Mistral starts processing personal data in USA and stops notifying of such changes

Mistral added the USA to the locations it handles personal data on its Google Cloud Platform infrastructure, whereas it was previously limited to Ireland in the EU.

In that same change, Mistral also adjusted its commitment to notify customers in case of “any changes” to the data subprocessors list, to only notify them in case of “addition or replacement of a Subprocessor”. This means it won’t notify its customers of a change like the one it just applied. Indeed, Google Cloud Platform is not added or removed from the list of subprocessors, only modified to expand its territorial reach.

The fact that personal data can from now on be processed in the USA and not only in the EU has strong privacy implications.