Re:UK to depart from GDPR
by jeroenhd on Friday March 12, 2021 @05:30AM
(#26434160)
> You can store it wherever you want, as long as you're in compliance.
From a GDPR standpoint, compliance means that the country where the data is stored has an agreement with the EU AND you must have enforceable and strong, negative consequences for the foreign party in your contract.
The EU can only make such an agreement for a foreign country if the data protection laws are sufficient. I do not know whether or not the UK laws are considered sufficient, but without any such agreement, you cannot assume that you can just store EU personal data in the UK.
With the death of Privacy Shield and its siblings, this first requirement isn't even the case for the US anymore as the US will not guarantee the safety of EU citizens' information from things like the patriot act. However, I haven't seen any country complain about storing data with Google, Amazon or Facebook yet so I don't think this rule will be enforced any time soon. Technically, though, storing PII in a foreign, non-EU country without the necessary requirements is still very much illegal with the full suite of fines available to the data processing agencies.
From a GDPR standpoint, compliance means that the country where the data is stored has an agreement with the EU AND you must have enforceable and strong, negative consequences for the foreign party in your contract.
The EU can only make such an agreement for a foreign country if the data protection laws are sufficient. I do not know whether or not the UK laws are considered sufficient, but without any such agreement, you cannot assume that you can just store EU personal data in the UK.
With the death of Privacy Shield and its siblings, this first requirement isn't even the case for the US anymore as the US will not guarantee the safety of EU citizens' information from things like the patriot act. However, I haven't seen any country complain about storing data with Google, Amazon or Facebook yet so I don't think this rule will be enforced any time soon. Technically, though, storing PII in a foreign, non-EU country without the necessary requirements is still very much illegal with the full suite of fines available to the data processing agencies.