Moving Web Hosting Offshore
Changing a web site domain name can be search engine suicide, but there are many other considerations raised by moving hosting to the United States - the Data Protection Act 1998 in particular.
In mid-August, E-consultancy.com's Chief Executive announced on their forums their web site will be transferred to a new domain and move from UK hosting, to the United States (US). He had posted the message to gain feedback and suggestions of the effect to their search engine listings. The new host name will be www.econsultancy.com rather than the current www.e-consultancy.com (with a hyphen).
Apart from the search engine optimisation issues, and my previous post about domain due diligence, the discussion in the forum has touched on data protection issues. It appears that additional thought needed to be put into this matter before moving the site hosting and current data abroad.
One contributor even suggested "go for second-best practice and get the job done quicker and more cheaply". But E-consultancy Limited are more professional than that. They seem to have put significant effort into consideration of their privacy previously. They are a current registered data controller. They are also signed up with TRUSTe's privacy program for the web site, although such programs have debateable value.
Web site users are bound by a user agreement (the terms and conditions for using the E-consultancy.com web site) referencing the privacy policy which states:
TRUSTe operates as a third-party "watch dog" by auditing privacy practices to make sure that they are in compliance with TRUSTe's privacy standards. In as far as this represents best practice on the web, e-consultancy.com is committed to complying with these standards so that members can feel secure in the knowledge that their personal data is properly managed.
The privacy policy says the data are hosted in the UK:
Your Personal Information is stored in our databases, which are located in the UK. Please note that the information you enter may at some time be transferred outside the European Economic Area for the purposes of processing by E-consultancy.com or any of its affiliates. By submitting your information, you consent to this transfer.
This text has been on this page since the site was launched in 2001 - see the December 2001 copy of the page in the Way Back Machine Internet Archive.
I believe storing the databases outside Europe is different to transferring it outside for processing - and I think users and members would maintain that too. I hope E-consultancy Limited consider the effects and get some good legal advice sooner, rather than later. Perhaps "opt in" to the change rather than "opt out" will be necessary?
I'm also a little worried about their registration as a data controller - only having one data use purpose of "consultancy and advisory services" appears to be a bit simplistic - you'd assume there would be at least some "staff administration", "advertising, marketing and public relations" and "accounts and records" going on.
Frank Jennings has written some timely advice for organisations planning to move data offshore in his September SC Magazine blog post "Legal matters: In the age of consent". This includes a discussion on the principle of "safe harbor" - harmonisation of data privacy practices in the less strict US. See also the guidance at Out-Law.com on "Overseas transfers of personal data".
Posted on: 16 September 2008 at 10:40 hrs
Comments are filtered automatically and should appear shortly after they been checked.