Bad for startups and the interconnected Internet, but still damage minimization compared to allowing the NSA dragnet.
The bad consequences are explained very well here:
The bad consequences are explained very well here:
Only for startups whose business plan consists of plundering EU citizens' data in ways not consistent with the privacy laws of those countries. Those are startups I'm happy to see inconveniences.
Not for service providers in the US, but it's a great day for European cloud service providers.
Ultimately I chose (then) Safe Harbor compliant US services, not out of convenience, but because most of them exhibited better security practices (e.g. 2FA) or deliverability (e.g. Mandrill) compared to their European counterparts.
I'm concerned about 2 things mainly:
- being forced to rely on less advanced 3rd parties, potentially less secure, which would not be a win for my users
- later down the road, seeing a backfire from the US telling that I cannot store US customers data in the EU
I have started a discussion over here [2].
[1] https://www.wisecashhq.com [2] http://discuss.bootstrapped.fm/t/concrete-ramifications-of-s...
>In a nutshell: this was the only reason any modern internet service could keep their primary user data in the United States on services like Amazon EC2 or Heroku.
But shouldn't you be fine if you use EC2 with a European location? (Then you can approximate by using the instance with the lowest ping to the user)
>The harder part is to figure out which user belongs to which jurisdiction.
Does the climbing website have to do store personal information in the first place? Does a random user-name like "a_bonobo" count as private data? An e-mail address? An e-mail address from a throwaway host? Pictures of climbing walls? What constitutes "personal data" here?
Personal data (and other data) are defined by the EU and probably US. The EU is EU Directive 95/46/EC (citing from wikipedia) "any information relating to an identified or identifiable natural person ("data subject"); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity;" (art. 2 a).
> ALWAYS STORED in the EU boundaries. which Amazon cannot guarantee.
That makes sense, and I fear of what we'd do to enforce this - full data inspection just to make sure that Amazon doesn't transfer private data to the US?
>n identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity
So a username like "a_bonobo" wouldn't fall under personal data as it's not really identifiable (but what if I research bonobos? My username gives a clue to my job, if that would be my job!). So under gasull's link I think that a lot of what the climbing community would save isn't directly personal data, as you don't need much information from your users to run such a site (except if you want to have Facebook's business model). Or am I wrong? I mean, you can even identify someone based on their writing patterns.
You can't guarantee that AWS is doing. You have to belive it. That's why hospitals & co keep the data in their own servers. And, if in the cloud, they try to avoid US companies as much as they can.
the username if not directly linked to someone (e.g., not an email) usually does not fall into personal data. But, since many usernames are reused by people they may identify the person. This is a a case which, honestly, i would not know how to deal with. I'll try to get an answer.
I assume a lot of businesses are waking up and calling their lawyers.
Of course, the best possible solution: no jurisdiction can demand data a service doesn't have.