undefined | Better HN

0 pointsineedasername4y ago0 comments

Yes, I suppose you're right, at least so long as they actually host their data in the EU.

But what happens when senior data scientists at Google want to do some analysis? Each dataset for each global region can't remain fractured from each other. The subsidiary may not have to hand it over to the US government but does the GDPR prevent data from leaving the EU zone? If not, then local copies in the US would be exposed.

I think there would be a lot of loopholes that needed to be closed. "Will be" a lot might be the better choice if words if France's decision becomes guiding legal doctrine in the region.

I don't think Google would willing give up that data either so they could be forced to change their practices to at least get that which allowable under EU law. And I don't want to get too slippery slope in this, but that could mean privacy-minded services begin using servers in the EU as an added layer of user privacy.

0 comments

pg_12344y ago

You're making the mistake of assuming that "something can't happen" if it is inconvenient for the business. The convenience of the business is irrelevant - it must operate within the law.

And yes, GDPR prevents data from leaving the EU zone if there is then a possibility that GDPR could be violated. That's the crux of the recent court cases in Austria and France. You may not collect GDPR protected data if as a consequence of that collection there is a reasonable prospect GDPR will eventually be violated by ANYONE.

For your example case, all initial data processing would have to physically occur within Europe, performed by a subsidiary not subject to US law, and only after they had reduced it to aggregate data that could not be reverse engineered to get GDPR protected data would they be permitted to export it to America.

j / k navigate · click thread line to collapse