united-states united-kingdom data-storage
Is it legal to collect data as a UK company that operates a US server?
<p>I'm a little confused with how the safe harbour law works out.</p>

<p>Related article: <a href="http://www.bbc.co.uk/news/technology-35471851" rel="nofollow">http://www.bbc.co.uk/news/technology-35471851</a></p>

<p>How does this law affect UK businesses that operate an external server that is in the US? Which of the UK or US law take effect?</p>

<p>For the basics of the (now annulled) Safe Harbor Decision I direct you to an <a href="http://www.theguardian.com/technology/2015/oct/06/safe-harbour-european-court-declare-invalid-data-protection" rel="nofollow">article</a> by The Guardian explaining the significance to various companies. The gist of the new agreement is quite well presented in the BBC article you linked.</p>

<p>Your question, whether the data will fall under UK or US jurisdiction, is exactly in the center of the concerns that lead to the Court of Justice of the European Union to annul the previous Safe Harbor Decision.</p>

<p>A company established in the UK operates generally under UK law, which in turn gets a lot of binding legislation from the European Union. EU legislation that comes in the form of Directives, binding as to the objectives but leave the Member States some leeway in implementation, need to be transposed to national law by the Parliament. Directive 95/46/EC, the Data Protection Directive, was implemented in the UK by the Data Protection Act 1998. UK companies must hence comply with the domestic data protection legislation that has roots in European Union legislation.</p>

<p>Another major source of data protection-related safeguards is the Charter of Fundamental Rights of the European Union, which was elemental in the Schrems case (<a href="http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=169195&amp;pageIndex=0&amp;doclang=en&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=769284" rel="nofollow">C-362/14</a>) that lead to the annulment of the Safe Harbour Decision.</p>

<p>The US company hosting the server (or providing a PaaS service) has to comply with US laws, but falls also under EU laws when it processes personal data collected by an EU company - or data collected from EU citizens. This provides for an interesting conundrum starting from the point when Snowden revealed the mass surveillance conducted by the NSA: if the US company is obliged to allow access to the data on its servers without a court order, but is not allowed to do so under EU legislation - namely the Safe Harbor guarantees they've made to be able to process the data at all -, then who's the one calling the shots?  </p>

<p>As long as the servers are physically located in the US, there's little doubt that any surveillance can be quite effectively pursued even if the company is hesitant about the matter, and therefore any guarantees given to the EU about due process are aspirational at best. </p>

<p>We got thus far without going into any general debate on "state sovereignty in the Internet age".</p>

<p>Hence the Schrems case, hence annulment of the Safe Harbour, and hence now the EU-US Privacy Shield.</p>
