My summary of the privacy talk + EC2: you're fine if you get a "Auftragsdatenvereinbarung", which you can get from AWS. Ask for it #cchh