We prioritize privacy and store all personal data in Norway
Are you tired of trying to figure out where personal data is stored, if it is stored securely, what is considered personal data, where it is processed, who has access to it, and where backups, logs, and files are kept?
Many of the major cloud-based service providers are based in the USA. You might think that hundreds of thousands of customers guarantee that your data is stored securely and protected. However, that might not be the case.
The issue is that US authorities can use the USA PATRIOT Act. This legislation gives US authorities the legal right to access data from companies based in the USA. But it does not stop there. The connection to the US is what causes the issue. Subsidiaries of a US group are also covered, even if the subsidiary is an EU company.
Make has developed a solution to address all of these issues: We store all personal data in Norway – local, transparent, and sustainable
Make AS is a Norwegian company with Norwegian owners, complying with Norwegian privacy laws and regulations. We store all personal data, backups, and logs in Norway. As a result, our customers are protected from increasingly invasive US legislation.
We believe this makes Make a great alternative to Mailchimp or similar US services when Norwegian businesses are choosing an email marketing provider.
"When we at Frende were choosing a new provider for email marketing, it was crucial that personal data was processed in Norway. That option is unique to Make. Since they also have a clean and structured infrastructure, good usability, excellent support, and all the features we need, the choice was simple." Alice Beate Holm – Frende Forsikring
US providers may be illegal
The widely discussed Schrems II ruling from the summer of 2020 has caused significant uncertainty regarding the storage of personal data, especially with large US companies. It is now clear that European businesses must implement "additional protective measures" when transferring personal data to the US, among other places, but few can provide clear answers on what these measures actually are.
The Schrems II ruling establishes that US laws grant US authorities excessive access to personal data, and that there is no objective body with sufficient authority for individuals to appeal their case. This is the real reason why Privacy Shield was invalidated, and the European Court of Justice specifies that this issue also applies to other transfer mechanisms, such as the EU's Standard Contractual Clauses (SCC).
Both the Norwegian Data Protection Authority and the EDPB (the European Data Protection Board) state that personal data cannot be transferred out of the EU unless, in addition to a valid transfer mechanism, security measures are established to ensure that the privacy of EU citizens is protected to a level equivalent to that within the EU.
Regarding the feasibility of establishing such security measures for transfers to the US, the Norwegian Data Protection Authority states: "...this can be highly challenging or impossible to achieve in practice".
The basis for this position is that US companies and their customers cannot contract out of the laws that apply to the operations of US companies in the US.
A similar issue applies to other countries without an adequate level of security, but it is particularly problematic with the US because most data-driven technology has a connection there.
As it stands, the only viable solution seems to be modifying the product itself (the technical setup) so that personal data of EU citizens is not transferred out of the EU.
The Schrems II ruling
Schrems II addressed whether Facebook could transfer data about users in Europe to the US. The answer was no. The ruling also includes stricter requirements for data transfers to third countries and the invalidation of the Privacy Shield (2016) transfer mechanism.
Have you heard of Schrems II?
A transfer of personal data refers to personal data being sent or transferred to a third country. In a broader sense, it is also considered a data transfer if a person in a third country is granted access to the stored data, even if this data is stored within the EEA. In this way, remote access is equated with an actual data transfer.
In principle, transferring personal data to countries outside the EEA (third countries) is not permitted. In some cases, exemptions can be made if the recipient of the personal data agrees to certain obligations. These obligations are referred to as transfer mechanisms. The data exporter is responsible for finding a suitable transfer mechanism and meeting the additional requirements set by the European Court of Justice.
The concept behind transfer mechanisms is that personal data should be just as well protected after being transferred to a third country as it would have been within the EEA. To achieve this, the data importer must first assess whether the legal access rights of local authorities override the obligations in the transfer mechanism, and map out what is achievable in practice.
This applies within the EEA, which includes EU countries, Iceland, Liechtenstein, and Norway. Additionally, there are some countries and territories approved by the European Commission. As of 2020, these are Switzerland, Andorra, the Faroe Islands, Guernsey, Jersey, the Isle of Man, Argentina, Canada, Israel, New Zealand, Japan, and Uruguay.
Typical data considered personal data includes name, address, telephone number, email address, and national identification number.
Biometrics such as fingerprints, iris patterns, and head shapes (for facial recognition) are also personal data. Furthermore, a dynamic IP address is also defined as personal data under certain conditions.