7 ms·

» The CNIL said it had repeatedly asked WhatsApp to provide a sample of French users’ data transferred to Facebook but the company had explained it could not do

» The CNIL said it had repeatedly asked WhatsApp to provide a sample of French users’ data transferred to Facebook but the company had explained it could not do so as it is located in the United States and “it considers that it is only subject to the legislation of this country.” « That's a very interesting quote from Facebook, and explains why the GDPR has a special section explaining that it also applies to foreign companies that process data of EU citizen. In general, Facebook is trying to set a dangerous precedent here. A company operating in our countries, taking our data, owning property in our countries, having employees in our countries, owning critical infrastructure in our countries (WhatsApp has basically replaced SMS and other messaging infrastructure), yet refusing to acknowledge the laws of the countries they operate in.

marksomnian 9y ago
> the GDPR has a special section explaining that it also applies to foreign companies that process data of EU citizen Is such a clause enforceable and/or valid? How could the EU punish a non-EU business for violating this? I guess they could block/get an injunction against them within the EU, but that seems like the sort of thing that would get challenged legally.
- ainiriand 9y ago
  It looks to be the same situation with Apple's Irish Taxes, finally Apple had to comply.
- germanier 9y ago
  There is nothing that would stop this legally (what authority should hinder them?). Things that can be enforced are only limited by practicality. Any non-EU business worth enforcing such a law against will very likely do business inside the EU (e.g. selling ads to local companies). Any money transferred can then be froozen to enforce this law. Facebook in particular does business as an Irish company for its EU users, so no problem at all here.
  - hartator 9y ago
    So, if you sell products or services in China, you have to comply to all China regulations, not just exports? That doesn't make any sense.
    - tonyztan 9y ago
      That is the way it currently works, yes. If your foreign web service is not approved by the Chinese government, it will most likely be blocked in China.
    - titanix2 9y ago
      That’s exactly what is happening: Windows 10 "China Edition" or some moves from Apple to comply with Chinese regulations for example. Respecting local regulations is not a mind blowing fact. A foreign company cannot sell heroin in the USA under the pretext it is legal in their country.
      - dguest 9y ago
        So you mean I can't use <insert shitty country>'s child pornography app in the US? I know it's an extreme case, but yeah, of course countries expect people who do business in them to respect their laws.
    - 1_2__4 9y ago
      I feel like you're getting quite the education in how the world works today.
- hanbura 9y ago
  Why shouldn't it be valid? As a European accessing US servers I also have to comply to US anti-hacking laws. The only limit is enforceability.
titanix2 9y ago
Don’t understand the downvote you’re facing. Whatsapp is operating in France so it must comply with the ruling here. Moreover the fact that they hide from the CNIL the data they are sharing probably mean they do not comply to the regulations (which are here to protect people). Too bad the sanctions are not dissuasive enough to force compliance. Politicians are allowing this situation from too long (same with taxes avoidance schemes).
- hartator 9y ago
  It will be nightmare if you have to comply to every laws of a country just because you have users in it.
  - edran 9y ago
    It's not a nightmare, it's a responsibility towards the people who use your product, and the society that allows you to gain wealth from such usage. If you want to simplify the system, lobby for multiple nations to adopt a good standard, or move on.
    - hartator 9y ago
      So, are you going to report NK users to them if you host dissident contents? You have to comply to your local laws, not foreign laws.
      - deleted 9y ago
        [deleted]
      - notimetorelax 9y ago
        You have a choice of not offering your services in these countries.
  - chaosite 9y ago
    This isn't even a law, it's an order. Don't want to comply? Don't accept users from that country. That's the reality of a multi-national...
hartator 9y ago
I am glad as an US company we don't have to comply to the dumb EU cookie laws. Yeah, we know every websites in the world uses cookies. Don't need a modal everywhere.
- toomuchtodo 9y ago
  Bad news friend. You have to comply with GDPR if any of your users are in the EU, even if they were originally not in the EU when they signed up. Your user merely needs to be a EU resident. https://en.wikipedia.org/wiki/General_Data_Protection_Regulation#Scope https://en.wikipedia.org/wiki/General_Data_Protection_Regula... --- The regulation applies if the data controller (an organization that collects data from EU residents) or processor (an organization that processes data on behalf of data controller e.g. cloud service providers) or the data subject (person) is based in the EU. Furthermore the regulation also applies to organizations based outside the European Union if they collect or process personal data of EU residents. According to the European Commission "personal data is any information relating to an individual, whether it relates to his or her private, professional or public life. It can be anything from a name, a home address, a photo, an email address, bank details, posts on social networking websites, medical information, or a computer’s IP address." ---
  - hartator 9y ago
    If you don't have an organization in EU, they can't sue you in the U.S. because it's allowed here. It's like the U.S. trying to sue local Amsterdam pot shop because they sell drugs to U.S. residents.
    - deleted 9y ago
      [deleted]
    - germanier 9y ago
      I have bad news for you: things like the Uniform Foreign Money Judgments Recognition Act exist which makes it possible to enforce foreign verdicts. Even if no such law applies, most US companies that do business with EU customers have by definition some assets in the EU even if only briefly (or else they couldn't charge them anything). The US doesn't sue foreign pot shops because the sale happens abroad and they have decided to not bother with that but they absolutely could enacted such a law if they wanted. Who is there to stop them? The US actually does apply some of its laws abroad. Here is an example that is similar to yours https://www.insightcrime.org/news/analysis/as-us-prosecutes-foreign-crimes-how-far-can-its-extraterritorial-jurisdiction-reach/ https://www.insightcrime.org/news/analysis/as-us-prosecutes-... Again, the problem is only enforceability. If they can't get hold of any money, a verdict is useless.
gourou 9y ago
> WhatsApp has basically replaced SMS and other messaging infrastructure That's especially true here in Spain where SMS prices dropped long after 3G appeared. There's even road/trafic signs showing Whatsapp's dominance. http://ecodiario.eleconomista.es/sociedad/noticias/6600084/04/15/Asi-son-los-pasos-de-cebra-que-advierten-contra-el-uso-de-WhatsApp-cruzando-la-calle.html http://ecodiario.eleconomista.es/sociedad/noticias/6600084/0... http://www.stateofdigital.com/marketer-understand-acquisition-whatsapp/ http://www.stateofdigital.com/marketer-understand-acquisitio...
briandear 9y ago
> taking our data Hang on. You're GIVING it the data. People want "free" services, so I'm genuinely curious what people actually expect is going to happen when they use WhatsApp. Is it just something provided benevolently? How does WhatsApp make money? Are people really so ignorant to think that they can get a free lunch? There's an implied quid pro quo -- you use a free service in exchange for providing data used to sell you products from advertisers. You want to protect your privacy? Stop using so-called "free" services where you are the product. Why should this even need regulation? People are making a choice to use Facebook/WA when they could be using conventional SMS or iMessage. But they get mad about paying for SMS -- so they trade privacy for "free." That's on the user. Who's supposed to pay for WhatsApp to run? Other than the early days when people paid $1/€1, it's free to users. Who pays for it? > having employees in our countries So providing jobs is a bad thing? What's the unemployment rate in France? It's over 10%. It seems like FB/etc. are actually providing a benefit to the country. Those employees also pay taxes, and buy stuff, thus benefiting the economy. You should be glad they have employees in those countries. I'm sure the employees are glad to have a job! > owning property in our countries And paying property tax. And making improvements. And attracting further economic development. > owning critical infrastructure in our countries ?? They don't own the phone companies -- it's people's choice to not use conventional SMS, but conventional SMS and phone lines still exist. WhatsApp is hardly 'critical'. Any nontrivial use of WhatsApp (i.e. by emergency services) is just stupid. That's on the population, not the fault of Facebook and friends.
- chrisper 9y ago
  Maybe you don't remember, but WhatsApp used to cost money. I even bought it back then. So how can I opt out of this data sharing then?
  - kuschku 9y ago
    Same for me, we paid WhatsApp to use a messenger that’s convenient, and isn’t Facebook. And yet, this now happened.
- fineng123 9y ago
  It's not like the concept is very complicated. As soon as stuff like this goes open source/distributed, the model falls apart. The Linuxification of everything will destroy the world as we know it

marksomnian 9y ago

> the GDPR has a special section explaining that it also applies to foreign companies that process data of EU citizen Is such a clause enforceable and/or valid? How could the EU punish a non-EU business for violating this? I guess they could block/get an injunction against them within the EU, but that seems like the sort of thing that would get challenged legally.

ainiriand 9y ago
It looks to be the same situation with Apple's Irish Taxes, finally Apple had to comply.
germanier 9y ago
There is nothing that would stop this legally (what authority should hinder them?). Things that can be enforced are only limited by practicality. Any non-EU business worth enforcing such a law against will very likely do business inside the EU (e.g. selling ads to local companies). Any money transferred can then be froozen to enforce this law. Facebook in particular does business as an Irish company for its EU users, so no problem at all here.
- hartator 9y ago
  So, if you sell products or services in China, you have to comply to all China regulations, not just exports? That doesn't make any sense.
  - tonyztan 9y ago
    That is the way it currently works, yes. If your foreign web service is not approved by the Chinese government, it will most likely be blocked in China.
  - titanix2 9y ago
    That’s exactly what is happening: Windows 10 "China Edition" or some moves from Apple to comply with Chinese regulations for example. Respecting local regulations is not a mind blowing fact. A foreign company cannot sell heroin in the USA under the pretext it is legal in their country.
    - dguest 9y ago
      So you mean I can't use <insert shitty country>'s child pornography app in the US? I know it's an extreme case, but yeah, of course countries expect people who do business in them to respect their laws.
  - 1_2__4 9y ago
    I feel like you're getting quite the education in how the world works today.
hanbura 9y ago
Why shouldn't it be valid? As a European accessing US servers I also have to comply to US anti-hacking laws. The only limit is enforceability.

titanix2 9y ago

Don’t understand the downvote you’re facing. Whatsapp is operating in France so it must comply with the ruling here. Moreover the fact that they hide from the CNIL the data they are sharing probably mean they do not comply to the regulations (which are here to protect people). Too bad the sanctions are not dissuasive enough to force compliance. Politicians are allowing this situation from too long (same with taxes avoidance schemes).

hartator 9y ago
It will be nightmare if you have to comply to every laws of a country just because you have users in it.
- edran 9y ago
  It's not a nightmare, it's a responsibility towards the people who use your product, and the society that allows you to gain wealth from such usage. If you want to simplify the system, lobby for multiple nations to adopt a good standard, or move on.
  - hartator 9y ago
    So, are you going to report NK users to them if you host dissident contents? You have to comply to your local laws, not foreign laws.
    - deleted 9y ago
      [deleted]
    - notimetorelax 9y ago
      You have a choice of not offering your services in these countries.
- chaosite 9y ago
  This isn't even a law, it's an order. Don't want to comply? Don't accept users from that country. That's the reality of a multi-national...

hartator 9y ago

I am glad as an US company we don't have to comply to the dumb EU cookie laws. Yeah, we know every websites in the world uses cookies. Don't need a modal everywhere.

toomuchtodo 9y ago
Bad news friend. You have to comply with GDPR if any of your users are in the EU, even if they were originally not in the EU when they signed up. Your user merely needs to be a EU resident. https://en.wikipedia.org/wiki/General_Data_Protection_Regulation#Scope https://en.wikipedia.org/wiki/General_Data_Protection_Regula... --- The regulation applies if the data controller (an organization that collects data from EU residents) or processor (an organization that processes data on behalf of data controller e.g. cloud service providers) or the data subject (person) is based in the EU. Furthermore the regulation also applies to organizations based outside the European Union if they collect or process personal data of EU residents. According to the European Commission "personal data is any information relating to an individual, whether it relates to his or her private, professional or public life. It can be anything from a name, a home address, a photo, an email address, bank details, posts on social networking websites, medical information, or a computer’s IP address." ---
- hartator 9y ago
  If you don't have an organization in EU, they can't sue you in the U.S. because it's allowed here. It's like the U.S. trying to sue local Amsterdam pot shop because they sell drugs to U.S. residents.
  - deleted 9y ago
    [deleted]
  - germanier 9y ago
    I have bad news for you: things like the Uniform Foreign Money Judgments Recognition Act exist which makes it possible to enforce foreign verdicts. Even if no such law applies, most US companies that do business with EU customers have by definition some assets in the EU even if only briefly (or else they couldn't charge them anything). The US doesn't sue foreign pot shops because the sale happens abroad and they have decided to not bother with that but they absolutely could enacted such a law if they wanted. Who is there to stop them? The US actually does apply some of its laws abroad. Here is an example that is similar to yours https://www.insightcrime.org/news/analysis/as-us-prosecutes-foreign-crimes-how-far-can-its-extraterritorial-jurisdiction-reach/ https://www.insightcrime.org/news/analysis/as-us-prosecutes-... Again, the problem is only enforceability. If they can't get hold of any money, a verdict is useless.

gourou 9y ago

> WhatsApp has basically replaced SMS and other messaging infrastructure That's especially true here in Spain where SMS prices dropped long after 3G appeared. There's even road/trafic signs showing Whatsapp's dominance. http://ecodiario.eleconomista.es/sociedad/noticias/6600084/04/15/Asi-son-los-pasos-de-cebra-que-advierten-contra-el-uso-de-WhatsApp-cruzando-la-calle.html http://ecodiario.eleconomista.es/sociedad/noticias/6600084/0... http://www.stateofdigital.com/marketer-understand-acquisition-whatsapp/ http://www.stateofdigital.com/marketer-understand-acquisitio...

briandear 9y ago

> taking our data Hang on. You're GIVING it the data. People want "free" services, so I'm genuinely curious what people actually expect is going to happen when they use WhatsApp. Is it just something provided benevolently? How does WhatsApp make money? Are people really so ignorant to think that they can get a free lunch? There's an implied quid pro quo -- you use a free service in exchange for providing data used to sell you products from advertisers. You want to protect your privacy? Stop using so-called "free" services where you are the product. Why should this even need regulation? People are making a choice to use Facebook/WA when they could be using conventional SMS or iMessage. But they get mad about paying for SMS -- so they trade privacy for "free." That's on the user. Who's supposed to pay for WhatsApp to run? Other than the early days when people paid $1/€1, it's free to users. Who pays for it? > having employees in our countries So providing jobs is a bad thing? What's the unemployment rate in France? It's over 10%. It seems like FB/etc. are actually providing a benefit to the country. Those employees also pay taxes, and buy stuff, thus benefiting the economy. You should be glad they have employees in those countries. I'm sure the employees are glad to have a job! > owning property in our countries And paying property tax. And making improvements. And attracting further economic development. > owning critical infrastructure in our countries ?? They don't own the phone companies -- it's people's choice to not use conventional SMS, but conventional SMS and phone lines still exist. WhatsApp is hardly 'critical'. Any nontrivial use of WhatsApp (i.e. by emergency services) is just stupid. That's on the population, not the fault of Facebook and friends.

chrisper 9y ago
Maybe you don't remember, but WhatsApp used to cost money. I even bought it back then. So how can I opt out of this data sharing then?
- kuschku 9y ago
  Same for me, we paid WhatsApp to use a messenger that’s convenient, and isn’t Facebook. And yet, this now happened.
fineng123 9y ago
It's not like the concept is very complicated. As soon as stuff like this goes open source/distributed, the model falls apart. The Linuxification of everything will destroy the world as we know it