2

We are building a video call application utilising Amazon Chime SDK. Our application serves customers in the UK and need to be GDPR compliant.

Amazon Chime's compliance info page doesn't explicitly state anything in relations to GDPR compliance. However AWS itself states it is, and Chime is a service under AWS.

So we are not sure if Chime itself is GDPR compliant. Could someonese please advice if have any relevant information to confirm or deny Chime's GDPR compliance conclusively.

emecheon
  • 307
  • 3
  • 10
  • The only way to find out is to see whether they respect people's rights under GDPR. https://noyb.eu/en/exercise-your-rights – Nemo Jul 09 '23 at 07:05

3 Answers3

2

I believe Amazon Chime is not GDPR compliant. The website provides no way to export existing user data. The documented approach to exporting history is to scroll back in the chat history and copy paste: https://answers.chime.aws/questions/629/how-can-i-save-all-the-data-from-a-chat-room-or-co.html

fileyfood500
  • 1,199
  • 1
  • 13
  • 29
2

After multiple attempts we did get a response - albeit vague - from AWS.

At the foundation of Amazon Chime security is Amazon Web Services (AWS) Security. AWS regions and networks are built and operated to meet the requirements of some of the world’s most security-sensitive organizations. AWS constantly undergoes third-party audits by a variety of public sector and private sector auditing organizations in order to maintain its status under multiple compliance offerings, such as the credit card industry’s PCI DSS Level 1, the U.S. Government’s FedRAMP program, C5 Certification in Germany, and IRAP assessment by the Australia Government. For more information, see the AWS Security and AWS Compliance websites. Amazon Chime is designed and operated according to the same AWS standards, has undergone the compliance process required to be a HIPAA-eligible service, and is currently in the process of being added to other relevant compliance programs.

The Amazon Chime SDK can be used by customers who incorporate GDPR best practices and compliance using our Shared Responsibility Model.

So they seem to imply it can be used in a GDPR compliant way.

Additional info: Specific to chat feature, AWS advised us to use the data-messaging API route to ensure the data relay and retention within EU.

All chat messages in the Chime app are relayed and stored in us-east-1 (Virginia). The chat messages always leave the UK.

There is a data messaging API in the SDK that can be use to build chat. (https://aws.github.io/amazon-chime-sdk-js/modules/apioverview.html#9-send-and-receive-data-messages-optional) These messages flow through the same region that is used to host the meeting (London, for example) and they are persisted there for a few minutes and until the end of the meeting so that they can be relayed to other participants during that meeting.

emecheon
  • 307
  • 3
  • 10
0

Talk to your AWS technical POC. I am sure they can help you understand this better. AWS is a big ecosystem of services. Chime used with other services can be made GDPR compliant.

For instance, all Chime events are tracked via AWS EventBridge. Should be pretty easy to attribute and track all data for a specific user.

Ramesh Elaiyavalli
  • 185
  • 6
  • 2
    I think you are no longer correct: https://www.cookiebot.com/en/schrems-ii-privacy-shield/. It is only GDPR compliant when you can guarantee that the data cannot be accessed by the American Government... which you cannot. The Schrems II case challenged the legality of this (US storage) system, arguing that an EU adequate level of data protection cannot be ensured by Facebook (or other American parties), since US laws (like FISA 702 and EO 12.333) mandates mass surveillance in sharp contrast to EU law (like the GDPR) that mandates strong data privacy. – Mr. Hugo Aug 28 '20 at 23:19