gdpr data-protection
What global big tech does to comply with data protection laws all over the world?
<p>Give this scenario...</p>
<p>A user in Germany, a user in US.
Each one decides to create an account on Facebook and facebook is located in US...</p>
<p>According with GDPR, US cannot store data from EU Citizens. So, what does Facebook do (or supposed to do) to comply with regulations?</p>
<p>I am involved in a global project and we don't know exactly what to do in this sense. Can we have a single global server storing user information? If the answer is no: Can we have a single global server storing only usernames and passwords and all the other data such as first name, last name, phone number, etc be stored in each region?</p>
<p>For this I suggested to my team: Let's try to find out what big techs are doing... What happens when Facebook, Apple, LinkedIn, etc earn a new user on the database?</p>

<p>What Big Tech is doing is spending a lot of money on lawyers and appeals – doesn't matter if it costs millions if you can make money in the meanwhile.</p>
<p>Facebook stores a lot of user data in the US. Initially, this was allowed because the US was recognized as offering an adequate level of data protection under the Safe Harbor and later the Privacy Shield Framework. Then Schrems I and Schrems II happened and the adequacy recognition was ruled to be invalid.</p>
<p>Does Facebook pull back their user data? No. The GDPR offers alternative reasons why you might process data in foreign countries, such as “standard contractual clauses” (SCCs) or “binding corporate rules” (BCRs). Now, Facebook claims that they are using SCCs. Is this valid? Almost certainly not due to the issues of US law analyzed in the Schrems II case, but it can take years for the next round of court cases to work its way through the system. And when Facebook's use of SCCs is ruled invalid they will probably try BCRs next, and once that is over a decade will have passed and the US might actually have achieved an adequate privacy level by then.</p>
<p>You do not have Facebook-style money to spend on lawyers and endless rounds of appeals, so you should avoid legally risky things such as outsourcing data processing activities to companies in the US (this doesn't mean you can't be compliant if <em>you</em> are a US entity).</p>
<p>I mentioned adequacy decision previously. There is a <a href="https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en" rel="noreferrer">list of countries</a> that the EU considers to be sufficiently safe. Currently, the more notable countries involve
Canada,
Israel,
Japan,
New Zealand,
Republic of Korea,
Switzerland,
and the United Kingdom,
in addition to EU/EEA countries of course.
If you want to process data in a location that is OK for both the UK and the US, then looking at companies in one of these countries is a good idea.
For example, if most of your users are in the US but you would like your servers to be in a country with an EU adequacy decision, then looking at Canada could make sense.</p>
<p>Even outside of this list, you can process data if you implement additional safeguards via SCCs. However, this requires a case by case analysis of the legal environment in that country. One problem with the US is that it has national security laws that impose requirements on companies in a manner that is incompatible with SCCs. A company bound by these US laws cannot enter into such a contract where it guarantees the privacy of your user's data.</p>
<p>Countries other than the EU have much more tedious data residency laws. The GDPR does not impose any data residency requirements in the sense that data must not leave a particular country – you just have to ensure that the data is properly protected. In contrast, Russia and China have real data residency requirements that are fundamentally incompatible with the GDPR.</p>
