I read recently that facebook could be moving 1.5 billion EU users data outside of the EU to get round the new EU regulations on GDPR.

Is this legal and how could it be stopped?

Source: https://www.zdnet.com/article/facebook-moving-1-5-billion-users-away-from-gdpr-protection/

  • That doesn't sound right. I do think they have to store that data in Europe. Apr 22 '18 at 12:45
  • @StephanBranczyk Well I read somewhere that that is what they might be doing. I personally don't have Facebook but I think it will have a huge impact on people privacy and data
    – coolio85
    Apr 22 '18 at 12:46
  • You read wrong. Facebook is moving all its users’ data out of the EU except for users in the EU, US or Canada. They could hardly have 1.5 billion users in the EU, which has a population less than a third of that number. techradar.com/news/…
    – Mike Scott
    Apr 22 '18 at 13:13
  • GDPR affects all EU citizens regardless of where they are in the world, even if the data is stored in the US it will still have to follow the guidelines laid out by the new regulation
    – Connor J
    Apr 22 '18 at 14:06
  • 1
    So I think you misread the article. It is explicitely about non-EU customers (excluding US and Canada) , that are currently all impacted by GDPR because of company's headquarters in Ireland. Facebook idea is to move these users data (again non-EU ones) out of EU so that it is not impacted by EU rules. It says nothing about EU customers. But it shows a lot about the principles being applied... catering for the lower denominator of security/privacy for its users... Apr 22 '18 at 19:44

They don't have to store the data in the EU as long as the data is treated in the other country as if it was stored in the EU.

So for example, storing the data in the US is only possible thanks to the EU-US Privacy Shield. That is basically an agreement, that the US will respect the GDPR and other EU regulations for this kind of data.

That being said, there is some amount of controversy around the EU-US Privacy Shield. It may not protect all your rights fully. There are currently lawsuits filed. There however is no way to prevent this other than not using the companies that transfer your data outside EU.

Also, it is hard to enforce such an agreement, as EU officials may never find out about US agencies, such as the NSA breaking the agreement or circumventing it somehow.

PS: If you are looking for services protecting your privacy, you may wish to use services based in Switzerland, where the right for privacy is a constitutional right and any personal data requests from other countries must be confirmed by a Swiss court, in accordance with Swiss law.

  • Ok thanks. So whats the point in them moving the data? Also I hear that Switzerland has good privacy protection laws so I've started to use proton mail rather then Gmail
    – coolio85
    Apr 22 '18 at 14:14
  • @coolio85 For one, they have to, to allow Americans to see your profile and content. Another reason might be, that it may be preferable for them to have all the data in one place, as figuring out what data is where may be complicated. They may also not want to build data centers in EU just for EU customers and so on... Apr 22 '18 at 15:26

Not the answer you're looking for? Browse other questions tagged or ask your own question.