Hacker News Reader

Comment by nl | Hacker News Reader

> Her trustees are advising that since Google cannot guarantee that her data is being stored in the UK (apparently?), they need to migrate.

She should push back on that, since there is no legal basis for it (except in very specific circumstances).

It would be cheaper to get competent legal advice than do a shift like this for many offices.

View on HN

This is correct. Current legislation (GDPR and the UK's implementation in the 2018 Data Protection Act) does not require data to be stored in the UK. G Suite is definitely GDPR compliant, could the trustee be raising vague concerns without good cause (they do that). There are other reasons to switch from Google, but that's not one of them.

Is the UK still bound to the GDPR though (considering Brexit) ?

Yes. GDPR is the EU regulation, but member countries incorporated it into their domestic legislation. In the UK that's the Data Protection Act 2018.

To remove GDPR from the UK we'd have to change the data protection act.

Do you know if the Brexit would invalidate the act?

I am not an expert on UK Law but I also wondered if it is possible that the reference on the GDPR would still be valid

At that point the UK could revoke or change the law. But it wouldn't automatically vanish.

No, brexit will not invalidate the act. It's now UK law.

Thanks for the clarification; most EU countries just made some kind of diff to the GDPR and did not make it an explicit law

Regulations are laws that directly apply across EU, unlike directives (which bind member states to make a law that achieves the goals of the directive).

https://en.wikipedia.org/wiki/Regulation_(European_Union)#De...

So you can make legislation around a Regulation but can't override its effects.

At least till the end of the year. They have an act that states the GDPR as applicable in the UK. Not sure if this will hold after the Brexit but could as well be.

Yes it was copied and pasted into UK law (along with local tweaks) as the Data Protection Act 2018.

The Data Protection Act 2018 enacts the EU GDPR requirements in UK law, which will become the UK GDPR after 31 December 2020. So, technically no, but in practice, yes.

AIUI Chapter V requires that, eg deletion, needs to be achievable under a binding and enforceable contract when data is outside the EEA.

Is that possible with companies in USA? How?

Agree, before changing office suite try changing adviser

Pretty hard to change the trustee of a UK charity. https://www.gov.uk/guidance/charity-trustee-whats-involved

> Trustees have overall control of a charity and are responsible for making sure it’s doing what it was set up to do. They may be known by other titles, such as:

    directors
    board members
    governors
    committee members

> Whatever they are called, trustees are the people who lead the charity and decide how it is run. Being a trustee means making decisions that will impact on people’s lives. Depending on what the charity does, you will be making a difference to your local community or to society as a whole.

> Trustees use their skills and experience to support their charities, helping them achieve their aims. Trustees also often learn new skills during their time on the board.

Legal basis is the GDPR, however it's possible to use services outside the UK/EU if similar data protection is possible. For the US this is not the case, at least this is the ruling of the CJEU. Google would have to provide additional guarantees to protect the data. The case is identical for Microsoft 365.

I would advice for Nextcloud and Onlyoffice. If you are hardcore data protection.

Google allows you to choose to have your gsuite data stored in the EU.

Thus is true for some SKUs, but not for nonprofit version. Must be Business, Enterprise or Essentials I believe.https://support.google.com/a/answer/7630496?hl=en

Besides the G Suite for Nonprofits Google also makes available G Suite for Nonprofits Business and G Suite for Nonprofits Enterprise which are actually just discounts on the regular Business and Enterprise products rather than the distinct G Suite for Nonprofits. I believe with these you can select the location of data storage.

Even if the data is stored in the EU, Google (or Microsoft for that matter) does not guarantee that data cannot be accessed from the US. That makes sense, since most of their operating staff is probably based in the US, but does mean that it is not GDPR-compliant, no matter what Google says about that. Google states that they are using the SCCs now Privacy Shield has been invalidated, but as Google US is an entity under reach of FISA I highly doubt that they can provide the necessary safeguards required under the GDPR and the SCCs.

"GDPR requires [blank]" is the new "HIPPA requires [blank]" and "FIPS requires [blank]" and in the case of all three these statements are often/usually/always wrong.

She'd probably prefer this route the most, since she'd ideally not have to move (the FSF-member in me be damned). Is this really a myth? I've heard of so many local councils and other public organisations flocking to Office365 for 'reasons of GDPR'.

> 'reasons of GDPR'

This joins a long list of bullshit reasons to do things, that often isn't based in understanding of what The Thing is actually requiring.

"Computer says no", "health and safety", "more than my jobsworth", "data protection", "safeguarding", "the regulator says", etc etc etc.

Urgh I'm currently battling migrating a large SASS app from GCP to Azure for these same non reasons.

Office365 is not a solution under GDPR.

I am in touch with other DPOs and our federal dpos - the big elefant in the room is Microsoft and Windows 10. Everybody knows that you can't use it if you follow the GDPR or at least you have to jump so many loops that it is practical impossible.

The federal DPOs advice against Teams and OneDrive so Microsoft gets the message but if the CJEU looks at Windows from a GDPR perspective Everybody had to stop using it.

Could you clarify what the issue with Microsoft and Windows 10 is? I have no reason to doubt you, I would just genuinely like to know what to look out for.

If you use Windows 10 you accept the Terms and Services [0]. This also includes the Data Processing Addendum. So there is a legal basis for Microsoft to send Data to the US. Since Microsoft falls under FISA it has to give data to the authorities with no chance to appeal for the data subject. This violates the GDPR.

Ok this is the legal stuff.

Here is the technical stuff [1]. In short: Windows 10 sends all kind of data including whole documents to Microsoft USA and you can't stop it using the OS but have to apply Firewall rules and DPI.

So if you really want to use Microsoft you have to make a Data protection impact assessment for each new version of windows 10. I know no one who does this. But if you ask the federal dpo they will tell you that they can't say if you can use windows 10 for this or that but you should asses it yourself using a data protection impact assessment.

I just hope nobody will ever touch this sticky ball

[0]https://www.microsoft.com/en-us/licensing/product-licensing/...

[1]https://www.bsi.bund.de/EN/Topics/Cyber-Security/Recommendat...

There is an explicit exemption in the GPDR for law enforcement and national security. See https://ico.org.uk/for-organisations/guide-to-data-protectio...).&text=However%2C%20it%20is%20covered%20by,for%20national%20security%20and%20defence.

EU Law Enforcment and EU national security and it has to be comliant with basic human rights.

In paragraph 183 of C-311/18, the CJEU also found that US surveillance “in transit” (like “Upstream” or taps of the underwater cables) violate EU fundamental rights.

This is incorrect.

Windows is GDPR compliant. See section 3 of https://docs.microsoft.com/en-us/windows/privacy/windows-10-...

GRDP compliance isn't too bad for a company like Microsoft who has decent data auditing ability. It's pretty easy for them to give you your windows data and delete it if required, and that's what is required for basic GRDP compliance.

If there is public advice otherwise a citation would be useful.

Note that your subsequent comment claiming that FISA request make GPDR compliance impossible is also incorrect as they are explicitly excluded (as law enforcement) by the GPDR: https://ico.org.uk/for-organisations/guide-to-data-protectio...).&text=However%2C%20it%20is%20covered%20by,for%20national%20security%20and%20defence.

So Microsoft states itself compliant? Ok...

Official citation:

Dutch DPA

https://autoriteitpersoonsgegevens.nl/en/news/dutch-dpa-micr...

THere is a excemption for Law Enforcement but it even law enforcment has to comply with basic human rights:

In paragraph 183 of C-311/18, the CJEU also found that US surveillance “in transit” (like “Upstream” or taps of the underwater cables) violate EU fundamental rights.

From an update on the very same site:

"Microsoft plans to rectify the situation through the next Windows 10 update in April 2018. This will end the violations noted in the Dutch DPA’s investigation report.... Microsoft has agreed to do this, and the Dutch DPA will monitor implementation."

https://autoriteitpersoonsgegevens.nl/en/news/privacy-window...

"In transit" US surveillance applies to all providers (including non-US providers) so doesn't preclude Microsoft.

This is true for all US basee Companies who fall under FISA not just Microsoft.

As you stated Microsoft can and will update its Practices to be more Compliant if enough pressure is applied.

I have more citations and also newer but they are in German.

Office 365 and Schools: https://datenschutz.hessen.de/pressemitteilungen/zweite-stel...

Checklist on Videoconferencing (including Teams): https://www.datenschutz-berlin.de/fileadmin/user_upload/pdf/...

And on the technical side:

https://www.bsi.bund.de/EN/Topics/Cyber-Security/Recommendat...

The Berlin DPO stated that Microsofts Data Processing Addendum is not Compliant with GDPR (second link) so wherever it is applied you are also non compliant as data controller.

Ok this is all heavy on Microsoft and I am not stating that any other company is better off. The bottom line is this: US Law violates the basic human rights guaranteed by the EU - there is no appeal for non-US citizens and the "full take" of all data is disproportionat. If you can not shield EU citizens from the regarding US Laws you can't use an US Service.

Thats the consequence from the CJEU ruling.

I didn't read all these and I don't speak German but the gist of https://datenschutz.hessen.de/pressemitteilungen/zweite-stel... is close to the opposite of what you claim.

It says they will allow the use of Office 365 in schools.

Yeah sorry for the german sources.

It's not as much as allow but tollerate if certain prerequirements are met e.g. not sending any diagnosis data to Microsoft. And it sounds more like they are somewhat pressured into it. Intensive talks...

Reply on news.ycombinator.com