Post date:
Monday, 24 February, 2020 - 08:24
You might have heard that Google is moving or, if you've recently had a notification around new terms and conditions, has moved UK data from it's data centre in Ireland to the US.
What does this mean?
In reality, nothing much! Lawyers have said that all data is currently still protected under GDPR and the UK has already enshrined GDPR into its own law (Data Protection Act 2018). The government says it intends to recognize the EU’s data protection system as adequate, even in a no-deal scenario, because it believes free data flows to the continent are vital to economic growth. However that has not been agreed yet and until December 2020 we won't really know. Basically, watch this space!
A great quote I read was:
"Never discount the desire of tech companies not be caught in between two different governments."
Which I think covers the main reason for the move, this way Google only has to worry about the UK - US regulations and not UK-US-EU ones.
What do I need to do?
Well if you are using Google for any business purpose. Drive, Documents, Analytics, you will have to update your privacy policy to say where that data is stored. Currently it will probably say, stored in the EU. If you use Google Analytics and you are anonymising the IP address, this isn't classed as personal data, so it doesn't need to be mentioned. Though best practice would be to mention it isn't. All our Drupal sites have Google Analytics set to anonymised by default.
Further Reading:
https://www.infosecurity-magazine.com/news/gdpr-protection-continue-googles/