This data protection deficit is rarely disclosed voluntarily by providers. As a layman, you don’t necessarily know that software providers are increasingly relying on third-party components – true to the motto: Why reinvent the wheel? Preference is of course given to open sources (see Open Source). However, some innovations are not open source and can only be used for a license fee. In this context, one speaks of proprietary software.
To make a long story short: If large parts of a software rely on services that run via servers that are located in the USA at best, then data sovereignty is not in good shape. Again, think about automatic face recognition. Here we are talking about sensitive data, about biometric information that concerns facial symmetry and should not fall into the wrong hands. If you plan to process personal data with your image management system, you should always specifically address the issue of data sovereignty when choosing a provider. Ideally, you should choose a provider that guarantees the following:
- Development of all software modules in-house and in Germany
- Hosting exclusively in the European Union, preferably in Germany
- Data protection compliant storage of biometric similarity vectors
- Continuous further development, especially with regard to data security
Only if these points are contractually defined do you have legal certainty and can assume that your data will not leave the defined sphere of activity.