Comment on €1.2B GDPR fine for MetaComments−xipix3yI always thought this would be a cool thing to do if I ran Evil Corp...A = <totally random bits>B = <personal data> XOR AStore A in USAStore B in EUThe data is not stored in EU, and it's not stored in USA either. It's not stored elsewhere. But Evil Corp still has it!−detaro3yWhy do you think encrypted personal data ceases to be personal data?−WJW3yEncrypted PII are still PII, so this scheme would count as "data stored in the EU and key stored in the USA".
Comments
I always thought this would be a cool thing to do if I ran Evil Corp...
A = <totally random bits>
B = <personal data> XOR A
Store A in USA
Store B in EU
The data is not stored in EU, and it's not stored in USA either. It's not stored elsewhere. But Evil Corp still has it!
Why do you think encrypted personal data ceases to be personal data?
Encrypted PII are still PII, so this scheme would count as "data stored in the EU and key stored in the USA".