GDPR and global load balancing
<p>Given the recent ruling in regards to the EU-US Privacy Shield and GDPR [1] would it still be possible to implement a global system with regional data sources? Specifically can you request a user email and process it in a location that may be outside EU with the explicit purpose of determining whether that the user should use a EU tenant or not for the rest of their session?</p>
<p>[1] <a href="https://techcrunch.com/2020/08/11/eu-us-privacy-shield-is-dead-long-live-privacy-shield/" rel="nofollow noreferrer">https://techcrunch.com/2020/08/11/eu-us-privacy-shield-is-dead-long-live-privacy-shield/</a></p>
<p>Example:</p>
<p>I have a software-as-a-service product with a global footprint. Most data is not classified as PII and so is stored in all regions. For data deemed PII I would like to store it in the appropriate region only. So when a user logs in to their account, the idea was to have them enter their email address, look up their region in a mapping table of a hashed value of the email address to a region, available globally and use that information to send all PII related browser requests to the regional servers only.</p>
<p>Follow up example:</p>
<p>Let’s say I still have a global software-as-a-service company. I set up two different data centres, one in EU, and one outside. When new clients are onboarded the select their region. How do I handle authentication in this case? One option is to give the clients different urls depending on region e.g. us.my-saas.com/login and eu.my-saas.com/login but that would not be an ideal user experience. Under GDPR, is there no way of having something like login.my-saas.com and depending on metadata associated with their profile or username automatically determine where to send them?</p>

<p>The ruling didn't prohibit data transfers to third countries. It clarified that there must be appropriate safeguards essentially equivalent to the level of protection required by EU law. The data exporter (you) and the data importer (the third party) must make that assessment.</p>
<p>From the <a href="https://edpb.europa.eu/sites/edpb/files/files/file1/20200724_edpb_faqoncjeuc31118.pdf" rel="nofollow noreferrer">Frequently Asked Questions on the judgment of the Court of Justice of the European Union in Case C-311/18 - Data Protection Commissioner v Facebook Ireland Ltd and Maximillian Schrems</a>:</p>
<blockquote>
<p>The Court highlighted that it is the responsibility of the data
exporter and the data importer to assess whether the level of
protection required by EU law is respected in the third country
concerned in order to determine if the guarantees provided by the SCCs
or the BCRs can be complied with in practice. If this is not the case,
you should assess whether you can provide supplementary measures to
ensure an essentially equivalent level of protection as provided in
the EEA, and if the law of the third country will not impinge on these
supplementary measures so as to prevent their effectiveness.</p>
</blockquote>
<p>It seems to me that if your users might be EU data subjects you must determine a user is not an EU data subject <em>before</em> transferring personal data to a place without &quot;appropriate safeguards&quot; <em>or</em> ensure that <em>all</em> personal data receives protection equivalent to that required by EU law <em>until/unless</em> you determine that protection isn't required for the specific user (by determining the user is not an EU data subject) or just make sure all personal data receives &quot;appropriate safeguards&quot;.</p>
<p>Article 49 of the GDPR provides for &quot;Derogations for specific situations&quot;. I suspect that isn't useful in your scenario but nevertheless worth reading in conjunction with section 8 of the FAQs.</p>

gdpr