gdpr
Are there any complications in hosting an Italian website on a server in the USA?
<p>I own a webserver that resides in the USA. This server hosts different websites but they all have users mostly from Italy.</p>
<p>One of the websites, a blog made with Drupal, has a .it domain registered with a company called aruba <a href="https://www.aruba.it/home.aspx" rel="nofollow noreferrer">https://www.aruba.it/home.aspx</a><br />
Yesterday I had an issue with he domain and i called their technical support. They noticed the domain was attached to an american server and they told me i could get fined for this due to the european GDPR law but they didn't want to tell me any more details despite me insisting. I don't think they read the privacy statement before saying that because the website was not accessible at that moment (even using the server's IP would not send you to the website, you need to go from the domain, which was not working)</p>
<p>I tried looking on the internet and i found 2 things:</p>
<ol>
<li>That cloud services hosted in the USA might not be good enough to host european websited (which is not my case because i'm not using a cloud service)</li>
<li>If you server is in the USA and you are collecting personal data you must specify that in your privacy statement (still not my cause because I'm not collecting personal data)</li>
</ol>
<p>This is what else i could think of about the website that might be relevant:</p>
<ul>
<li>The privacy statement is a &quot;standard&quot; one i found on the web a few years ago and i've seen it being used on many italian websites</li>
<li>The website does not collect any personal data  by itself (only aggregate data like how many people visited a certain article)</li>
<li>There is a private area but it's for the staff only and it doesn't require email or any data (users are created manually and are for internal use)</li>
<li>It only uses technical cookies</li>
<li>It has Google Analytics attached to it but but it's specified in the privacy statement and the &quot;cookie banner&quot; is configured in a way that will block it until you opt-in</li>
</ul>
<p>The only issue i could think of is that I have not specified in the privacy statement that the site is hosted on an american server but that can be easily fixed.</p>
<p>My questions are: Is what i was told by Aruba's technical support correct? What could be the reason for this risk? What can i do to prevent being fined? Do i have to move my servers to Europe?</p>

<p>When the data controller is from the EU/EEA/UK, the GDPR applies. Any website inherently processes personal data such as IP addresses. Thus, when transferring personal data into the US (e.g. because the website is hosted in the US), it is necessary to comply with the GDPR's Chapter V which covers international transfers. The US hoster would also have to be bound as a data processor per Art 28.</p>
<p>There are multiple legal bases for international transfers into the US.</p>
<ul>
<li>There used to be an “adequacy decision” that allowed transfers without further conditions in the form of the EU–US Privacy Shield, but it was found invalid in the 2020 Schrems II ruling due to concerns about US mass surveillance.</li>
<li>The next alternative are “appropriate safeguards” to protect the transfer, which generally requires that the data exporter and data importer (here: you and the hoster) sign standard contractual clauses (SCCs). But in the wake of Schrems II, it is clear that SCCs alone are not sufficient, and would generally require supplemental measures to protect the personal data. The concern is that an US company would not be legally able to comply with the SCCs they've signed.</li>
<li>Art 49 has fallback legal bases for occasional transfers such as the data subject's explicit consent, which are not useful here.</li>
</ul>
<p>What most people do is pretend like SCCs are sufficient and hope that regulators turn a blind eye, at least until another adequacy decision is negotiated. However, guidance by regulators including <a href="https://edpb.europa.eu/our-work-tools/public-consultations-art-704/2020/recommendations-012020-measures-supplement-transfer_en" rel="nofollow noreferrer">EDPB recommendation 01/2020</a> explains that it's the responsibility of data controllers to analyze their specific transfers, adopt supplemental measures if necessary, or stop transfers if such measures are impossible. To cut the chase short: there are no technical measures that could help in a cloud or SaaS setting, and I would include webhosting in that setting.</p>
<p>As a consequence, it's effectively impossible to be GDPR-compliant while relying on services that store or process personal data in the United States. It would therefore be prudent to migrate an US-hosted website to a server located in the EU/EEA or in a country that has an <a href="https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en" rel="nofollow noreferrer">adequacy decision</a>. Your registrar's information seems correct in this regard, though it is admittedly a bit self-serving for a company that offers web hosting itself.</p>
<p>On to your specific questions/arguments.</p>
<ul>
<li><p>Is all of this irrelevant because you are not using an US “cloud” service?</p>
<p>No. Don't get distracted by the word “cloud”. The issue is that you are using an US-based service that processes personal data in the clear.</p>
</li>
<li><p>Can you avoid disclosing the international transfer because you aren't processing personal data?</p>
<p>But you are most likely processing personal data. The GDPR's definition of personal data does not just include identifying information, but any information relating to identifiable persons. Identification includes being able to single out a person. IP addresses are likely (but not necessarily) a kind of personal data. In any case, your use of Google Analytics sets tracking cookies that definitely allow identification of visitors.</p>
<p>Since you are performing an international transfer of personal data, you must inform the data subjects.</p>
</li>
<li><p>Is copying a standard privacy policy sufficient?</p>
<p>While transparency about processing activities is an important part of GDPR, it is only a part. Other parts include:</p>
<ul>
<li>having a clear purpose and legal basis for processing activities</li>
<li>binding services who process personal data on your behalf as <em>data processors</em> per Art 28 (here: in particular hosting and analytics)</li>
<li>finding and implementing appropriate security measures</li>
<li>having a plan for dealing with data subject requests</li>
</ul>
<p>In any case, the privacy policy must fulfil all points mentioned in Art 13 GDPR. Ideally, it should also cover the information obligations from Art 15. There are <a href="https://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=622227" rel="nofollow noreferrer">guidelines on transparency</a> from the EDPB. If your privacy policy was drafted before 25 May 2018, it likely wasn't updated for GDPR.</p>
</li>
<li><p>There is a staff-only private area.</p>
<p>Whether or not there is any private area is not relevant for GDPR. GDPR is not about protecting private data in contrast to public data, but about processing of personal data, i.e. data that relates to persons.</p>
<p>Also note that the staff members are data subjects as well.</p>
</li>
<li><p>The only cookies are “technical cookies”.</p>
<p>Very good! The ePrivacy directive is closely related to GDPR and addresses what kind of information you may use from user devices, including cookies or similar technologies like LocalStorage. This directive was implemented in the Italian Data Protection Code. You may only use cookies etc if they are strictly necessary for providing the service explicitly requested by the user (such as storing a language preference on your website), or if the user has given their consent.</p>
</li>
<li><p>You are using Google Analytics, but only if the user gives consent.</p>
<p>Since Google Analytics is an US-based service, some of the above concerns about international transfers apply.</p>
<p>Relying on consent is good, though Art 7 GDPR gives some conditions for consent. In particular, the user must have a real choice. While analytics can probably be used without consent, setting cookies for analytics does require consent. As much as I loathe them, consent management tools can be useful here e.g. because they also help with keeping records of consent.</p>
</li>
</ul>
<p>In summary: While you have good data minimization practices, your website likely isn't GDPR-compliant in its current form. You can take some first steps toward better compliance, such as by avoiding unnecessary international transfers and updating the privacy policy to better align with Art 13 GDPR.</p>
<p>Fines are unpredictable. Most data controllers are non-compliant in some way (probably including myself). But most data controllers don't end up getting fined. While fines should be “effective” and “dissuasive”, they also have to be proportionate to the infringement. Many data controllers have been able to substantially reduce or completely avoid fines by quickly remediating compliance issues when being contacted by their supervisory authority. I have yet to hear about a fine for data transfers into the US, but of course I have no idea what cases the supervisory authorities are currently investigating.</p>
