Meta facing order from Irish regulator to suspend data transfers to US
irishtimes.com
irishtimes.com
What if it’s cached by a CDN close to users in a third country, say Japan? Is that illegal?
As a scientist I find regulatory over-reach tedious. As a citizen I find corporate illegality unjustifiable. This is not regulatory over-reach this is corporate illegality.
How can anyone be legal, when the laws of different countries are in conflict?
But the profile a companies creates about you, your phone number for 2FA, (group) chats local to the EU, etc. do not fall under this.
Though I'm not sure about public profiles, probably you also should probably be able to select to not share you public profile with the US.
> if user A living in France makes a post
The post data would be stored on a server in France.
> a user B living in America comments on it
The user B's thick client app would have to query all servers all over the world that might hold data they're allowed to see, and then render it. It's up to the servers in each country to decide whether the post should be sent to the viewer in question.
When User B comments, their comment would be stored on a server in the US.
For User A to see the comment, like User B, they would need to connect to all servers in all countries to fetch what data they're allowed to see.
Is this cheap and practical? Of course not. But it's possible, just not in the sense we've come to know social media apps.
When User B comments, their comment would be
stored on a server in the US.
For User A to see the comment, like User B,
they would need to connect to all servers
in all countries to fetch what data they're
allowed to see.
IANAL, but to my best knowledge, holding one-off data in memory is repeatedly defended in European courts as not storing data. This is from the top of my head, so treat it as "probably wrong".
All in all, the whole thing is a bit of a circus, really.
“any information” “relating to” “an identified or identifiable” “natural person”
https://gdpr.eu/eu-gdpr-personal-data/
Ultimately the problem is that the GDPR is written broadly enough to encompass basically everything.
I don't disagree with your general thrust, but I think there's some imprecise terminology here. No, anonymized post IDs are not, themselves, personal identifiers. A simple list of all UUIDs of posts in your table, for example, is not personal data. It can't be used to determine who made a post, there's no time data encoded there. It's just a list of handles to go get data somewhere else.
If you store a user identifier, then it's personal data. Even an anonymized user identifier could be used to perform network analysis if it is used more than once. Using it only once is fine, but at that point it's just a post UUID with extra steps.
Where I will go farther than great-grandparent is that GP is right and you don't have to run a full-scan of everything every time. It would be legally permissible for Facebook to store, in the US, "if you can see post 227, you should lookup the following: comment 383, like 398, comment 442, like 721". As long as there's no association (even anonymized) back to users, knowing that an event happened is not, itself, personal data. Even knowing times is fine, as long as you don't know who did it. That of course has a much broader sense than just storing user ID, you can't store IP address or anonymized user IDs or anything else either, but a list of object UUIDs and relational data between them is not, itself, personal data.
The implication of this is that it would be generally permissible to store what are essentially post-to-comment and post-to-like indexes in the US, meaning you don't have to full-scan everything every time. You can't attach user info to them, and you very obviously cannot just store everything in the US anymore, but storing relational data between non-identifiable objects is legal - of course "non-identifiable" is doing a lot of work in that sentence, but if I tell you "post 227 exists, and has comment 383 and like 398 in my database" that declaration does not, itself, mean that the EU is coming after me for GDPR violations. You don't have the content, and you don't have any metadata other than a completely unidentifiable object tag that cannot be correlated to any user by any means.
It does mean that you'd probably want to partition your data according to some reasonable shape, like localizing comments/likes/etc to the same server, but you don't have to scan everything just to find out if there exists any match ever.
It would also be permissible to store a place where you could go to look up that identifier, as long as it can't be correlated. So it would be fine to say "post 227 exists on shard A123X", as long as that can't be correlated back to something like geolocation. If you can backreference from shard A123X to that post being made by someone in Paris France, that's a problem. If your user-to-server mappings are randomized such that a French user's comments might end up in a server in Belgium, that's probably permissible to store the shard location even inside a US server. If you don't randomize like that, the lookup data would probably have to live in the EU as well.
There is, unfortunately, a huge amount of "don't wanna!" around this issue in the programmer community and on HN in particular. The GDPR is perceived as onerous because it outlaws some data collection practices that generate a lot of revenue (directly or indirectly - such as providing insight to guide decisions), and programmers have decided that means it's impossible to comply. It's not, it's just impossible to comply while doing the things you were doing before, because they were socially harmful and were specifically outlawed by these regulations.
It would be a lot better for industrial businesses if they could just dump their toxic waste in the river too. Their business model doesn't work if they can't do that! Having to comply with EPA regulations and dispose of the waste appropriately is complex and difficult and we can't afford that!
It's the set of users acting on a post that can be used to identify the poster.
Knowing that this is HN thread 30427711 doesn't give you a set of users who acted on that. For example, a hyperlink to this thread, or posts within it, is not personal data.
You'd have to go to the HN server and ask them for the data - which is personal data, but the post ID itself is not, it's just a handle.
Assigning UUIDs randomly instead of sequentially strengthens this further because there is no way to pull out even a time component from the post ID.
In GDPR parlance, that's called "de-identification", not anonymization. Basically, if there's a risk you could piece together someone's identity from abstract IDs, even by combining various abstract IDs and doing some deduction, it's "de-identification". Recent GDPR decisions basically treat de-identified data as a form of personal information and subject it to many/most of the same requirements, including the prohibition on transfers to the US.
(I'm not saying this approach is wise from a policy or technical perspective, but that's the way it is.)
I think the general idea is that Facebook and co. will need to spend their lobbying influence and dollars on getting FISA and the CLOUD act changed to allow them to make the necessary privacy and integrity guarantees for the European user data. And/or for the US to make those changes to get or keep the same kind of market access.
The former is unlikely at best and the latter would require the kind of "giving in" that the US gov does not like to do. I think continual can kicking or eventual EU capitulation is more likely.
I think Microsoft, Apple and others have done similar think to obtain approval for some of their products so is not something new but FB can decide they can pull out or try to work with the other giants to demand that non-US citizens deserve privacy and basic rights.
That being said, GDPR isn't purely a data localization law - that's merely an implication of broader data export rules. If a court were to interpret public posts as private information under GDPR, then the solution would be that the user in America doesn't even see the post, because retrieval would count as a data export.
However, I'm not sure if this interpretation would fly in court. Most of the Schrems II cases focus around analytics, CDNs, and ad-tracking - i.e. the sort of things that just happen automatically and users don't get a say in[0]. Presumably, if a French user wanted to DM an American[1], whatever data transfers are necessary to send that message along would be legal, but nothing further. So we wouldn't be banning Americans off of Facebook, but Facebook couldn't use US/EU messaging as an excuse to ignore GDPR entirely.
GDPR data export rules are not specifically targeted at Americans. They apply to all third countries, America just being one of them. If you pass GDPR in your local law, then unlimited data exports are permitted[4]. However, that would probably require you also have the same data export rules, which would also mean you can't export data to other third countries that don't have them. Furthermore, while I postulated scenarios in which a data export would be necessary in order for the service to work at all, you probably couldn't use those justifications to ship data to arbitrary non-GDPR third-countries. i.e. DMs can flow between America and the EU, but the CDNs probably need to remain in the GDPR-o-sphere or America.
That being said, there is the potential for further legal hijinx. If the US absolutely insisted on "privacy is for US citizens only"[2], they could pass contradictory privacy rules that made compliance with GDPR illegal. This would cut the Internet[3] in half, and make it illegal to offer any sort of service in which Americans and Europeans interact. And the US is the king of making economic sanctions watertight - it's our primary engine of soft imperialism. We don't roll tanks, we just make it very painful for any country to trade with you.
[0] Unless you maintain a really, really victim-blamey definition of the word "User-Agent"
[1] Despite France's stereotypical anglohostility, such people do exist!
[2] This is the current operating mode of most intelligence agencies and trade representatives. Internationalism without international citizenship is a recipe for the erosion of democracy.
[3] Or, at least, the Internet of countries that don't have restrictive national censorship policies
[4] In your specific example, the EU Commission ruled that Japan's data protection law is adequate... but it's not entirely GDPR. And the EU Commission are the same people who thought US Privacy Shield was OK. So at this point I'm going to say get a bunch of lawyers if you really need to know the answer to the question of "can I export data here".
More or less the same curt decisions where already decided 2 or 3 years ago.
It was just that due to legal shenanigans the legal consequences of this decisions where delayed by a few years.
Please do. And also from the rest of the world, while you're at it.
For instance when microsoft "teams" want some professional network of people information for a "prospect" (competition sabotage, ppl to flood with money to get "what" they want, etc, you know: "business"), they just need a dedicated access to "linkedin" data, whereever it is stored (and "linkedin" data servers are theirs). Ofc, if they "partener" with "meta" to cross-share their data, they could also get extra-professional network of people info to be more "effective", or have better corelation. Let's push it a bit further: with "uber eat" (which they own) they could intercept some food delivery for "prospects"... ok, I am going too far now :)
How does it play out if Facebook thumbs their nose at EU regulators and just says "We'll do what we want anyway"?
What if they just shut down their servers / datacenters on EU soil, lay off all Europe-based employees, and set Facebook's DNS to IP's of US-based servers (or otherwise non-EU)?
Could EU courts order European ISP's to block Facebook at the DNS level or blackhole traffic to Facebook IP addresses?
Could the situation reach a point where Facebook executives -- or even rank-and-file employees -- risk being handcuffed and sent to a European jail if they go on vacation to Europe?
Not paying the fines would most likely result in actions like preventing European advertisers from paying for Meta's services.
I suspect it would also open up for outright censorship in some individual member states. There's a lot of politicians who would be happy about limiting their more SoMe-savvy colleagues from using Meta's services to reach voters, or to stop fake news as well as legitimate opposition media.