GOOGLE PLANS TO MOVE USER INFO OUTSIDE EU

[nettihen]

How does this impact schools storing data on the cloud?

 

https://www.reuters.com/article/us-google-privacy-eu-exclusive-idUSKBN20D2M3

[timbo343]

from reading another source, it looks like the same EU GDPR law remains the same: https://www.belfasttelegraph.co.uk/news/uk/google-uk-user-data-not-at-risk-from-post-brexit-move-to-the-us-38974616.html

[Ditto]

It's not very convincing is it? If they are sticking to the same rules, why move? Is there a cost saving? I know Google's international internet connections are high performing, but surely nearer is better? I wonder what government view is on this. Also, we need to know what applies to personal accounts versus the wider school use of GSuite accounts which is getting quite a bit of focus at present. Edited February 21, 2020 by Ditto

[nettihen]

I agree with you Ditto. Would be interesting to know Government and ICO take on this particularly in view of schools. It’s all well and good Google commenting that they will apply same rules but where’s the enforcement?

[jthompson]

I suspect our govt may be broadly in favour of the move as it may end up easing the mechanisms by which the security services can get as user data.

 

From Google's perspective, it means that UK data needs only be processed in line with UK GDPR, rather than both EU and UK GDPR. In time, EU and UK GDPR could start to diverge bit by bit. Enforcement would be down to UK regulators, just as it is now, but with arguably less weight behind it if the EU courts aren't in the picture.

[Ditto]

I suspect our govt may be broadly in favour of the move as it may end up easing the mechanisms by which the security services can get as user data.

 

From Google's perspective, it means that UK data needs only be processed in line with UK GDPR, rather than both EU and UK GDPR. In time, EU and UK GDPR could start to diverge bit by bit. Enforcement would be down to UK regulators, just as it is now, but with arguably less weight behind it if the EU courts aren't in the picture.

Is there such a thing as UK GDPR? I think divergence in the future is a possibility. Any UK company storing data of EU citizens will require to adhere to GDPR. It's an oddity that those same companies storing data for UK citizens may be able to get away with a lower level of protection.

[Theblacksheep]

Is there such a thing as UK GDPR? I think divergence in the future is a possibility. Any UK company storing data of EU citizens will require to adhere to GDPR. It's an oddity that those same companies storing data for UK citizens may be able to get away with a lower level of protection.

 

It's signed into UK DPA law.

 

Well, we are no longer EU citizens and current UK data is stored in the UE (Ireland) which might be problematic because we are (stupidly) heading for No Deal.

 

Gsuite for education is not the same as Google private accounts as is not impacted by this change. Additional Google services outside of gsuite (youtube, maps) is.

Edited February 21, 2020 by Theblacksheep

[localzuk]

This is very much just about limiting jurisdiction. Google, if they operated in only in the US would only be subject to US laws. Operating in the EU, they are subject to both the EU laws and individual member state laws, as well as US law. For UK customers, now we're out of the EU, it makes sense as an entity for our data to be handled by either a UK entity, or a US entity, not an EU one - so, for any legal issues with UK entities, they would only have to worry about UK and US laws.

 

Its just to simplify their compliance for UK customers really. Won't actually make any difference in reality, until UK laws change somehow. The big question coming up is how UK law will handle US data processing, as the "Privacy Shield" is an EU agreement, not a UK one. The ICO and the US say this would be a case of the non-UK providers adding UK to their declaration, but I suspect it will play out in courts anyway. Plus any future trade deal may well change things too.

[Ditto]

To look at this a slightly different way. If Google still have to abide to UK law, and UK law still requires adherence to GDPR regulations, from a GDPR perspective I can't see the benefit (purely from a GDPR perspective. I can see perhaps from other legal requirements, it has benefit, but not for GDPR. I guess it's worth asking why data was stored in Ireland in the first place?

 

Your point on Privacy Shield is an interesting one. It does apply beyond the EU, e.g. EEA - I guess it wouldn't be impossible for us to be added to that group.

[jthompson]

To look at this a slightly different way. If Google still have to abide to UK law, and UK law still requires adherence to GDPR regulations, from a GDPR perspective I can't see the benefit (purely from a GDPR perspective. I can see perhaps from other legal requirements, it has benefit, but not for GDPR. I guess it's worth asking why data was stored in Ireland in the first place?

 

Your point on Privacy Shield is an interesting one. It does apply beyond the EU, e.g. EEA - I guess it wouldn't be impossible for us to be added to that group.

 

The UK is basically running with a forked version of "GDPR" at this point. Nobody knows how much the data protection laws either side of the Irish sea might diverge in future, so having UK data held outside of the EU allows Google to absorb those changes more readily as and when they come along.

[gh5000]

Just picking up on points by @Theblacksheep and @Ditto on storage locations and internet connections.... In a education domain anyway your data can be held anywhere in the world with Google. It doesn't have to be in Europe/Ireland. Although it's likely your primary copy of data will be held in data centres geographically close to where you typically access your data for latency reasons, your data (especially redundant copies) could be held in Google data centres throughout the world.

 

If I remember right there are 6 criteria for storing data outside of the EU. Only one has to be met for it to be legal and Google comply with 5. One is the model contract clauses which a super admin can approve in your domain

[GrumbleDook]

There are areas being contested about how Google use data and whether they are making decisions or not.

 

The main things to remember are

that they are still subject to UK law, schools need to be careful about the use of the additional services by school accounts and that the biggest areA to be mindful of is what users upload and share within G Suite ... sending access links to the wrong people is always going to be a problem!

[kingoranks]

Well, this is not going to go down well with our GDPR officer as we move fully to G Suite.

[paulkerton]

Well, this is not going to go down well with our GDPR officer as we move fully to G Suite.

Why? It still complies with GDPR and the idea that "Google is moving your data outside the EU" is a classic example of a scaremongering clickbait false "fake news" headline. That isn't how this technology works. In the slightest. Your data will always be held on the three nearest data centres to wherever you are, as you travel.

 

It is literally a classic example of FUD.

 

The only difference that this law creates is that Google LLC are now the service provider instead and data controller, and are responsible for the application of UK law instead of Google Ireland Ltd. Your data will still be held in exactly the same way as before and be managed in the same way as before.

 

When it comes to it, absolutely nothing changes at all unless the UK government changes the data privacy laws moving forward to be in line with US data protection laws instead of the EUs.

[GrumbleDook]

Why? It still complies with GDPR and the idea that "Google is moving your data outside the EU" is a classic example of a scaremongering clickbait false "fake news" headline. That isn't how this technology works. In the slightest. Your data will always be held on the three nearest data centres to wherever you are, as you travel.

 

It is literally a classic example of FUD.

 

The only difference that this law creates is that Google LLC are now the service provider instead and data controller, and are responsible for the application of UK law instead of Google Ireland Ltd. Your data will still be held in exactly the same way as before and be managed in the same way as before.

 

When it comes to it, absolutely nothing changes at all unless the UK government changes the data privacy laws moving forward to be in line with US data protection laws instead of the EUs.

 

The school is Data Controller for G Suite for Education ... the question is about the additional services and the application of legislation there. To be fair, the education team at Google are switched on and sorting out who to speak with on this. I am sure we will see more information soon. Some schools *will* need to look at DPIAs, and also need to think about the additional service.

[paulkerton]

The school is Data Controller for G Suite for Education ... the question is about the additional services and the application of legislation there. To be fair, the education team at Google are switched on and sorting out who to speak with on this. I am sure we will see more information soon. Some schools *will* need to look at DPIAs, and also need to think about the additional service.

Hands up. I meant to type Data Processor. Clearly I'm tired.

My point still remains, that until the UK changes it's data protection laws, then by all intent and purpose nothing changes, and with Northern Ireland and it's half-in half-out scenario it makes things harder to change in regards to data protection and relaxing those laws.

 

Now there may be issue with the CLOUD Act but thats a different thing entirely!

Edited March 3, 2020 by paulkerton

[Ditto]

CLOUD Act - yes, something that adds to the dynamics, possibly? I've spun off a thread to discuss: http://www.edugeek.net/showthread.php?t=213932

[SimonHooker]

This sounds like it may be covered in a similar way to AWS services. They published guidance, https://aws.amazon.com/compliance/gdpr-center/brexit/, which indicates that currently their standard contractual clauses are sufficient in any case. The same document also mentions that transferring in/out of the EEA is covered within Standard Contractual Clauses. I would assume that Google has similar clauses which in turn would cover this move. I am not a lawyer though, so it may be there's something I've not been aware of.

 

It does seem odd though, as mentioned having the data further away from the point of use feels inefficient.

[EduDataPro]

Just picking up on points by @Theblacksheep and @Ditto on storage locations and internet connections.... In a education domain anyway your data can be held anywhere in the world with Google. It doesn't have to be in Europe/Ireland. Although it's likely your primary copy of data will be held in data centres geographically close to where you typically access your data for latency reasons, your data (especially redundant copies) could be held in Google data centres throughout the world.

If I remember right there are 6 criteria for storing data outside of the EU. Only one has to be met for it to be legal and Google comply with 5. One is the model contract clauses which a super admin can approve in your domain

 

Similar to Office365, Gsuite Education accounts can set their 'geographic location for your data' in the admin settings https://support.google.com/a/answer/7630496?hl=en. Settings can be 'no preference (default), Europe, United States'. No option currently for 'UK'. I understand that Google will be sending out a message to all admins shortly confirming that Gsuite for Education core services are not affected by this change of jurisdiction.

[paulkerton]

It does seem odd though, as mentioned having the data further away from the point of use feels inefficient.

It would be strange, if that was what was happening. But it isn't. Google LLC are becoming the service provide and data processor as a legal entity for UK consumer customers, instead of Google Ireland LLC.

Other than that there are literally no other changes. Your data will still be stored in Google Cloud just like it is now. Three closest data centres from wherever you're logging in from.

 

- - - Updated - - -

 

Similar to Office365, Gsuite Education accounts can set their 'geographic location for your data' in the admin settings https://support.google.com/a/answer/7630496?hl=en. Settings can be 'no preference (default), Europe, United States'. No option currently for 'UK'. I understand that Google will be sending out a message to all admins shortly confirming that Gsuite for Education core services are not affected by this change of jurisdiction.

Only for Enterprise customers.

There is no option for UK, because Google don't have a data centre in the UK.

Edited March 4, 2020 by paulkerton

[EduDataPro]

Message going out to all admins shortly:

Hello G Suite for Education Administrators,

Recently, we sent you a notice about our updated consumer Terms of Service that will become effective on March 31, 2020.

As a G Suite for Education user, we want to clarify that G Suite for Education Core Services are not affected by these changes. The G Suite for Education Terms of Service, the G Suite Data Processing Amendment and our Model Contract Clauses have not changed. You can read more about our privacy commitments & data protection practices for Google Cloud on our GDPR Resource Center.

Please note that the changes to our updated Terms of Service (including the change of service provider from Google Ireland Limited to Google LLC) will apply to the Additional Services that some of your users may be using (such as Maps and Blogger). You can view and control access to these services in your Admin console under ‘Apps’ > ‘Additional Google Services’.

Learn more about our Terms of Service

Customers can always check their Terms of Service in the Admin console to verify that the contracting entity for G Suite for Education is Google Ireland Limited. To find these terms:

 

• 
  
  • Log into admin.google.com
    
  • Open the menu on the left-hand side
    
  • Scroll to the bottom, to where it says “terms of service”
    
  • Open the G Suite for Education and G Suite for Non profit terms and conditions
    

Customers can also review the Data Processing Amendment and Model Contract Clauses in the Admin console which can be found here.

We’re here to help

Further information regarding GDPR and International Data Transfers can be found here.

If you have questions or need assistance, please contact G Suite support.

Thank you,

 

The Google for Education Team

[EduDataPro]

Only for Enterprise customers.

There is no option for UK, because Google don't have a data centre in the UK.

 

Yes Enterprise accounts including 'Enterprise for Education' users. Good point on the lack of UK data centre, I thought there was one in London but it's Dublin only.

https://www.google.com/about/datacenters/locations/

[PlantHead]

This is a worry .

The US has rights to view any data stored in locations under its jurisdiction without notice to the person.

If the data is stored in non-US data centres then the US has no rights to see that information.

Need to read a bit more about it but certainly there are businesses that will not want their data stored in the US

Edited March 4, 2020 by PlantHead

[localzuk]

This is a worry .

The US has rights to view any data stored in locations under its jurisdiction without notice to the person.

If the data is stored in non-US data centres then the US has no rights to see that information

Not according to US laws. Basically, the CLOUD act gives the US govt rights to see that information if the company storing the data is a US owned entity. Eg. Microsoft UK Ltd or whoever. The act provides some mechanisms to challenge such requests, but overall the companies are subject to US requests wherever they put their servers. So, this change makes no difference to US government access to our data - they were legally able to get it before this change, and are still able to get it now.

[paulkerton]

This is a worry .

The US has rights to view any data stored in locations under its jurisdiction without notice to the person.

If the data is stored in non-US data centres then the US has no rights to see that information.

Need to read a bit more

 

You clearly do, because what you've said is not true.

 

The US under the CLOUD Act have the right to subpoena or serve a warrant to get data from US companies cloud servers, and have that right for any server ran and maintained by a US company on any server they operate, no matter where in the world the server resides.

 

However, companies still have the right to challenge that warrant/subpoena based on the laws of the country in which that data is stored.

 

From the US point of view, data stored in a non-US data centre by a US company is under exactly the same legal situation as data stored in the US.

 

And furthermore, once again, data is stored by Google is on the three nearest servers (none of them are in the US, unless you go there and login to Google) and has to be kept to the standard of the country the person resides from under GDPR. GDPR law states this, both the EU Regulation and each countries own passing of said data into law.

 

So the only time your data would end up on US data centres is if that you login from the US, and then they have to treat that data as if it's in the EU.

Americans can subpoena/warrant your data even if your data was stored on a Microsoft Data Centre in Kuala Lumpur, because Microsoft are a US company.

 

So if they subpoena a US company for UK data that is on US companies servers, they'd have to follow the UK law on retrieving it. So Google/Microsoft et al would refuse because of GDPR, then the US would have to go court in the UK to get right to access that data.

 

So basically, absolutely nothing changes and this is just fear, uncertainly and doubt. Full FUD.

 

- - - Updated - - -

 

Not according to US laws. Basically, the CLOUD act gives the US govt rights to see that information if the company storing the data is a US owned entity. Eg. Microsoft UK Ltd or whoever. The act provides some mechanisms to challenge such requests, but overall the companies are subject to US requests wherever they put their servers. So, this change makes no difference to US government access to our data - they were legally able to get it before this change, and are still able to get it now.

Except under GDPR, that data has to be stored as if it's in the country of origin, so the US would have to go to the country's court to get access.