP addresses PII. The only way it's not is if you verify that there is no way…

In UK it is not even a requirement for an ISP to keep those records but that is not the topic to address, so who is able to legally obtain that data and is it something that you are reasonably likely to do? You can see why people err on the side of caution.

>who is able to legally obtain that data and is it something that you are reasonably likely to do?

Any other 3rd party that has obtained their IP address and can legally share it with you. That's the problem. How do you ensure that something doesn't exist? Practically it's impossible.

Re: Ask HN: Do I have to host all data in the EU to comply with GDPR?

#73

Post by pvtmert » Tue, Mar 15, 2022, 10:06 PM UTC

You can store outside of the EU and keep them fully encrypted with encryption keys are only in the EU.

Which will make things immensely complicated though.

And of course, both data at rest and data in transit encryption.

GDPR's main point is data protection. Some 3rd world countries stealing idea and converting rules to "turn the data in (decrypted form) so I can see who's doing what".

Re: Ask HN: Do I have to host all data in the EU to comply with GDPR?

#74

Post by devn0ll » Fri, Mar 18, 2022, 6:53 AM UTC

eqvinox wrote: post #11

With all the "IANAL" answers here, let me give you a different one: if it's viable, I would try to host all data in the EU for all your EU customers regardless of the legal situation. Because the legal situation is likely to change further - just plain and simple, it's a risk, and if your cost in avoiding that risk is sufficiently low, that might be worth it. And you can advertise it as a benefit to your customers.

As I have understood it from a lawyer: US laws require a company to hand over the data wherever the data is located. EU, Japan, whatever. You are a US company, so hand it over.

EU law states: EU data shall not leave the EU.

Those two bite each other, and the result is that a company can _never_ bow to both laws.

So, if EU data must be kept in the EU, choose a (hosting) company with no ties to the US. Vice versa is no problem, the EU law _does_ respect data locality.

It is the reason why we had to move away from Hetzner, when they opened a US office/branch.

(https://docs.hetzner.com/general/general-terms-and-condition...

If you require a web hosting company that has absolutely no connections to the USA, then unfortunately, we may no longer be the best choice for you)