I'm fairly confident that data encrypted over the wire and only decrypted locally on the user's machine, shared willingly with the intended recipient, would not violate anything of interest (clearly, European companies can serve pages to the US). Of course, there are many more ambiguous cases than that (like, where exactly can metadata about which Europeans are allowed to view an American's posts be stored? Is that PII?), but the specific case of serving a post is not really all that complicated.

For those downvoting me, I'd love to hear why you think it's more complicated than that. Contrary to popular belief, the people who wrote the GDPR are pretty technically sophisticated and understand that data on the internet has to move between countries from time to time.

Let's take a more complicated example, that is one of the main things that happens on Facebook:

1. Sam makes a post.

2. FB predicts Pat will comment on this post if they see it.

3. Pat sees the post, and writes a comment.

4. FB predicts Alex will reply to Pat's comment if they see it.

5. Alex sees the comment, and writes a reply.

To show why data transfer is such an issue, assume Sam, Pat, and Alex are all in jurisdictions with EU-style privacy regulations and that don't have data transfer agreements with each other.

How would you build a system that supports 1-5, a user journey that is core to Facebook's usage, in a way compliant with these regulations? For example, where is the discussion stored? Where do the models in (2) and (4) run?

Insofar far as I understand GDPR, models (2) and (4) can run anywhere, provided that the data are ephemeral, encrypted in transit, and their output decision cannot be queried later (e.g. by logging a relationship between the input to the model and the eventual message delivery that includes PII like IP). The question of "where is the discussion stored?" would indeed be problematic if it were not possible for it to be encrypted in such a way that a key from both countries was needed in order to reveal the conversation plaintext, but I don't see a clear reason why that should not be possible (it may not be how Facebook actually stores conversations now, of course, but it is not a technical barrier).

As far as I can tell, the really difficult aspect here is how and where to permanently store the fact that the two users are talking to each other once the comments are actually made, since the mere fact that they are talking to each other demonstrates a relationship between them which may be considered PII in some contexts. Or at least, it would be difficult if the US also had privacy laws like the EU's, and IMO any coherent solution should be able to work if the US adopts something like GDPR. Unlike the message contents, this is quite difficult to store in a privacy-preserving way. I think the discussion would be more interesting and feel less like attacking a strawman if people were to focus on the interesting questions like this one, rather than the extremely uninteresting question of whether Facebook can serve posts to the US at all (which it obviously can).

I live in the US, I have several friends that live in the EU. "Who our friends are" is unquestionably PII. Is this friendship graph something that must reside in the US or EU?

Yes, that was the example I brought up as something more complicated. This does not really have anything to do with the fact that data has to eventually be transferred to the US though, which is what the majority of this thread seems to be about. I suspect that a good answer to this is quite complicated, but it's worth looking at the work Signal has been doing to protect this sort of data in a reasonably privacy-conscious way.

One option would be to serve this data directly from the European server. However, it's not the public profile data which most people object to be shared, it's the tracking/user-profile data which FB collects in the background.

> If a user in Florida tries to view a post by a user in Germany, doesn't the German user's data have to leave the EU?

> One option would be to serve this data directly from the European server.

What do you think happens with the data when you "serve it directly from the European server" to a user in Florida?

Exactly, it leaves the EU to go to Florida. ;-)

People in the EU can explicitly share data with other people, they aren’t trying to take down the phone system.

Yeah, to the user who requested it. Also, it's just the user's post, not the user's tracking/advertisement data.

So the only thing the US government could get, are the public facing posts/images which the user posted but nothing more. If the profile is private, even less. No messenger data (except when send to users in the US).

You can access EU-served data from all over the world, that's not a problem. What's in question is bringing data from EU residents outside of the EU to process it.

Yes (and this is fine - because you're sharing that post with a certain audience). But the issue is all the metadata that comes and goes with it.

Right, the people at Meta aren't stupid. They understand fully will that users posts aren't the issue, but steering the debate in that direction would make the EU look unreasonable.

Meta could be more accommodating to the wishes of the EU and place a greater focus on privacy, but that would mean changing how they do business. Meta clearly don't believe that it's possibly for their businesses to be profitable without data mining the crap out of their users. I know it's not a popular opinion, but business like Facebook and Instagram are the direct reason why the EU feel the need to step in and regulate.

It doesn't need to be on a US FB server

Data on the internet always travels all over the globe.

It's where the data is stored and kept that is at issue.

Inherently isn’t the data stored and kept everywhere it’s accessed? If you’re in Germany and are a German your message sent to me just now also now is being stored where I’m located to even read it, no?

In terms of this discussion, stored doesn't mean on an end user device, nor in ram on servers, or temp caching, while serving content.

You guys are just playing with semantics.

In terms of this context, easiest way would be to shard db infrastructure. Not even a remotely big deal for Facebook, with their size.

Hell, they should already want this, to avoid costly, and high ping time, intercontinental links.

But oh nooos, so hard to do. Absurd.

It’s not semantics, though. If I saved everything I ever read onto a database, indexed uniquely by website schema, how does anything change? The point is the same.

I don't get what you are saying. DB schema is irrelevant in terms of where the database backend is stored.

My point is I could just as well have a local database and permanently persist everything I see on the web, no? The same point applies.

Think about internet archive, BitTorrent dumps of Facebook, etc.

This is where lawyers, regulators, and engineers can reasonably disagree with very serious consequences for governments, shareholders, and ultimately citizens.

If you're in a given geography/regulatory regime, and you read something on your smart phone, technically you were served that via some cell tower or ISP, those bits transited that infrastructure. In the US there's a massive clot of regulatory blockage working it's way slowly through the bowels of government around the term of art: "common carrier".

As with many things that devolve into nitpicking, there is a deeper issue: the EU is increasingly regretting becoming the host to, ironically, European-style colonialism on large-scale consumer Internet platforms. The PRC has its own Google, Twitter, Facebook, etc. The EU has Google, Twitter, Facebook, etc. and doesn't love that US companies and regulators are kind of driving the digital lives of the citizens.

The proximate tussle is about the durability of the storage involved. As a European regulator I might be much more comfortable with a write-through cache like TAO holding messages, or FBIDs of messages, including a German in the chat than I am with all such chats being held on a DFS in Prineville among other places, and having them ground over by a Spark or Hadoop job in Forest City among other places.

They'll kick it around and come up with some compromise that will serve end-users by accident at best. Europe won't develop a homegrown consumer Internet industry in our lifetimes. The odds are both US and EU legislators and regulators will miss a step and it'll be ByteDance everywhere by the time anyone reads this :)

Not on their servers though. If the data is in your browser, it's not trivial for e.g. Facebook to then go an do nefarious things with that data at scale. This is how I understand it.

My point isn’t Facebook in particular, but more generally around data residency. Inherently data must be saved and stored to all who access, no?

Wouldn’t the true solution simply be for those who don’t want other regions to save to simply not have access, e.g firewall?

My understanding was that it's about where the data resides. That assumption may or may not be true. But if it is it's feasible for EU data to be stored in the EU and US users request that data from the EU server. Again, my understanding was that this would be a valid way to handle that data but I might be wrong.

Your understanding is correct, but my point is that inherently if US people can access EU profiles inherently some EU data will be stored in the US.

It would then been trivial for someone to crawl EU pages and rebuild the corpus of data.

The only real solution is to firewall off regions and prevent those users from accessing anything other than their own.

This is already what some countries like China do, for instance

I don't think this is what the EU is requiring even though it is possible to scrape EU data. Facebook is pretty good at preventing scraping though.

That is correct, as well as caching.

I'm sure we'd all benefit from hearing the TurtleCoin guy expound on how one goes about multi-national regulation of terrabits/s of multi-layered write-through caching ranging from extremely cold storage on custom hardware to the POP sitting in a Munich suburb and where exactly the line should be drawn on data custody in that setting.

Enlighten us?

That's one issue. Another more complicated issue is which country's legal authority does the owner of the data have to respond to. If the answer is USA, then the data can be requested by this government regardless of where it's stored...

Just for clarification, GDPR does not prohibit in any way that privat personal data leaves the EU (obviously). However, if you want to transfer privat personal data out of the EU you have to certify it still conforms with GDPR (this can be self certified).

Yes, however, as in China, if EU wants their own internet, having their own internet is an option, however extreme.