Choose server location

[gernot_h]

I have a dropbox professional.

Is it possible to transfer my files to a server located in EU? 

[Yannic_Belgium_Europe]

Hello Megan (or colleague),

Is there any update on this?

Important extra question: following European GDPR & Data-privacy regulations, is Dropbox (or the mother-entity) aware of the fact that a company/service-provider cannot (en)force a customer to buy certain number of licenses (or certain commercial package) in order to have the "choice" where the data will be stored on the provider's server(s)? (in our case, and as for all European customers, on European server/s)

This means that for smaller customers (so less then 10 users) you do not give the option (contradicting European law/regulations) to have data stored on European servers from Dropbox, correct?

Best regards,

Yannic De Baets

[Hannah]

Hey @Yannic_Belgium_Europe, we appreciate your feedback on this matter.

Rest assured that your comments are passed along to our team about this.

If you have any other questions, please let us know.

[Yannic_Belgium_Europe]

Hello Hannah,

And will we also receive a answer or update on this so we can make the right choices regarding cloud-storage?

Thank you,

Best regards,

Yannic

[Jay]

Hi everyone, thank you for your input on this. 

As you know, Dropbox servers are located in the EU and US, our EU based file storage is provided on Amazon Web Services (AWS) infrastructure. While the GDPR does not require personal data to be hosted within the EU, the personal data that is entrusted to us is protected equally under GDPR whether it is hosted in Europe or the US.

Dropbox has a long-standing commitment to maintaining high standards of privacy and security for our customers’ data. This is the cornerstone of what we do. 

You can download our Privacy Whitepaper and Security Whitepaper to find out more about how we protect your data.

Thanks!

[Yannic_Belgium_Europe]

Hi Jay,

So this still means that customers who want to (and/or legally have to due to regulations from their customers) host their data in EU do still require to buy a certain level of licenses or package to have this option, correct? Dropbox is not changing their offering to give smaller companies the option to have the data hosted in EU, correct?

Regards,

Y.  De Baets

[Mark]

---

@Yannic_Belgium_Europe wrote:

Hi Jay,

So this still means that customers who want to (and/or legally have to due to regulations from their customers) host their data in EU do still require to buy a certain level of licenses or package to have this option, correct? Dropbox is not changing their offering to give smaller companies the option to have the data hosted in EU, correct?

Regards,

Y.  De Baets

---

Yes this is currently the way it works similar to lots of other companies I'm afraid. 

[An_Laoch]

Why?

GDPR applies to individuals and businesses, why can't individuals also have the protections that the EU citizens are entitled to?

[An_Laoch]

GDPR does say that transfers of EU Citizens data outside of the EU and EEA is prohibited unless an adequate safeguard can be used. Each time the EU Commission agree a data sharing agreement with the US, i.e. EU-US Privacy Shield (Schrems I & II) , and when it is tested in the European Court of Justice conclude that the US data protection laws are essentially NOT equally good as the GDPR, specifically the US Foreign Intelligence Surveillance Act (FISA) Section 702, Executive Order 12333 and Presidential Policy Directive 28 and the Privacy Shield ombudsman does not have the power to adopt decisions that would be binding on US intelligence services.

How therefore can you say that data that is moved to the US from the EU is fully GDPR protected for individuals? 

[Sam DBX]

Hi @An_Laoch,

Thanks for your question, happy to assist here. 

We can confirm that Dropbox has SCCs (Standard Contractual Clauses) in place covering transfers of our users’ data. As you can check in our Privacy Policy, when transferring data from the European Union, the European Economic Area, the United Kingdom and Switzerland, Dropbox relies on a variety of legal mechanisms, such as contracts with our customers and affiliates, Standard Contractual Clauses, and the European Commission’s adequacy decisions about certain countries, as they apply.

Hope this clarifies! 

Thank you

[An_Laoch]

Actually, the European Court of Justice, in Schrems II, passed the case of SCCs back to the Irish DPC and in the Meta Ireland case the DPC found that Meta had infringed Article 46(1) GDPR by continuing to transfer personal data from the EU/EEA to the US following Schrems II. Meta Ireland effected those transfers on the basis of SCCs; however, the DPC found that these arrangements did not address the risks to the fundamental rights and freedoms of data subjects that were identified by the CJEU in its judgment. While the specific decision was in relation to Meta, it has implications for companies such as Dropbox too as the analysis in this Decision exposes a situation whereby any Internet platform falling within the definition of an an Electronic Communications Service Provider (ECSP) subject to FISA 702 PRISM programme may equally fall foul of the requirements of Chapter V GDPR and the EU Charter of Fundamental Rights regarding their transfers of personal data to the US.