1. Legal Frameworks That Control It

A. EU GDPR Chapter V - Art 44-50 - Strictest in world

Rule: You can store outside EU ONLY if:

Adequacy Decision - Art 45: Commission says country is adequate. Only 15 countries: Andorra, Argentina, Canada (commercial), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, NZ, South Korea, Switzerland, UK, Uruguay. US is NOT adequate after Schrems II, except under new EU-US Data Privacy Framework 2023 for certified companies.

Appropriate Safeguards - Art 46: If no adequacy, you need SCCs (Standard Contractual Clauses) + Transfer Impact Assessment (TIA) + supplementary measures like encryption where provider has no key.

Derogations - Art 49: Explicit consent, contract necessity, public interest - interpreted very narrowly, cannot be used for systematic storage.

If you store outside without one of these, fine is up to 4% global turnover under Art 83(5).

B. Spain LOPDGDD Additional Rule - Art 20 + Art 40

For solvency files (ASNEF, BADEXCUG), data cannot be stored outside EU unless data subject explicitly informed. AEPD enforces this strictly.

C. US CLOUD Act 2018

US law says opposite of GDPR: If you are US company (Microsoft, Google, AWS, Meta) or have US presence, you MUST provide data regardless of where stored if US warrant says so. Data location irrelevant. This directly conflicts with GDPR Art 48 which says foreign court orders are not automatically enforceable.

D. India DPDP Act 2023 Sec 16 + Sec 17

India moved from localization to blacklist model: Government will notify countries where data CANNOT be transferred. Until then, free transfer except government may require certain data to be localized for national security. RBI still mandates payment data storage ONLY in India - stricter than DPDP.

2. Landmark Case Laws - Storage Outside Jurisdiction

CASE 1: US v Microsoft Corp - Microsoft Ireland Case 2013-2018 - The Origin

Facts: US DOJ issued SCA warrant for emails of drug trafficking suspect stored in Dublin data center. Microsoft refused: US warrant cannot apply extraterritorially.

Second Circuit Court of Appeals sided with Microsoft in 2016: SCA does not have extraterritorial reach.

Congress responded by passing CLOUD Act in March 2018 in 2 weeks, overturning decision. Law says provider must disclose if it has "possession, custody or control" regardless of location.

Supreme Court then declared case moot April 2018.

Legal Principle Established: Modern rule in US: Control test, not location test. If you control data, you must produce it even if stored in Ireland, Spain, India.

This is direct conflict with GDPR.

CASE 2: Schrems I - C-362/14 (2015) and Schrems II - C-311/18 (2020) - EU v US Storage Conflict

Facts: Max Schrems complained Facebook Ireland transferred his data to US where NSA PRISM accessed it under FISA 702.

CJEU Held in Schrems I: Invalidated Safe Harbour - US does not provide adequate protection.

In Schrems II: Invalidated Privacy Shield. Court said:

Section 702 FISA and Executive Order 12333 allow disproportionate access to EU data, not limited to what is strictly necessary, and EU citizens have no effective judicial remedy. Therefore US is not adequate.

Impact on Storage Outside Jurisdiction: Any EU company storing data in US (AWS, Google Cloud, Azure US regions) must now:

• Conduct TIA
• Prove US law does not impinge on GDPR
• Implement encryption where US provider cannot decrypt

AEPD, CNIL, Austrian DPA fined companies using Google Analytics because data stored in US without adequate safeguards - €1M+ fines across EU in 2022-23.

CASE 3: Google Spain v AEPD C-131/12 (2014) and Google v CNIL C-507/17 (2019) - Where Must Deletion Happen?

Problem: If data stored outside jurisdiction, where must deletion order be enforced?

In Google Spain, Spanish DPA ordered Google Inc (US) and Google Spain (Spain) to delete. Google argued data stored in US.

CJEU: If you have establishment in EU (Google Spain) that promotes selling ad space, you are subject to EU law even if processing happens outside.

In Google v CNIL, French CNIL ordered global delisting. CJEU limited it: EU law requires deletion on all EU domains, but does not mandate global. Member state can order global if proportionate.

Principle for storage: Location of server irrelevant, location of targeting/establishment matters for jurisdiction.

CASE 4: Equustek Solutions Inc v Google Inc 2017 SCC 34 (Canada) - Global Storage Order

Canadian company Equustek had counterfeit products sold via websites. BC Supreme Court ordered Google to globally de-index sites, even though data stored in US.

Canadian Supreme Court upheld global order: Internet is global, effective remedy requires global de-indexing.

US court (N.D. California) refused to enforce, citing First Amendment conflict.

Principle: Courts now claim global jurisdiction over data storage if needed for effective remedy, creating direct conflict of laws.

CASE 5: Spanish Cases - AEPD vs CaixaBank €6M (PS/00477/2019) and Vodafone €8.15M

CaixaBank: AEPD found CaixaBank transferred data within group companies, some with servers outside EU, without informing data subjects about categories and purposes, violating Art 13,14,6. Fine €6M - largest Spanish bank fine. AEPD said: "Illicit transfers of personal data to other companies within banking group" = storage outside original purpose/jurisdiction without basis.

Vodafone Spain €8.15M (2021): Vodafone outsourced CRM to provider outside EU and could not demonstrate where data was stored or who had access, nor could it identify opt-outs. AEPD: Failure to know where your data is stored = violation of accountability Art 5(2) and Art 28 processor obligations.

CASE 6: CJEU C-311/18 - The Practical Solution? EU-US Data Privacy Framework (DPF) 2023

After Schrems II, EU and US created new framework. US issued Executive Order 14086 creating Data Protection Review Court for EU citizens.

EU Commission adopted adequacy decision July 10, 2023: US companies certified under DPF are adequate.

But challenge already filed: NOYB (Schrems org) filed complaint Oct 2023 arguing EO 14086 does not fix proportionality. Expected Schrems III by 2025-26. So storage in US under DPF is legal today but at high risk of being invalidated again.

3. How to Legally Store Outside Jurisdiction Today - Compliance Model for Banks in Spain

If you are BBVA, Santander, CaixaBank storing in AWS/Google:

Step 1 - Data Mapping: Identify exact location: e.g., AWS eu-west-1 (Ireland) vs us-east-1 (Virginia). AEPD asks for this.

Step 2 - Legal Basis:

• If inside EU/adequate country -> OK with Art 28 DPA.
• If US: Check if provider is DPF certified (list on ITA website). If yes, can transfer under adequacy.
• If not certified or you need extra protection: Use EU Commission SCCs Module 2 + TIA + encryption with keys held in EU only (so US provider cannot decrypt - AEPD accepts this as supplementary measure).

Step 3 - Information Obligation: Art 13(1)(f) requires you to inform data subject in privacy notice: "Data will be transferred to US, based on DPF / SCCs".

Step 4 - No Conflict Instruction: In DPA with US provider, include clause: Provider must challenge US government access requests and notify you unless prohibited, to allow you to defend under GDPR Art 48.

Spanish Bank Reality: After AEPD €6M CaixaBank fine, all Spanish banks now keep core banking data in EU regions only (AWS eu-west-1, eu-west-3). US storage used only for non-personal or encrypted-with-EU-key analytics.

India Angle: If you store Indian customer data outside India, under DPDP you can currently do so unless country is blacklisted (not yet notified), but RBI circular 2018 says payment system data must be stored ONLY in India - no copy outside. Banks were given 6 months to comply in 2018. So for payment data, storage outside jurisdiction is prohibited outright in India.