Workday ringfences support in Europe after Safe Harbour ruled unsafe

European companies nervous about using US datacentres

Concerns over the security of data stored in the US, which can be accessed by the US government under the Patriot Act, have led some companies to transfer their datacentres from the US to Europe.

Elekta, a high-tech healthcare company, headquartered in Sweden, told Computer Weekly that it transferred its human resources (HR) data from Workday’s datacentres in the US to Dublin three months ago, after its works council raised privacy concerns.

“That was one of the main conditions from the German works council – that the data should be hosted in Europe,” said Raymond L’homme, global HR business application manager at Elekta.

“With the Patriot Act, they did not really feel the data was secure in North America, because if government asked for it, it would just get access.”

Rockwool, a manufacturing company headquartered in Denmark, also disclosed that its executives were nervous about storing HR data on Workday’s US datacentres, following the Snowden revelations.

“Wikileaks was in the news, and the phone tapping of Angela Merkel. They were less concerned, knowing data was going to be stored in Dublin,” said Wouter Bak, director for Rockwool’s HR centre of excellence.

An extra level of data protection

Under the proposed plan, a team of more than 400 developers in Ireland, along with a team of developers in New Zealand, will provide round-the-clock support to European companies that do not want their data to be accessed by the US.

Workday said the idea had won backing from the company’s European advisory council, made up of 18 Workday customers.

Leighanne Levensaler, senior vice-president for products at Workday, said: “They have already been through this with their privacy, security and works councils, so they [agree] it’s going to be very appealing for prospective customers.”

Workday said the new measures were designed to reassure potential customers, and existing customers would still be protected through model data privacy contracts, which are unaffected by the failure of Safe Harbour.

“The majority of customers and prospects are completely fine with the policies we have in place today,” said Fernandez.

Russian data protection concerns

Separately, Workday said it was working with technology partners to comply with new data protection laws in Russia, which require copies of all data to be held within the country.

The company has no plans to build a datacentre in Russia, but is developing reporting tools that will allow company data to be shared internationally.

“We are working collaboratively with our customers, and their legal council and compliance officers, to ensure we do everything we can to support them,” said Levensaller.

Local developers key to EU support policy

Aneel Bhusri, founder and co-CEO of Workday, said the EU support policy was only possible because the company had a large team of developers in Dublin.

“If there are issues in Europe, we do not have to go back to the US to solve them,” he told Computer Weekly.

Workday said the design of its cloud service, which gives all its customers access to the same version of the Workday software, made it easier to limit data access to specific geographies or individuals.

“If you are stitching different applications, and you are coming from acquisitions and different data models and datacentres, that is not going to be easy,” he said.