Is Iceland the place for your data?

With the continued revelations from the Snowden leaks, companies around the globe are clamoring to move their cloud-hosted services and data to countries with less, um, draconic anti-privacy laws than the US and the UK. Many are seeking the supposed safety of cloud providers in the EU with their more friendly data privacy laws. However, there are kinks in Directive 95/46/EC, as illustrated in the case where Hungary prematurely ended the term of its Data Protection Commissioner (discussed in the memo IP/12/395), in violation of the EU's Data Protection Directive. This is a case where a member nation took independent action in violation of 95/46/EC on January 1, 2012 but a finding was just issued by the Court of Justice of the European Union on April 8, 2014. In addition to the actions of member nations that can circumvent 95/46/EC, this Directive contains verbiage in clauses in Article 3 and Article 25 that provide for similar provisions to the US Patriot Act inside of the EU member nations as well as transfer of data to US (and other countries) companies under the Safe Harbor provision under a promise that the companies maintain the care of data equivalent to the requirements called for in 95/46/EC, even though it is highly unlikely that this data can be secured against government inspection once it is in the infrastructure of a cloud provider located on US soil. So, moving to an EU-based cloud provider may not be good enough for some consumers.

Enter Iceland.

(Photo Credit: Marek Ślusarczyk)

There are a handful of countries that have excellent data privacy policies that exceed the protections of the EU Data Protection Directive and also have the benefit of being sovereign nations outside the control of the European Commission. Two such countries are Iceland and Norway. Of these two countries, Iceland holds my strong preference for many reasons. First, Iceland is a very low-risk country in terms of the probability of natural disaster occurrence; in fact, it is rated much lower than the US, UK, and India. Second, it has an abundance of natural geothermal energy sources, making the operational costs of facilities such as data centers significantly less expensive. Third, portions of the former NATO air base in Keflavik have been converted to a high technology incubator, which provides excellent facilities for data center operations. In addition to all of these factors as well as excellent data connectivity and infrastructure, the country is beautiful and the people are friendly and well-educated.

Not being one to keep my eggs all in one basket, it has not escaped me that I need a contingency site in a different geography. As mentioned above, Norway also has strong data privacy laws without ties to the overarching EC governance and is also a beautiful country with well-educated friendly people. When I get back from my site surveys of these locations, I'll post pictures. In the meantime, I strongly recommend that you look into the emerging capabilities and benefits of utilizing cloud providers in these two countries.