6 ms·

I think worst case (best case?) scenario is that they will 'copy' the data they're not supposed to keep off to another country, maybe anonymize it but otherwise

I think worst case (best case?) scenario is that they will 'copy' the data they're not supposed to keep off to another country, maybe anonymize it but otherwise the data will still be there. Its too important - even in anonymized form. Its capable of helping sociologists, medical researchers, advertisers, etc... They don't need to know that "James. T. McLovin' of 123 Happy Lane, went on 15 dates and slept with 3 women, prefers brunettes", but knowing that a "John Doe, M, 27, income of $50k, likes rugby, etc..." is good information to have.

nicktelford 9y ago
The country the data resides in is irrelevant. If the data is about an EU citizen, that's all that matters. I believe the company in question would also need a legal entity in the EU in order for the EU to prosecute them, as I don't think you can take (e.g.) an American company to an EU court. IANAL though.
- slamdance 9y ago
  eh. Maybe. If they copy the data to a 3rd party in America (i.e. sell the data a marketing company, for "research" purposes), then the EU can't really go after the marketing company. I'm not saying it's right. I don't see why they couldn't anonymize the data (morally or ethically). But, I don't own a marketing company.
  - vidarh 9y ago
    If a company based in the EU is transferring the data to a 3rd party in America without appropriate safeguards to ensure said data is treated in a way that complies with EU law, then the transfer itself is unlawful, and the EU can go after the company for that.
  - stordoff 9y ago
    They don't need to. By selling the data on without ensuring the requirements continue to be met, the original company can be taken to court.
  - kuschku 9y ago
    Actually, the EU wrote into the GDPR that they can do exactly that. Any company with data on EU citizen is liable, no matter where they got it from.
  - rmc 9y ago
    > If they copy the data to a 3rd party in America (i.e. sell the data a marketing company, for "research" purposes), then the EU can't really go after the marketing company. No, but they can go after the original company who transfered the data. Remember, under EU law, companies don't own that personal data. It's not theirs to give away.
- vidarh 9y ago
  You can take an American company to an EU court assuming the EU court has jurisdiction, and laws can specify that its jurisdiction should extend to actions taken outside the geographical area (I don't know if that is the case here). Without a US court case they'd be dependent on assets or an income stream in the EU to be able to force payment of any fines, though.
  - brango 9y ago
    The GDPR relies on international treaties to make the location of the business irrelevant. Any company processing data of EU citizens must comply IIRC.
    - vidarh 9y ago
      Do you have any pointers to where I can find info on that? It's clear that the GDPR itself establishes jurisdiction for EU courts over GDPR worldwide - it's very explicit about that. But I can't find anything about how they'd make it enforceable in other jurisdictions (as opposed to enforcing the judgements by e.g. fining EU subsidiaries and the like). Article 50 does say the Commission should take "appropriate steps" to ensure international "cooperation mechanisms", and its clear under e.g article 44 onwards that carrying out a transfer to a jurisdiction where the data would be subject to inadequate controls would be a violation of the directive, so you may very well be right.
  - pgeorgi 9y ago
    > assuming the EU court has jurisdiction If the company wants to do business with a EU customers, they have _some_ surface area in the EU, which is enough. > an income stream in the EU If the company cares for EU customers, there's probably also _some_ way to make money on them. Unless EU customers will exclusively get Netflix USA ads in the future (which are 100% useless to them) on an otherwise 100% free service, there is a money stream to hook into.
    - rmc 9y ago
      Not only the money stream part, but if a big company pulls out of the EU, then they leave a big hole for someone else to fill. And you've just created a competitor who has a market base that you are choosing to not compete it. e.g. if Facebook pulled out (unlikely), then someone can just make a new Facebook site (we already know what functionality to copy), and then suddenly Facebook has a competitor.
beager 9y ago
> and slept with 3 women At first I thought "how would they know that" but it's simple: establish "home" for each of a match pair and identify that both parties' devices are at one or the other "home" during certain hours after matching. In that sense, it's more than just data, it's inference, and that's almost worse as a private company's data could end up libeling you if it leaks!
- deleted 9y ago
  [deleted]
- devdad 9y ago
  Uhm. I'd guess they'd be able to pull it from chats easier than what you're suggesting.
  - goialoq 9y ago
    ? Running a data-analysis job over location history is much easier than trying to do NLP on chats and detecting ghosting.

nicktelford 9y ago

The country the data resides in is irrelevant. If the data is about an EU citizen, that's all that matters. I believe the company in question would also need a legal entity in the EU in order for the EU to prosecute them, as I don't think you can take (e.g.) an American company to an EU court. IANAL though.

slamdance 9y ago
eh. Maybe. If they copy the data to a 3rd party in America (i.e. sell the data a marketing company, for "research" purposes), then the EU can't really go after the marketing company. I'm not saying it's right. I don't see why they couldn't anonymize the data (morally or ethically). But, I don't own a marketing company.
- vidarh 9y ago
  If a company based in the EU is transferring the data to a 3rd party in America without appropriate safeguards to ensure said data is treated in a way that complies with EU law, then the transfer itself is unlawful, and the EU can go after the company for that.
- stordoff 9y ago
  They don't need to. By selling the data on without ensuring the requirements continue to be met, the original company can be taken to court.
- kuschku 9y ago
  Actually, the EU wrote into the GDPR that they can do exactly that. Any company with data on EU citizen is liable, no matter where they got it from.
- rmc 9y ago
  > If they copy the data to a 3rd party in America (i.e. sell the data a marketing company, for "research" purposes), then the EU can't really go after the marketing company. No, but they can go after the original company who transfered the data. Remember, under EU law, companies don't own that personal data. It's not theirs to give away.
vidarh 9y ago
You can take an American company to an EU court assuming the EU court has jurisdiction, and laws can specify that its jurisdiction should extend to actions taken outside the geographical area (I don't know if that is the case here). Without a US court case they'd be dependent on assets or an income stream in the EU to be able to force payment of any fines, though.
- brango 9y ago
  The GDPR relies on international treaties to make the location of the business irrelevant. Any company processing data of EU citizens must comply IIRC.
  - vidarh 9y ago
    Do you have any pointers to where I can find info on that? It's clear that the GDPR itself establishes jurisdiction for EU courts over GDPR worldwide - it's very explicit about that. But I can't find anything about how they'd make it enforceable in other jurisdictions (as opposed to enforcing the judgements by e.g. fining EU subsidiaries and the like). Article 50 does say the Commission should take "appropriate steps" to ensure international "cooperation mechanisms", and its clear under e.g article 44 onwards that carrying out a transfer to a jurisdiction where the data would be subject to inadequate controls would be a violation of the directive, so you may very well be right.
- pgeorgi 9y ago
  > assuming the EU court has jurisdiction If the company wants to do business with a EU customers, they have _some_ surface area in the EU, which is enough. > an income stream in the EU If the company cares for EU customers, there's probably also _some_ way to make money on them. Unless EU customers will exclusively get Netflix USA ads in the future (which are 100% useless to them) on an otherwise 100% free service, there is a money stream to hook into.
  - rmc 9y ago
    Not only the money stream part, but if a big company pulls out of the EU, then they leave a big hole for someone else to fill. And you've just created a competitor who has a market base that you are choosing to not compete it. e.g. if Facebook pulled out (unlikely), then someone can just make a new Facebook site (we already know what functionality to copy), and then suddenly Facebook has a competitor.

beager 9y ago

> and slept with 3 women At first I thought "how would they know that" but it's simple: establish "home" for each of a match pair and identify that both parties' devices are at one or the other "home" during certain hours after matching. In that sense, it's more than just data, it's inference, and that's almost worse as a private company's data could end up libeling you if it leaks!

deleted 9y ago
[deleted]
devdad 9y ago
Uhm. I'd guess they'd be able to pull it from chats easier than what you're suggesting.
- goialoq 9y ago
  ? Running a data-analysis job over location history is much easier than trying to do NLP on chats and detecting ghosting.