4 ms·

I'm thinking EU residents/citizens should be able to do so under the GDPR. The main concern is that the request would cascade to their 3rd parties (as data proc

I'm thinking EU residents/citizens should be able to do so under the GDPR. The main concern is that the request would cascade to their 3rd parties (as data processors) and it might be difficult to anticipate the total reach of the request.

adamnemecek 9y ago
EU doesn't have Equifax.
- dreamfactored 9y ago
  Applies to any EU citizen data anywhere.
  - kingnothing 9y ago
    Applies to EU citizen data for companies that operate in the EU. You can't enforce laws against a company outside of your realm of jurisdiction.
    - aussie1233 9y ago
      GDPR has what is called extra-territorial applicability.
      - stryk 9y ago
        It may, but they'll play hell trying to enforce it worldwide, as if any countries would let them (some may).
      - laingc 9y ago
        If it’s outside their jurisdiction, they can claim whatever applicability they like: the law is simply not enforceable outside that jurisdiction.
        T-Winsnes 9y ago
        Technically yes, laws only apply within sovereign borders, but this is where trade agreements come into effect. EU is a big enough market that most countries will likely agree to uphold the rules for European citizens. It has been a big focus for online retail in Australia lately, and for good reason.
        dragonwriter 9y ago
        The law can be enforced against people who are, or have assets, within the jurisdiction, whether or not the alleged violation occurred there.
        nraynaud 9y ago
        You can also have some very weird legal definition of a nexus, like this bank that allegedly opened a nexus in the US because they used US dollars for a transaction between two non-Us countries. And there is also the case that the US army just land in your country and arrest anyone they could not kill.
        dragonwriter 9y ago
        > And there is also the case that the US army just land in your country and arrest anyone they could not kill. Unlikely; its a lot easier to kill people than arrest them, especially if you are the US army, which is optimized for the former over the latter.
- dmoy 9y ago
  Many eu countries have credit agencies though.
- viraptor 9y ago
  Sure it does: https://www.equifax.co.uk/ https://www.equifax.co.uk/ (or at least some EU countries do)
x0x0 9y ago
Unless you're willing to live without credit, legitimate interests will override. Section 6f. This is, in fact, called out as an example in the ICO guidance. That bit doesn't (imo) seem to have materially changed wrt the DPA / Data Protection Directive 95. Breach notifications are new and interesting though. Equifax definitely would have been required by the gdpr to promptly disclose. I don't specifically know if EU credit agencies are in the practice of widespread selling of credit data besides when a person has asked for credit. The gdpr will definitely allow opt-out of that (by default even!), but I think previous privacy laws may cover that. I'm not sure. My personal opinion is the gdpr is probably the end of Acxiom style businesses, plus all the ancillary businesses the CRAs in the United States get up to besides plain credit reports. Eg marketing, wage tracking, outcomes estimation for colleges, etc.
- djKianoosh 9y ago
  I got it! We'll solve it with blockchain/crypto....
  - jeremyt 9y ago
    Www.civic.com

adamnemecek 9y ago

EU doesn't have Equifax.

dreamfactored 9y ago
Applies to any EU citizen data anywhere.
- kingnothing 9y ago
  Applies to EU citizen data for companies that operate in the EU. You can't enforce laws against a company outside of your realm of jurisdiction.
  - aussie1233 9y ago
    GDPR has what is called extra-territorial applicability.
    - stryk 9y ago
      It may, but they'll play hell trying to enforce it worldwide, as if any countries would let them (some may).
    - laingc 9y ago
      If it’s outside their jurisdiction, they can claim whatever applicability they like: the law is simply not enforceable outside that jurisdiction.
      - T-Winsnes 9y ago
        Technically yes, laws only apply within sovereign borders, but this is where trade agreements come into effect. EU is a big enough market that most countries will likely agree to uphold the rules for European citizens. It has been a big focus for online retail in Australia lately, and for good reason.
      - dragonwriter 9y ago
        The law can be enforced against people who are, or have assets, within the jurisdiction, whether or not the alleged violation occurred there.
        nraynaud 9y ago
        You can also have some very weird legal definition of a nexus, like this bank that allegedly opened a nexus in the US because they used US dollars for a transaction between two non-Us countries. And there is also the case that the US army just land in your country and arrest anyone they could not kill.
        dragonwriter 9y ago
        > And there is also the case that the US army just land in your country and arrest anyone they could not kill. Unlikely; its a lot easier to kill people than arrest them, especially if you are the US army, which is optimized for the former over the latter.
dmoy 9y ago
Many eu countries have credit agencies though.
viraptor 9y ago
Sure it does: https://www.equifax.co.uk/ https://www.equifax.co.uk/ (or at least some EU countries do)

x0x0 9y ago

Unless you're willing to live without credit, legitimate interests will override. Section 6f. This is, in fact, called out as an example in the ICO guidance. That bit doesn't (imo) seem to have materially changed wrt the DPA / Data Protection Directive 95. Breach notifications are new and interesting though. Equifax definitely would have been required by the gdpr to promptly disclose. I don't specifically know if EU credit agencies are in the practice of widespread selling of credit data besides when a person has asked for credit. The gdpr will definitely allow opt-out of that (by default even!), but I think previous privacy laws may cover that. I'm not sure. My personal opinion is the gdpr is probably the end of Acxiom style businesses, plus all the ancillary businesses the CRAs in the United States get up to besides plain credit reports. Eg marketing, wage tracking, outcomes estimation for colleges, etc.

djKianoosh 9y ago
I got it! We'll solve it with blockchain/crypto....
- jeremyt 9y ago
  Www.civic.com