Hacker News Reader

Comment by Beltiras | Hacker News Reader

I am actually the Lead Developer at a medical device company making software that manages patient data from EU citizens. Our answer to this is really easy: Do not host anything in the US. We intend to use AWS. Frankfurt will do just fine, even if it is a bit more expensive.

View on HN

You may want to research requirements for patient data by country.

I am pretty sure you can't store medical data in AWS in France. (if your data actually qualify as medical data according the law, it's hard to know without knowing the details, the exact term is "données de santé à caractère médical" which translates to health data of medical nature)

There, you have to choose from a list of certified providers (thanksfully, OVH is now in the list [1]).

It will probably be different for every country, though you should be able to fly under the radar until you get some traction.

[1] Full list [FR] : http://esante.gouv.fr/services/referentiels/securite/heberge...

We don't have operations in France as of yet. Thank you for the heads-up.

In Germany, you should also be careful with §203 StGB-relevant data [0]. There is no really good legal solution to this. The so-called "Gehilfern-Lösung" has never been tested in court, and is not possible with AWS in any event.

https://dejure.org/gesetze/StGB/203.html

Medical data and AWS? Urks. If you host with an US-company, your data is no more secure then if they were physically in the US. Not if preventions of overreach like Privacy Shield (which was mostly a joke anyway) are dismantled.

Get a EU data-provider!

I work in a startup bank in Norway, and we have been explicitly denied using AWS, Azure or google cloud by the authorities for our data/services because of this.

So there this is not new for us. We are currently using a EU based provider for some of the services and a Norwegian based one for the rest.

We might go for azure now for some processing, but the data we can keep there has to be anonymized to the point where it is almost useless.

AWS is 27001 and 27018 compliant: https://aws.amazon.com/compliance/iso-27001-faqs/

Onli is talking about the potential for US authorities to order US companies to disclose information hosted by them regardless of the location of their services, not the actual security of the data. The issue of US companies being compelled to disclose is the subject of ongoing litigation between Microsoft and the US. I believe the Supreme Court will hear arguments this year.

Of course if you are encrypting hosted data and AWS has no access to the keys, then that gives comfort over the disclosure. The relevant authorities/local authorities would have to come to you for disclosure of the keys and you would have any protections applicable under local laws...

That would exclude AWS from an awfully large segment of data hungry industries. Operating in the EU AWS has to comply with GDPR for at least the operations they have located in the EU. Frankfurt is safe.

It is not. See https://www.extremetech.com/extreme/186302-us-government-ass... for a popular explanation why.

AWS being excluded from business is exactly what those companies are arguing.

Still being litigated [1]. Last ruling was for Microsoft's position.

  [1] https://en.wikipedia.org/wiki/Microsoft_Corporation_v._United_States_of_America

That's a good caveat. Still: Being litigated means the US is trying to achieve a state which is explicitly unsafe. Which for me means already that AWS-Frankfurt is not safe. Especially for something like medical data. The potential danger is way too big, especially since we know that the US-agencies will siphon the data anyway, regardless of what the court rules.

Think business: Do you really want to face the media backlash when your competitor lances the story that the medical data you collect goes directly into the tiny little hands of Trump, and to the NSA?

If they are using extra-judicial means to get at the data I have no recourse anyways. I will have to store it somewhere and a dedicated attacker will always (eventually) find a vulnerability. The standards I have to implement do not state that I must keep the data out of the hands of attackers. They state principles and methods that make it less likely. When the regulators come knocking after an 'incident' their levying of fines will depend on standards and regulation compliance, not the leaked documents. You have an unreasonable expectation of what can be done.

Not hosting private medical data on a server controlled by a country with no regard for privacy of those patients is not an unreasonable expectation. It is a basic requirement for this kind of business. There will come a crackdown on that kind of malpractice. I hope you reconsidered till then.

What would exclude AWS from large segments? Having to hand over data? Actually various governments around the world have the ability to compel entities to hand over data if in support of an investigation. It is not a concept unique to US entities. This is a reality we deal with and AWS will always fight hard to resist that disclosure. As I say, if you encrypt the data then AWS can only ever hand over that encrypted data. That is the comfort that you can offer users.

Since you mention the GDPR, that regulation as with previous legislation contains carve-outs permitting disclosure of personal data to comply with legal obligations, for example assisting in criminal investigations. Also, the GDPR, whilst introducing certain obligations on processors, mainly deals with controllers, which AWS is not.

If I have a subpoena issued against me for data it doesn't matter where the data resides. Having it stored in the EU insures we use EU courts to litigate the issue.

As you are in Germany then I would say you're out of scope for subpoenas direct from US governmental authorities. They would however look for assistance from German authorities who may or may not be minded to comply. Of course different jurisdictions will react differently to a request from a US governmental authority for assistance (Russia for example would be unlikely to comply I imagine). As you say therefore, in terms of direct action against you, you would be able to fight in your courts.

In terms of the host of your data, the location of the data is of relevance, as is the jurisdiction in which the host is based. It's related to the Microsoft v US litigation. The main purpose of the litigation is to decide whether US entities hosting data outside the US have to comply with warrants to disclose that information (and in the process bypassing local protections/giving you the opportunity to fight in local courts).

If Microsoft is successful in the litigation, they won't have to comply with US issued warrants in relation to data stored outside the US.

If Microsoft loses, then you would be better placed using a hosting provider with no links to the US if you want to reduce the chances of data being disclosed to US governmental authorities.

This is my analysis as well. The only addition I have is that I find it very unlikely Microsoft will lose on appeal.

The subpoena – or at the very least, the concrete call to give the data – would not be issued against you. It would be issued against Amazon. You will have no course of defense in that case.

That's where the jurisdiction becomes very important. The outcome of USJD vs. Microsoft will dictate how it will be resolved. I'm betting that it will not be overturned on appeal.

So what? You really think that if a government agency asks for data, and an US-government argues (again) that an US-company does not have the right to not give the data out, Amazon will not comply? This is exactly what was part of the whole discussion about Privacy Shield, and you saw how that ended up.

Edit: grabehs answer is clearer than my own. Thanks.

Relevant case: the DOJ attempted to gain access to Hotmail data residing on a server based in Ireland: https://www.theguardian.com/technology/2015/sep/09/microsoft...

Any US connection is worrying from a privacy POV.

Still being litigated[1]. As it stands the ruling is for Microsoft's position.

  [1] https://en.wikipedia.org/wiki/Microsoft_Corporation_v._United_States_of_America

The reason I mention it is because if you don't have a US connection, this concern goes away. Imagine if this happened to a small data storage company that didn't have deep pockets of Microsoft to fight the case...

Actually, in Germany there is a law that prohibits storing any user data somewhere else then Germany.

The Federal Data Protection Act in Germany authorises data transfers within the EEA (and outside the EEA in certain conditions). It implements the EU's Data Protection Directive. Clearly you're not going to have much of a single market in the EEA if individual states are permitted to restrict data from being transferred outside its borders.

Citation needed

Right call here, as that broad the statement is not correct.

§4b BDSG, Absatz 2. See https://www.gesetze-im-internet.de/bdsg_1990/__4b.html. The gist is: You can transfer data if you inform and the data protection is adequate. Then Safe Harbor collapsed, that was not the case anymore (also before, protection was not really adequate, but that was partly ignored). Thus Privacy Shield to give a new legal foundation. If now that collapsed as well, transferring personal data to the US will indeed be illegal again.

I think it needs a country by country solution. Doesn't France make it illegal to move transmit data on patients to outside France?

A sibling comment had a link to a list of approved vendors. It's in french but Google translated it quite well.

Reply on news.ycombinator.com