Hacker News Reader

Comment by viraptor | Hacker News Reader

> I wish I was kidding about this one, a fear that our data could be hosted on a Google server in a country with questionable human rights laws

Was that in UK by any chance? If so, take a look at Data Protection Act - especially this:

Personal data shall not be transferred to a country or territory outside the European Economic Area unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.

If you want to be ok with the law, basically you cannot store your emails (which at some point will definitely contain personal data) in an unknown location. Gmail storage qualifies as an unknown location for all we know.

View on HN

It's in the US, but that's a fascinating law.

Google actually specifies that they cannot disclose the exact location of one's Google Apps data because it is automatically distributed across three different server farms out of several dozen (or more) potential locations. They also are purposefully vague about disclosing the locations of their data farms, in general. Incidentally, one likely reason for this is security.

I agree that there are some genuine privacy and security concerns about the cloud, but I think most criticisms fall into the unforgivable category of "I don't trust it because I can't see it."

And in this sense, academics refusing to accept the cloud are like academics refusing to accept gravity.

I think it's not a problem of not seeing the data. After all, outsourcing storage and processing is very common now. The real problem is that when you need to see the data, you cannot and you don't know where to find it.

For example, you cannot easily swap the email server for a new one and recover everything from backups. Actually, you cannot even reliably make full on-site google apps backups afaik, which is a hard requirement in many places. If you have problems with disappearing data, not only do you have to wait for Google to fix it, but you have a specific priority in their queue. In extreme cases you might want to get a bunch of consultants to deal with the problem on-site right now. No such option if you outsource your storage.

Google has a UK office, so they have to comply with the law, too.

To be honest, I'm not sure how does it work for companies providing the technology, but from what I can tell Google doesn't store the personal data itself. They let you store theoretically opaque strings. They might guarantee that their own emails which contain personal data are not stored in the country X. But since they don't really provide a system for storing personal data, your emails might end up in that country. It was your responsibility not to put them in a potentially foreign place and it was you who broke the rule, not Google.

So in the end, their UK office might be compliant - but it's not the same as their datacenters.

Reply on news.ycombinator.com