Data location matters

Dale Olds in The physical location of data matters writes, “…it matters to me in real, tangible ways who runs the servers and where my data is stored ‑‑ and who is liable when there is a failure.”

From an international perspective, while this is of course true, there are bigger issues than just operational issues and liability.

For many non-Americans top of mind when they think about the physical location of their data is the USA Patriot Act. This law presents two particularly thorny issues regarding their data stored in the US.

First, the bar is set very low. US law enforcement agencies can access the data if they consider it relevant to their investigations. This is far easier to meet than the normal test of probable cause.

Second, if data is accessed in this manner, the data holder (the US-based vendor) is not allowed to tell the overseas data owner that their data has been accessed, even if the vendor is contractually bound to do so.

Both of these angles and more are well covered in a report from the Information & Privacy Commissioner of British Columbia, Canada (pdf, 1.29 MB). It was published in October 2004 but still remains relevant.

There is another angle for data location that is top of mind for organisations that outsource IT or back-office functions internationally. That’s privacy and protection of personal information from unauthorised access, especially from insiders of the vendor’s company.

NZ’s Privacy Commissioner recently gave a presentation that includes concerns for personal data held overseas.

It’s no wonder that most organisations prefer to keep their data onshore. Data location does indeed matter.