gdpr privacy
Is storing on EU-based servers sufficient to be GDPR-compliant with regard to the Schrems II arrest if they&#39;re controlled by a U.S. company?
<p>After the Schrems II decision, data transfers to US data processors are increasingly risky at best, for example to public cloud providers such as GCP, Azure, and AWS.</p>
<p>A very common suggestion is to store your data in EU-based data centers of these cloud providers if your application isn't too latency-sensitive, for example in <a href="https://law.stackexchange.com/a/74430/45855">this answer</a>.</p>
<p>I fail to see how this makes a significant difference. All of the major public cloud providers are US companies, and their servers in Europe are still under their control, and so the US government can just as easily demand to hand over data hosted on EU servers as they can on US servers.</p>
<p>In a strict sense of the word, data transfer to the US is indeed avoided, as the data physically remains on EU servers. But in a broader sense of the word, and really in the spirit of the Schrems II arrest and GDPR in general, the data is de facto transferred to a US controlled company the moment when it's stored on any GCP, Azure or AWS server, regardless of where that server is located.</p>
<p>Thus, I feel as though hosting on EU-based servers of US-based public cloud providers doesn't solve anything at all, and simply provides a false sense of security and compliance. Is this correct, or am I missing something?</p>

<p>The tricky bit from a GDPR standpoint is that the US has a law that says a US-based company must hand over data to US government agencies even if the data is stored outside the US. This is US specific and a case where the US government gives itself jurisdiction outside the US but the EU can't directly do anything against it (outside of international negotiations).</p>
<p>As you noticed this means if you store data at a US data processor there is no real difference whether the data is physically stored in the US or the EU. So to avoid transferring EU consumer data to the US several steps are needed. First the servers have to be physically located in the EU and second the company needs to be non-US based, EU based seems the obvious choice. AFAIK constructions of a US-based company creating a fully owned EU-based subsidary are currently used to achieve the second part. Whether this is sufficient may have to be decided in court.</p>

<h1>EU servers don't make you compliant by themselves</h1>
<p>There are many other rules you have to abide by beyond storing the data in the EU - and just not transferring the data to the US just isn't sufficient to make you GDPR compliant.</p>
<p>For example, you have to delete data on request by Data Subjects, and that is only the tip of the iceberg.</p>

<p>Kind of.</p>
<p>A relevant question here is: has an international transfer of data occurred? And if so, who is the controller for that transfer?</p>
<ul>
<li><p>When you store data in US-based servers, then yes, you have made a transfer.</p>
</li>
<li><p>When you store data in EU-based servers, the no, you have not made a transfer.</p>
<ul>
<li>When the cloud provider breaches their duty as a data processor and transfers the data into the US against your instructions, they would have made a transfer.</li>
</ul>
</li>
</ul>
<p>This suggests that using EU-based servers is generally OK from a data transfer perspective, even if they are provided by a company that is subject to US jurisdiction. You are not making a transfer. If a transfer occurs, it's because that cloud provider is breaking the GDPR.</p>
<p>So instead of a Chapter V international data transfer problem, I'd see this as a Chapter IV security problem.</p>
<ul>
<li><p>You as the controller are required to implement appropriate technical and organizational measures to ensure the security and compliance of processing (Art 42, Art 32). If you identify a risk, you have to take appropriate measures. But you can use a risk-based approach here: if a risk is very unlikely, it may be appropriate to do nothing.</p>
</li>
<li><p>You as the controller are required to legally bind your data processors per Art 28 to only use the data as instructed by you. If you are convinced that a potential processor is not legally able to enter into that contract, for example if they are subject to conflicting foreign laws, then you can't engage them as a processor and will have to look for a different company.</p>
</li>
</ul>
<p>Because of the US' CLOUD Act, there is a real concern when using EU-based IT services that are still under US control. Some providers try to address this issue with a trustee solution where the tech is provided by the US company but the data centre is legally under the control of an EU company. But I think of the large cloud providers only Microsoft Azure seriously attempted this, and their Azure Germany service has now been shut down.</p>
<p>In practice, no one cares. Regulators seem to be aware of the massive impact of Schrems II enforcement and are treading lightly – especially since this isn't necessarily a data transfer issue, as outlined above. Businesses will not want to miss out on industry-standard tools for the hypothetical possibility that the US might invoke their CLOUD Act. If businesses are concerned, they can use the many EU cloud and hosting companies, or use supplemental measures such as end-to-end encryption to secure the data.</p>
