The location of a server and its relevance for the GDPR

American and Chinese internet companies in particular advertise that they use servers in Europe for their online platforms. This is intended to exude seriousness and prevent fears that data could migrate or be read by foreign intelligence services. What does the location of a server technically mean for the ability to access data?

Introduction

The informal data protection agreement between the EU and the US called Privacy Shield was always invalid. Following this, the EU had established the Data Privacy Framework (DPF) with the US. Not much has changed. The rights of affected European citizens in the US are still at a low and GDPR unworthy level. This can already be read from the Presidential Order of the US. By the way, it should be noted that such an order can be revoked at any time, either by the current or by a next US President.

The Intelligence Service Problem is just one topic. Mentally many seem to feel better when data is stored or otherwise (fleetingly) processed in the EU. However, this mental attitude is inappropriate, as will be briefly outlined below.

What is a server?

A server is a computational servant. It provides a service or several services. When using services on the internet, it is necessary for the service server to be publicly accessible. This happens through the assignment of a public network address. The network address in the context of the internet is also called an IP address.

Theoretically, all the software for a service runs on a dedicated server that is physically located in Cologne, for example. In practice, the situation is often different. More on this later.

The location of a server

The location of a server is determined by one fact alone. This fact is the current physical location of a server. It is not the IP address that is assigned to it. The same IP address can be assigned to Server 4711 in Germany and Server 0815 in Texas in the next second. The owner of servers and IP addresses can change this assignment of publicly accessible network addresses to servers at any time as desired.

It is therefore not possible to determine where a server is located from the outside. The server operator must communicate and contractually guarantee the server location. With German or European providers that are small enough, it is often possible to visit the data center to inspect the server. A corresponding backup at software level (perhaps also with a dongle) would then possibly guarantee that the server on site would not be replaced by a server at another location by carrying out a backup and redirecting the network traffic.

When trying to generate an AI image for this post, the following also came out:

The prompt for this image contained a reference to Germany, as this is my nationality and this post is written in the national language. You can see the relabeling of a larger country, towards the positive, you could say.

Data processing on a server

Let's take Google Analytics as an example of a service that is operated on a server in Ireland and offered for your website. You integrate a Google Analytics script into your website. Now the following happens with the standard use of the Google Analytics plugin:

1. Someone calls up your website.
2. Your website loads the Google Analytics script.
3. This script establishes a connection to a Google Analytics server (located in Ireland, for example).
4. The Google Analytics server in Ireland sends back the code to your server where your website (also a service!) is hosted, so that your website can track its users (Tracking called).
5. The visitor to your website (see 1.) clicks and scrolls on your website and possibly makes entries in a form.
6. The program received via 4. now sends tracking events about the visitor to your website to the Google Analytics server, which is located in Ireland. The IP address of the visitor to your website is always automatically transmitted to the Google server. Shortening is not possible here.
7. The Google server in Ireland processes these tracking events.

That sounds halfway good, although the legal basis for points 6 and 7 must also be clarified here. As legal basis, only consent (or a contract) remains. The further justification and cookie theme we leave out of consideration here for clarity's sake. There are numerous contributions on Dr. GDPR regarding this.

Detailed view for Google Analytics

It's not as simple as that for Google Analytics and many other services, however. For point 3, for example, you have to determine which server gets to respond to your website via a routing service. Because the plugin address is google-analytics.com. This address can be directed to any server worldwide (or even in the universe) at any given time, and can be redirected anew every second as needed.

Other servers may therefore be involved until the server that provides the Google Analytics services for your website is found. Personal data is also exchanged in the process (such as the IP address or browser fingerprint).

At point 7 mentioned above, the service server processes your website's request. In this example, it is saving a Google Analytics tracking event. Google itself admits, that all analysis data from Google Analytics are always processed in the USA. So further servers, which this time obviously do not stand neither in Ireland nor in Europe, are involved in processing data for your website.

The Google servers in the USA can send the data to any other server further. The data can also be sent to any Google order processors further. These order processors sit for Google Analytics in countries like

• Philippines,
• India,
• Argentina,
• Singapore,
• USA,

Alle Bilder in diesem Beitrag wurden von einem Computer-Programm erzeugt. Verwendet wurde das selbst entwickelte KI-System von Dr. DSGVO, ähnlich zu Midjourney. Die Bilder dürfen auf Webseiten frei verwendet werden, mit der Bitte, eine Verlinkung auf diesen Blog zu setzen.