4 ms·

GDPR has been in "preview mode" for two years but it is currently the law in many countries. It will start being enforced in May so you already have had two yea

by tyfon 9y ago

GDPR has been in "preview mode" for two years but it is currently the law in many countries. It will start being enforced in May so you already have had two years to fix the issue if I read you correctly.

closeparen 9y ago
Extraterritoriality is new. Most websites are probably not in the business of complying with the law in random EU countries where they have no legal or logistical presence. HN, for example, doesn’t.
- cinquemb 9y ago
  Well, let's not pretend that it will stop EU countries from trying to engage in this glorified rent seeking exercise cum morality play against companies everywhere.
  - the_mitsuhiko 9y ago
    Which cases do you have in mind where that happened?
    - cinquemb 9y ago
      The case where CNIL told my company to do remove information we had collected on our site. We are not based in the EU nor have any assets they can exert any influence over in the EU. We promptly ignored the request. But did have some private words we exchanged amongst ourselves at the futility of such request.
      - the_mitsuhiko 9y ago
        It doesn’t matter if you are based in the EU or not. You are already required to register for VAT as a non EU company and that’s one of the many ways in. Privacy Shield is another.
        cinquemb 9y ago
        >nor have any assets they can exert any influence over in the EU.
        the_mitsuhiko 9y ago
        You are still legally required. Pretending that it’s okay to ignore your legal obligations because you think they have no leverage does not seem like a sensible thing to do. Neither morally nor legally unless you are willing to write off the EU market.
        cinquemb 9y ago
        As a non EU person or company with no legal assets in the EU, even if you or any EU institution says this, there are no repercussions from us continuing to engage in the activities (collecting data people put willing into the open) because there is no ability for the EU to enforce these laws upon us, short of arresting us outside of EU's borders. In order to stop us technically, the EU must pass laws that disallow their citizens to give information to platforms of various forms that could be used in various ways to amass data upon them as well as against allowing their citizens from accessing such information on sites like ours that mine crypto based on the time they spend on the site engaging with such information. >are willing to write off the EU market. We don't discriminate against our site visitors; we want to collect, correlate, cross-reference, and process it all and put it into the public to be used however people everywhere see fit, just like governments do today!
        the_mitsuhiko 9y ago
        There are years worth of backtaxes for failure to pay VAT. If you think you can skirt it for forever that might work for you. Very few companies are like that though and even small companies I know did not fare well with this approach. It’s your responsibilty as a business not to accept customers from countries you cannot do business with. //edit: > We don't discriminate against our site visitors; we want to collect, correlate, cross-reference, and process it all and put it into the public to be used however people everywhere see fit, just like governments do today! Which is not permitted under GDPR ever.
- pjc50 9y ago
  I'm as Remain as the next person but I think extraterritoriality is a really bad idea whatever the circumstances. But it's not as if this is the first instance of extraterritorial law, and it's not like the US doesn't tend to assume its law applies everywhere too (e.g. gambling). To me it seems to have parallels with tax law and AML. If it's not extraterritorial, a big business of tax havens and money laundering springs up. The extraterritorial GDPR rules are there to prevent "data laundering" similarly.

by tyfon 9y ago

closeparen 9y ago

Extraterritoriality is new. Most websites are probably not in the business of complying with the law in random EU countries where they have no legal or logistical presence. HN, for example, doesn’t.

cinquemb 9y ago
Well, let's not pretend that it will stop EU countries from trying to engage in this glorified rent seeking exercise cum morality play against companies everywhere.
- the_mitsuhiko 9y ago
  Which cases do you have in mind where that happened?
  - cinquemb 9y ago
    The case where CNIL told my company to do remove information we had collected on our site. We are not based in the EU nor have any assets they can exert any influence over in the EU. We promptly ignored the request. But did have some private words we exchanged amongst ourselves at the futility of such request.
    - the_mitsuhiko 9y ago
      It doesn’t matter if you are based in the EU or not. You are already required to register for VAT as a non EU company and that’s one of the many ways in. Privacy Shield is another.
      - cinquemb 9y ago
        >nor have any assets they can exert any influence over in the EU.
        the_mitsuhiko 9y ago
        You are still legally required. Pretending that it’s okay to ignore your legal obligations because you think they have no leverage does not seem like a sensible thing to do. Neither morally nor legally unless you are willing to write off the EU market.
        cinquemb 9y ago
        As a non EU person or company with no legal assets in the EU, even if you or any EU institution says this, there are no repercussions from us continuing to engage in the activities (collecting data people put willing into the open) because there is no ability for the EU to enforce these laws upon us, short of arresting us outside of EU's borders. In order to stop us technically, the EU must pass laws that disallow their citizens to give information to platforms of various forms that could be used in various ways to amass data upon them as well as against allowing their citizens from accessing such information on sites like ours that mine crypto based on the time they spend on the site engaging with such information. >are willing to write off the EU market. We don't discriminate against our site visitors; we want to collect, correlate, cross-reference, and process it all and put it into the public to be used however people everywhere see fit, just like governments do today!
        the_mitsuhiko 9y ago
        There are years worth of backtaxes for failure to pay VAT. If you think you can skirt it for forever that might work for you. Very few companies are like that though and even small companies I know did not fare well with this approach. It’s your responsibilty as a business not to accept customers from countries you cannot do business with. //edit: > We don't discriminate against our site visitors; we want to collect, correlate, cross-reference, and process it all and put it into the public to be used however people everywhere see fit, just like governments do today! Which is not permitted under GDPR ever.
pjc50 9y ago
I'm as Remain as the next person but I think extraterritoriality is a really bad idea whatever the circumstances. But it's not as if this is the first instance of extraterritorial law, and it's not like the US doesn't tend to assume its law applies everywhere too (e.g. gambling). To me it seems to have parallels with tax law and AML. If it's not extraterritorial, a big business of tax havens and money laundering springs up. The extraterritorial GDPR rules are there to prevent "data laundering" similarly.