5 ms·

How do I follow conflicting laws? One country says "keep all data for 90 days to aid law enforcement" the other says "delete it immediately" which is it?

kough 9y ago
You ask your team of lawyers who can make a good decision for your company based on your business goals and the relative values of complying with each of the competing laws, along with the relative risks associated with failing to do so.
harperlee 9y ago
I would guess that one solution is to keep EU citizens' data in the EU to avoid it being subject to other laws. And possibly having separate companies by country. As an analogy, if I recall correctly banks have very stringent laws to follow regarding data export and money export to other countries. The solution they choose is to have a bank per country, not a global bank.
- strictnein 9y ago
  > I would guess that one solution is to keep EU citizens' data in the EU to avoid it being subject to other laws. This is exactly what is being done by the large corporations that can afford to do it. European datacenters staffed by Europeans. Americans are not allowed to view any PII for any European (at least with the company I work at). Russia requires the same thing, although they just want the servers in their country so they can put a SORM-3 alongside it and intercept whatever data they want. https://en.wikipedia.org/wiki/SORM https://en.wikipedia.org/wiki/SORM
  - dmoy 9y ago
    Ah yeah 242-FZ, definitely a different purpose in Russia
CyberThijs 9y ago
One of the goals of the GDPR is to consolidate all the data protection laws of the EU member states. So within the EU this shouldn't pose a problem. For the US, I assume this is covered by the EU-US data shield. I assume a similar construct will be necessary for GB once it leaves the EU.
AndyMcConachie 9y ago
There is no easy answer to this question. For example, what happens if US courts demand data you have stored on Irish servers,[1] but an EU citizen asks that you destroy this data? Do you destroy the data and risk being charged with destruction of evidence in the US? Or do you keep it and risk being non-compliant with the GDPR? [1] https://www.theguardian.com/technology/2014/apr/29/us-court-microsoft-personal-data-emails-irish-server https://www.theguardian.com/technology/2014/apr/29/us-court-...
- alexeldeib 9y ago
  Just FYI, this case was reversed on appeal (i.e., against the government). I recall there being some buzz with the government potentially pushing for further court action, but as far as I know that's the current status.
- throwawaymanbot 9y ago
  I would imagine, since the EU is where the Data resides, and the EU is the legal jurisdiction, that the EU would take precedence. Its monumental nationalistic and legal hubris to think that American law takes precedence anywhere in the world, let alone with an ally as large as the EU.
  - luma 9y ago
    Be that as it may, there is nothing to stop US authorities from charging US companies with crimes if they were to comply with EU laws. They are in direct conflict, and any internet-based company operating on nearly any scale is in danger of running afoul of these sorts of issues. This isn't a Google/Facebook only problem, this is a problem for any web service that might store user data.
    - k-mcgrady 9y ago
      Maybe the EU/US Privacy Shield will help handle situations like the above.
    - ryanlol 9y ago
deleted 9y ago
[deleted]
louhike 9y ago
Company may have to treat the data differently according to where the user lives (yes, it can be a mess). For EU countries, the EU law has priority (except for the constitution).
kbart 9y ago
"How do I follow conflicting laws? One country says "keep all data for 90 days to aid law enforcement" the other says "delete it immediately" which is it?" GDPR is EU wide regulation that trumps national privacy laws. It doesn't even need to be approved by individual members, so when it goes into effect on 25 May 2018, it will be working EU-wide on the same day. Furthermore, it affects companies all over the world that serves EU citizens. There's much skepticism on how EU will enforce this law worldwide, but for now it was quite successful dealing with big companies, remember: Microsoft vs EU (paid €561 million fine), multiple cases of Google vs EU (right to be forgotten, Ireland tax rulling, ongoing case vs Android), Facebook/WhatsApp vs EU (€110 million fine) etc. To answer your question: no, there will be no conflicting laws - if you serve EU citizens, you must follow GDPR. From my personal perspective, GDPR is one of those not-so-often moments that I'm proud of EU.
- tajen 9y ago
  Microsoft vs EU yielded €2bn fines. I had made the calculations myself in 2013, I can't find the source, but here's most of the details: https://www.neowin.net/news/since-2004-the-eu-has-fined-microsoft-304-billion-dollars https://www.neowin.net/news/since-2004-the-eu-has-fined-micr...
- wav-part 9y ago
  > Furthermore, it affects companies all over the world that serves EU citizens. No gdpr applies if companies target EU citizens [1][2]. My personal opinion of the law is that its as useless as cookie law but way more costly and unpredictable. [1] (122), Pg 22, https://docs.google.com/viewer?url=http%3A%2F%2Fec.europa.eu%2Fjustice%2Fdata-protection%2Freform%2Ffiles%2Fregulation_oj_en.pdf https://docs.google.com/viewer?url=http%3A%2F%2Fec.europa.eu... [2] Pg 13, https://docs.google.com/viewer?url=http%3A%2F%2Fwww.linklaters.com%2Fpdfs%2Fmkt%2Flondon%2FTMT_DATA_Protection_Survival_Guide_Singles.pdf https://docs.google.com/viewer?url=http%3A%2F%2Fwww.linklate... The mere accessibility of your website by individuals in the Union or use of the languages of one of the Member States in the Union (if the same as the language of your home state) should not by itself make you subject to the Regulation. However, the following factors are a strong indication that you are offering goods or services to individuals in the Union and so are subject to the Regulation: > Language - You are using the language of a Member State and that language is not relevant to customers in your home state (e.g. the use of Hungarian by a US website). > Currency - You are using the currency of a Member State, and that currency is not generally used in your home state (e.g. showing prices in Euros). > Domain name - Your website has a top level domain name of a Member State (e.g. use of the .de top level domain). > Delivery to the Union - You will deliver your physical goods to a Member State (e.g. sending products to a postal address in Spain). > Reference to citizens - You use references to individuals in a Member State to promote your goods and services (e.g. if your website talks about Swedish customers who use your products). > Customer base - You have a large proportion of customers based in the Union. > Targeted advertising - You are targeting advertising at individuals in a Member State (e.g. paying for adverts in a newspaper).
s_dev 9y ago
There won't be conflicting laws -- the GDPR is a EU wide policy and supersedes any laws on the books in that nation.
- yammajr 9y ago
  Except that not every country belongs to the EU. If you have customers globally, you'll still have to deal with conflicting requirements.
  - abandonliberty 9y ago
    Until we have One World Government we'll have to respect the laws of the countries we do business in. This is an example of why some local services are winning out against global competitors. Respect for and knowledge of their specific niche.
    - kodablah 9y ago
      So on my ad-supported site that does not ask users where they are from, I will have to put a geo-ip filter to keep EU people off in order to avoid fines? Otherwise, do we accept that statements like "we'll have to respect the laws of the countries we do business in" is a bit generic and over-reaching in a global medium? I have not read the proposed law and I trust this situation is covered, but I am still annoyed at every region having so many of it's own internet rules (not EU specific, goes with them all). Granted explicit business w/ explicit customers giving explicit monies in nation-backed currencies does make it easy to follow this law, but not everyone's business is like this.
      - ForHackernews 9y ago
        Do you collect a lot of data about your users and not offer them any way to delete it?
        kodablah 9y ago
        This is a hypothetical, so let's say yes. So, do I need to filter out my users to avoid fines? That may seem noble and great in this particular case, but it's a slippery slope. The more regionally-specific regulations that are introduced causing more work for companies, the more the ROI per customer in that region may reduce. Once it gets below 0 with the threat of fines for a company, the users might be cut off. It seems all good for this specific policy because most of us agree with it globally. But data protectionism and/or extreme regional deviations/regulations in law will reduce the globalism everyone shares. Other options (such as educating the populace or encouraging competition) can be more effective than restrictions. This is something to think about as the EU grows smaller, not larger. Even today, small companies with fewer EU users may stop and think about providing access at the cost of, e.g., building a portal for them to manage cookie settings.
hamilyon2 9y ago
Encrypt it with key that only the law enforcement has. Keep actual encrypted data on a medium outside of coutry where it is illegal.

kough 9y ago

You ask your team of lawyers who can make a good decision for your company based on your business goals and the relative values of complying with each of the competing laws, along with the relative risks associated with failing to do so.

harperlee 9y ago

I would guess that one solution is to keep EU citizens' data in the EU to avoid it being subject to other laws. And possibly having separate companies by country. As an analogy, if I recall correctly banks have very stringent laws to follow regarding data export and money export to other countries. The solution they choose is to have a bank per country, not a global bank.

strictnein 9y ago
> I would guess that one solution is to keep EU citizens' data in the EU to avoid it being subject to other laws. This is exactly what is being done by the large corporations that can afford to do it. European datacenters staffed by Europeans. Americans are not allowed to view any PII for any European (at least with the company I work at). Russia requires the same thing, although they just want the servers in their country so they can put a SORM-3 alongside it and intercept whatever data they want. https://en.wikipedia.org/wiki/SORM https://en.wikipedia.org/wiki/SORM
- dmoy 9y ago
  Ah yeah 242-FZ, definitely a different purpose in Russia

CyberThijs 9y ago

One of the goals of the GDPR is to consolidate all the data protection laws of the EU member states. So within the EU this shouldn't pose a problem. For the US, I assume this is covered by the EU-US data shield. I assume a similar construct will be necessary for GB once it leaves the EU.

AndyMcConachie 9y ago

There is no easy answer to this question. For example, what happens if US courts demand data you have stored on Irish servers,[1] but an EU citizen asks that you destroy this data? Do you destroy the data and risk being charged with destruction of evidence in the US? Or do you keep it and risk being non-compliant with the GDPR? [1] https://www.theguardian.com/technology/2014/apr/29/us-court-microsoft-personal-data-emails-irish-server https://www.theguardian.com/technology/2014/apr/29/us-court-...

alexeldeib 9y ago
Just FYI, this case was reversed on appeal (i.e., against the government). I recall there being some buzz with the government potentially pushing for further court action, but as far as I know that's the current status.
throwawaymanbot 9y ago
I would imagine, since the EU is where the Data resides, and the EU is the legal jurisdiction, that the EU would take precedence. Its monumental nationalistic and legal hubris to think that American law takes precedence anywhere in the world, let alone with an ally as large as the EU.
- luma 9y ago
  Be that as it may, there is nothing to stop US authorities from charging US companies with crimes if they were to comply with EU laws. They are in direct conflict, and any internet-based company operating on nearly any scale is in danger of running afoul of these sorts of issues. This isn't a Google/Facebook only problem, this is a problem for any web service that might store user data.
  - k-mcgrady 9y ago
    Maybe the EU/US Privacy Shield will help handle situations like the above.
  - ryanlol 9y ago

deleted 9y ago

[deleted]

louhike 9y ago

Company may have to treat the data differently according to where the user lives (yes, it can be a mess). For EU countries, the EU law has priority (except for the constitution).

kbart 9y ago

"How do I follow conflicting laws? One country says "keep all data for 90 days to aid law enforcement" the other says "delete it immediately" which is it?" GDPR is EU wide regulation that trumps national privacy laws. It doesn't even need to be approved by individual members, so when it goes into effect on 25 May 2018, it will be working EU-wide on the same day. Furthermore, it affects companies all over the world that serves EU citizens. There's much skepticism on how EU will enforce this law worldwide, but for now it was quite successful dealing with big companies, remember: Microsoft vs EU (paid €561 million fine), multiple cases of Google vs EU (right to be forgotten, Ireland tax rulling, ongoing case vs Android), Facebook/WhatsApp vs EU (€110 million fine) etc. To answer your question: no, there will be no conflicting laws - if you serve EU citizens, you must follow GDPR. From my personal perspective, GDPR is one of those not-so-often moments that I'm proud of EU.

tajen 9y ago
Microsoft vs EU yielded €2bn fines. I had made the calculations myself in 2013, I can't find the source, but here's most of the details: https://www.neowin.net/news/since-2004-the-eu-has-fined-microsoft-304-billion-dollars https://www.neowin.net/news/since-2004-the-eu-has-fined-micr...
wav-part 9y ago
> Furthermore, it affects companies all over the world that serves EU citizens. No gdpr applies if companies target EU citizens [1][2]. My personal opinion of the law is that its as useless as cookie law but way more costly and unpredictable. [1] (122), Pg 22, https://docs.google.com/viewer?url=http%3A%2F%2Fec.europa.eu%2Fjustice%2Fdata-protection%2Freform%2Ffiles%2Fregulation_oj_en.pdf https://docs.google.com/viewer?url=http%3A%2F%2Fec.europa.eu... [2] Pg 13, https://docs.google.com/viewer?url=http%3A%2F%2Fwww.linklaters.com%2Fpdfs%2Fmkt%2Flondon%2FTMT_DATA_Protection_Survival_Guide_Singles.pdf https://docs.google.com/viewer?url=http%3A%2F%2Fwww.linklate... The mere accessibility of your website by individuals in the Union or use of the languages of one of the Member States in the Union (if the same as the language of your home state) should not by itself make you subject to the Regulation. However, the following factors are a strong indication that you are offering goods or services to individuals in the Union and so are subject to the Regulation: > Language - You are using the language of a Member State and that language is not relevant to customers in your home state (e.g. the use of Hungarian by a US website). > Currency - You are using the currency of a Member State, and that currency is not generally used in your home state (e.g. showing prices in Euros). > Domain name - Your website has a top level domain name of a Member State (e.g. use of the .de top level domain). > Delivery to the Union - You will deliver your physical goods to a Member State (e.g. sending products to a postal address in Spain). > Reference to citizens - You use references to individuals in a Member State to promote your goods and services (e.g. if your website talks about Swedish customers who use your products). > Customer base - You have a large proportion of customers based in the Union. > Targeted advertising - You are targeting advertising at individuals in a Member State (e.g. paying for adverts in a newspaper).

s_dev 9y ago

There won't be conflicting laws -- the GDPR is a EU wide policy and supersedes any laws on the books in that nation.

yammajr 9y ago
Except that not every country belongs to the EU. If you have customers globally, you'll still have to deal with conflicting requirements.
- abandonliberty 9y ago
  Until we have One World Government we'll have to respect the laws of the countries we do business in. This is an example of why some local services are winning out against global competitors. Respect for and knowledge of their specific niche.
  - kodablah 9y ago
    So on my ad-supported site that does not ask users where they are from, I will have to put a geo-ip filter to keep EU people off in order to avoid fines? Otherwise, do we accept that statements like "we'll have to respect the laws of the countries we do business in" is a bit generic and over-reaching in a global medium? I have not read the proposed law and I trust this situation is covered, but I am still annoyed at every region having so many of it's own internet rules (not EU specific, goes with them all). Granted explicit business w/ explicit customers giving explicit monies in nation-backed currencies does make it easy to follow this law, but not everyone's business is like this.
    - ForHackernews 9y ago
      Do you collect a lot of data about your users and not offer them any way to delete it?
      - kodablah 9y ago
        This is a hypothetical, so let's say yes. So, do I need to filter out my users to avoid fines? That may seem noble and great in this particular case, but it's a slippery slope. The more regionally-specific regulations that are introduced causing more work for companies, the more the ROI per customer in that region may reduce. Once it gets below 0 with the threat of fines for a company, the users might be cut off. It seems all good for this specific policy because most of us agree with it globally. But data protectionism and/or extreme regional deviations/regulations in law will reduce the globalism everyone shares. Other options (such as educating the populace or encouraging competition) can be more effective than restrictions. This is something to think about as the EU grows smaller, not larger. Even today, small companies with fewer EU users may stop and think about providing access at the cost of, e.g., building a portal for them to manage cookie settings.

hamilyon2 9y ago

Encrypt it with key that only the law enforcement has. Keep actual encrypted data on a medium outside of coutry where it is illegal.