Those poor small international businesses? If you want to do business internationally, it'll be complicated, and that's fine. The internet has spoiled us by making it so easy for a while.

You're absolutely right. Unfortunately, the little guy is more easily accommodated for with lenoency during onboarding regulation-wise, and the bigger actors can never be brought to heel if something doesn't go down on paper.

And I think your team did not think through before implementing your product. The GDPR and its consequences have been discussed for a very long time. And the product even managed to get locked into Azure.

Why are you so shocked that people want to assert control over their medical data? This is the crux of the problem. You're being absolutely incredulous that someone have a say in data that is about them.

Other people exist and have rights. It's about time that people assert their rights over data that is absolutely consequential to their lives, instead of being tiny pawns of companies who treat them like a highschool science experiment with live ants.

It is kind of a strange idea in the first place, to store medical data outside the country, in a country like the US. I don't know if any country with good data protection laws would allow such a thing. I find the idea, that this could be OK for patients to be weird. I surely wouldn't want my medical data put onto US servers, likely without even knowing, because the hospital stuff does not know themselves and not telling me either. Maybe even worse being put to the choice of having some equipment used on me, which automatically shares that data to the US.

At some point in your project there seems to have been a time, when such basic questions of consent were overlooked and later you paid the price. Your intentions may have been nothing but good, but I for one am glad, that such practice was not allowed to happen.

You were transferring dicom files out of country? Madness. That's identifiable medical data.

Tell me you were at least running anonymisation software in hospitals before you transferred?

Under which law, please provide them specifically, were this not possible to do in France with data being processed in the US?

I am truly interested in this since I am in EU and use Azure for similar processing.

This sort of regulation is not new when it comes to health data. I'm actually surprised storing medical data outside the country was legal in France at any point, I don't think it would have been in my country.

So blaming the GDPR and new rules, seems a bit weird in this case.

Now, consumer protection regulation is always a balancing act. And most consumer protection laws will hurt some companies that didn't actually do anything bad. That doesn't mean I don't want any regulations. Particularly when it comes to healthcare.