The GDPR and privacy legislation. We’ve heard these terms mentioned frequently in recent years. For example, personal data processed by organizations in the EU may, in principle, only be processed within the EU. An exception to this was made for parties certified under the EU-US Privacy Shield. However, on July 16, the Court of Justice of the EU declared this invalid. What does this mean for the applications you have hosted in, for example, Google Cloud, Microsoft Azure, or Amazon AWS? Our Security Officer Timo explains in this blog why it’s better to choose a hosting provider within Europe.
The GDPR and the Privacy Shield
In May 2018, the new European privacy legislation, the General Data Protection Regulation (GDPR), came into effect. This privacy legislation sets strict rules regarding the processing of personal data of European citizens by (European) organizations. Among other things, the GDPR states that this personal data may only be processed within the EU. There are several exceptions to this. For data transfers to the US, for example, there was the EU-US Privacy Shield—a kind of certification intended to demonstrate that personal data would still be properly protected. Parties such as Google, Amazon, and Microsoft were among those covered. European organizations using American cloud solutions to process data often relied on the Privacy Shield to justify sending this data to the US.
The EU-US Privacy Shield declared invalid
However, on July 16, 2020, the Court of Justice of the EU decided to declare this scheme invalid, as European personal data would not be sufficiently protected in the US. The reason for this is that the American government would have the authority to access and process data in the US. In short, due to this ruling by the Court, data transfers to the US under the Privacy Shield are no longer permitted as of immediately. The EU member states and the supervisory authorities (in the Netherlands, the Dutch Data Protection Authority) can enforce this immediately. At this moment, they are considering how to deal with this situation.
What does this mean for organizations?
Many organizations make use, to a greater or lesser extent, of American cloud solutions or tools. In many cases, the Privacy Shield was used to justify data transfers. Now that the Privacy Shield has been declared invalid, it is important for companies to assess whether such data transfers are truly necessary and whether there is still a solid legal basis for them. In some cases, so-called “Standard Contractual Clauses (SCCs)” may be applicable to justify the data transfer. However, these do not always suffice. For example, not all services of a provider may fall under them, so processing data in the US remains a risk. If companies still wish to do this, they must have a strong legal basis and be able to justify it thoroughly.
Why hosting within the EU?
Any organization currently using an American provider to process data would do well to consider whether there are good European alternatives. To limit the risks regarding privacy legislation and data transfers to the US, it may be wise to look for a reliable European hosting provider and ensure that all data is processed within the EU. This way, you can avoid potential future problems, such as hefty fines.
Secure and GDPR-compliant hosting at Shock Media
Shock Media is a Dutch Managed Hosting Specialist with a strong focus on IT security and privacy. We demonstrate this by being certified for both ISO 27001 and NEN 7510. Our clients are assured that their data is processed geographically separated, but within the European Economic Area (EEA). We also do everything possible to optimally protect this data, for example through our advanced security monitoring.
Would you like to know more about how we can help you protect personal data and ensure GDPR compliance? Please contact us and we’ll be happy to tell you more about the possibilities!
