index.md 2.0KB
title: Implémentation et Safe Harbor
How to Comply?
Now the question is how to comply with what this is going into. These new rules are more than implementable for Facebook size corporations, but it is incredibly hard to do for small startups. It’s also not quite clear what can and what cannot be done with data now. At which point data is considered personal and at which point it is not, is something that differs from country to country and is in some situations even not entirely clear. For instance according to the UK DPA user relationships are personal information if they have “biographical significance”.
A Disconnected World
What worries me is that we are taking a huge step back from an interconnected world where people can share information with each other, to more and more incompatible decentralization. Computer games traditionally have already enforced shards where people from different countries could not play together because of legal reasons. For instance many of my Russian friends could never play a computer game with me, because they are forced to play in their own little online world.
Armin se pose des questions intéressantes sur l’implémentation de la récente loi européenne et son interprétation dans un contexte numérique qui permet difficilement de s’appuyer sur un stockage physique uniquement (problématiques de flux, de relations complexes, de déplacements des utilisateurs, etc).
Sa conclusion est que seule les startups et petites entreprises vont trinquer, bridant l’innovation en Europe. Pour chaque danger, un nouveau marché : j’imagine que des CDN de la donnée (DDN ?) vont apparaitre pour stocker de manière transparente les données d’un service en fonction de la localité.
PS : si vous êtes tenté de mettre la localisation dans l’URL de votre API, les headers sont probablement un meilleur endroit…