7 ms·

How is the law reasonable? It's not even clear what is allowed under it and what isn't. The EU refuses to clarify anything, the only time any decision will be m

How is the law reasonable? It's not even clear what is allowed under it and what isn't. The EU refuses to clarify anything, the only time any decision will be made is by courts, if there's an actual dispute in progress. The rules are so vague that any firm could be argued to be in violation. And the EU acts as judge, jury and executioner. It looks like a way to tax the SV tech firms without needing a treaty change. After all there's no practical difference between a tax and a law that everyone is guaranteed to always be in violation of that has huge fines attached. The money all goes straight into EU central coffers.

throwawaymaroon 9y ago
It's about time things started being unfair to corporations the same way they're unfair towards individuals.
Xylakant 9y ago
“And the EU acts as judge, jury and executioner.” That’s true only if you regard he EU as a single entity. Laws made via the EU will be turned into national law, and independent judges will judge all cases, up to the EU high court. By the same right you could call the US judge, jury and executioner on all laws and rules made and enforced by the US government (FACTA anyone?)
- peoplewindow 9y ago
  No. That's not how the EU works. That's how a national government would work but not the EU. The GDPR is not a directive so it does not have to be translated into national law. It is directly binding and applies immediately everywhere. Fines have to be paid up front, before appeals are exhausted. Appeals can of course take years. The EU courts have judges appointed by the same people who control the rest of the EU, and are ideologically aligned as such. They have a long history of legislating from the bench and making shocking and nonsensical decisions: consider the case where they simply voided the UK's opt out of new human rights related legislation, despite a very clear paragraph in the treaties saying they did not apply to the UK. The court simply decided it didn't like that bit of the treaty and so it did not apply. I do not regard the ECJ as a robust court. It will rule in whatever way is most favourable to the European project.
  - pjc50 9y ago
    No, the enforcement is through the national "supervisory authorities" such as the ICO. Most of the enforcement process is through national courts and the ECJ is only for the final layer of appeal. This very article says "German Court rules ..." > voided the UK's opt out of new human rights related legislation, despite a very clear paragraph in the treaties saying they did not apply to the UK. [citation needed]; did you read this in the UK press?
    - peoplewindow 9y ago
      See here: https://fullfact.org/europe/eu-and-human-rights/ https://fullfact.org/europe/eu-and-human-rights/ In the section "Wasn’t the UK supposed to get an opt-out from EU human rights laws?" The summary is, when the Treaty of Lisbon awarded the EU new human rights powers the UK and Poland negotiated an opt out which was written in the treaty. It was a part of convincing the UK government to accept the new treaty without granting a referendum on it, as they had previously promised. The opt out is very clear, really as clear as lawyers can make such things. It says: The charter does not extend the ability of the CJEU, or any court or tribunal of… the United Kingdom, to find that the laws, regulations or administrative provisions, practices or action of… the United Kingdom are inconsistent with the fundamental rights, freedoms and principles that it reaffirms and In particular, and for the avoidance of doubt, nothing in Title IV of the Charter creates justiciable rights applicable to Poland or the United Kingdom except in so far as Poland or the United Kingdom has provided for such rights in its national law http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:C:2007:306:0156:0157:EN:PDF http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:C:2... In other words, this part of the treaty does not allow the courts to overturn UK laws. Stated twice, for clarity. A few years later the ECJ decided that the opt out was meaningless and voided it, under a new interpretation that they claimed meant they'd actually always had these powers, and therefore the treaty did not "extend" them, and so the opt out didn't "work" despite its apparently clear wording. They then began overturning UK laws. It's unclear why the treaty had anything new in it at all if the courts had always had these powers of course, but this is how things go in the EU - no matter how plainly something seems to be written, no matter how clear the assurances seem to be at the time, the moment it becomes politically inconvenient to the project the rules are tossed out under bizarre and kafkaesque re-interpretations. Same thing happened to Ireland with corporation tax. They were promised the EU wouldn't interfere with their tax policies. Then the EU decided low taxes were "state aid" and awarded itself the power to control Irish tax policy. Nobody had previously interpreted the state aid clauses that way.
Joe-Z 9y ago
>The rules are so vague that any firm could be argued to be in violation. I think that's a good thing. So the law has to be interpreted by precedence set by the courts. If the text of is too specific you could have the opposite effect of companies weaseling through. It is not a tax. It's pretty clear that the EU expects companies to treat private user data with respect. If your company cannot operate without exploiting this info, than maybe the world is better off without it anyway.
- peoplewindow 9y ago
  Why have any law at all, by your logic? Just have a single law that says "Whatever we decide, is final" and make up all rulings and fines on the fly. No 'weaselling' is possible then. Only problem is, it's totalitarian. Nobody knows what is or is not allowed, there is no such thing as justice. Law is meant to be precise. If it's not, then ignorance of the law does become an excuse and law loses its moral authority. Unfortunately the EU does seem rather keen on laws so vague that they're impossible to understand - it's rule by law, not rule of law.
  - Joe-Z 9y ago
    As mentioned in another reply, the actual laws will have to be implemented by the member states anyway. So the text for each country can vary and can be more specific. As for your strawman that I somehow argued to abandon all law: I won't deal with that.
    - Tomte 9y ago
      No, they actually won't. The Data Protection Directive needed to be implemented by national legislators into national law, but the GDPR is a regulation which means it is directly binding law. Only a few technical, minor points need to be spelled out in national regulations or laws.
      - x0x0 9y ago
        That's simply not true. Each country (or state, in the case of Germany I believe) will have their own privacy commissioner with substantial leeway. Now technically these differences won't be implemented as laws, but there will be substantial differences between eg the French and the UK privacy regulators. The GDPR also allows for individual states to strengthen its provisions, eg for genetic data.
ncallaway 9y ago
> How is the law reasonable? It's not even clear what is allowed under it and what isn't. The EU refuses to clarify anything, the only time any decision will be made is by courts, if there's an actual dispute in progress. How is that different from a US law like HIPAA? The structures of the law seem largely the same, in that they give you guidelines to follow, but provide no clarity about what specifically is required by it and what isn't. Understanding HIPAA has largely come from companies doing their best to comply with their understanding, and clarifications tend to come from courts when there's an actual dispute in progress. Then, the US (through it's various district courts, circuit courts, the supreme court, and regulatory bodies) acts as the "judge, jury, and executioner".
- peoplewindow 9y ago
  HIPAA and other mega-regulations like them have the same problems. And they do cause people to just give up rather than deal with the risk. I've listened in on various conversations around health products over the years. HIPAA is a common reason given for not getting into the healthcare space and focusing elsewhere. A lot of smart people and smart products that could have been focused on health just never turn up at all, because of the vagueness, poor drafting and expansive reach of such things. But this specific thread is about EU social network privacy fines, not US healthcare privacy fines. The US courts aren't quite the same. They're a lot more independent. The ECJ has a history of surprising things, like hearing cases where one of the appellants wasn't aware he was involved in a court case at all and both sides turned out to be the same law firm, or simply voiding parts of the treaties they found to be inconvenient to the EU, or inventing new 'rights' on the fly (legislating from the bench). Like the right to be forgotten, which was invented by the judges in response to a lawsuit and required massive responses similar to the creation of entirely new regulations. The Supreme Court is generally much better about following the Constitution, not inventing new laws on the fly and ensuring the cases before them are actually legitimate.
  - ethbro 9y ago
    > I've listened in on various conversations around health products over the years. HIPAA is a common reason given for not getting into the healthcare space and focusing elsewhere. A lot of smart people and smart products that could have been focused on health just never turn up at all, because of the vagueness, poor drafting and expansive reach of such things. As someone who worked extensively on HIPAA covered data and systems, there are only three options here. Option 1) Mandate no data protection. This is how you end up with hidden security dumpster fires like Equifax, when public companies are involved (cost of security vs profit). Option 2) Strictly mandate how companies must behave to be compliant. Example: DoD (I believe?). Legal requirements always lag technical best practices. Option 3) Generally mandate what compliance results in. Example: HIPAA. Results in lack of clarity and legal challenges. Of these options, I'll take (3) every time. If a startup isn't willing to make a best effort to comply (which is specifically worded into HIPAA and substantially reduces penalties), then I'd rather they not be able to touch my health data anyway...
petre 9y ago
Vague laws = arbitrary justice. They will aid the EU's squeezing money out of US corporations under the pretense that they're protecting the consumer.
loup-vaillant 9y ago
> And the EU acts as judge, jury and executioner. Now, now, you make it sound like a single human actually endorses those three roles. Any state (or group of states) is judge, jury, and executioner. I also write and dictates laws… And that's okay.
TheAceOfHearts 9y ago
The real world is very complicated. As time goes on, there will be lots of court cases which set a precedent. Even though I dislike em, I think the laws surrounding fair use and copyright are another example. Due to its nature, it's incredibly difficult to provide exhaustive guidelines. As long as these large enterprises engage in a good faith attempt at complying with the law they shouldn't end up receiving huge fines.

throwawaymaroon 9y ago

It's about time things started being unfair to corporations the same way they're unfair towards individuals.

Xylakant 9y ago

“And the EU acts as judge, jury and executioner.” That’s true only if you regard he EU as a single entity. Laws made via the EU will be turned into national law, and independent judges will judge all cases, up to the EU high court. By the same right you could call the US judge, jury and executioner on all laws and rules made and enforced by the US government (FACTA anyone?)

peoplewindow 9y ago
No. That's not how the EU works. That's how a national government would work but not the EU. The GDPR is not a directive so it does not have to be translated into national law. It is directly binding and applies immediately everywhere. Fines have to be paid up front, before appeals are exhausted. Appeals can of course take years. The EU courts have judges appointed by the same people who control the rest of the EU, and are ideologically aligned as such. They have a long history of legislating from the bench and making shocking and nonsensical decisions: consider the case where they simply voided the UK's opt out of new human rights related legislation, despite a very clear paragraph in the treaties saying they did not apply to the UK. The court simply decided it didn't like that bit of the treaty and so it did not apply. I do not regard the ECJ as a robust court. It will rule in whatever way is most favourable to the European project.
- pjc50 9y ago
  No, the enforcement is through the national "supervisory authorities" such as the ICO. Most of the enforcement process is through national courts and the ECJ is only for the final layer of appeal. This very article says "German Court rules ..." > voided the UK's opt out of new human rights related legislation, despite a very clear paragraph in the treaties saying they did not apply to the UK. [citation needed]; did you read this in the UK press?
  - peoplewindow 9y ago
    See here: https://fullfact.org/europe/eu-and-human-rights/ https://fullfact.org/europe/eu-and-human-rights/ In the section "Wasn’t the UK supposed to get an opt-out from EU human rights laws?" The summary is, when the Treaty of Lisbon awarded the EU new human rights powers the UK and Poland negotiated an opt out which was written in the treaty. It was a part of convincing the UK government to accept the new treaty without granting a referendum on it, as they had previously promised. The opt out is very clear, really as clear as lawyers can make such things. It says: The charter does not extend the ability of the CJEU, or any court or tribunal of… the United Kingdom, to find that the laws, regulations or administrative provisions, practices or action of… the United Kingdom are inconsistent with the fundamental rights, freedoms and principles that it reaffirms and In particular, and for the avoidance of doubt, nothing in Title IV of the Charter creates justiciable rights applicable to Poland or the United Kingdom except in so far as Poland or the United Kingdom has provided for such rights in its national law http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:C:2007:306:0156:0157:EN:PDF http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:C:2... In other words, this part of the treaty does not allow the courts to overturn UK laws. Stated twice, for clarity. A few years later the ECJ decided that the opt out was meaningless and voided it, under a new interpretation that they claimed meant they'd actually always had these powers, and therefore the treaty did not "extend" them, and so the opt out didn't "work" despite its apparently clear wording. They then began overturning UK laws. It's unclear why the treaty had anything new in it at all if the courts had always had these powers of course, but this is how things go in the EU - no matter how plainly something seems to be written, no matter how clear the assurances seem to be at the time, the moment it becomes politically inconvenient to the project the rules are tossed out under bizarre and kafkaesque re-interpretations. Same thing happened to Ireland with corporation tax. They were promised the EU wouldn't interfere with their tax policies. Then the EU decided low taxes were "state aid" and awarded itself the power to control Irish tax policy. Nobody had previously interpreted the state aid clauses that way.

Joe-Z 9y ago

>The rules are so vague that any firm could be argued to be in violation. I think that's a good thing. So the law has to be interpreted by precedence set by the courts. If the text of is too specific you could have the opposite effect of companies weaseling through. It is not a tax. It's pretty clear that the EU expects companies to treat private user data with respect. If your company cannot operate without exploiting this info, than maybe the world is better off without it anyway.

peoplewindow 9y ago
Why have any law at all, by your logic? Just have a single law that says "Whatever we decide, is final" and make up all rulings and fines on the fly. No 'weaselling' is possible then. Only problem is, it's totalitarian. Nobody knows what is or is not allowed, there is no such thing as justice. Law is meant to be precise. If it's not, then ignorance of the law does become an excuse and law loses its moral authority. Unfortunately the EU does seem rather keen on laws so vague that they're impossible to understand - it's rule by law, not rule of law.
- Joe-Z 9y ago
  As mentioned in another reply, the actual laws will have to be implemented by the member states anyway. So the text for each country can vary and can be more specific. As for your strawman that I somehow argued to abandon all law: I won't deal with that.
  - Tomte 9y ago
    No, they actually won't. The Data Protection Directive needed to be implemented by national legislators into national law, but the GDPR is a regulation which means it is directly binding law. Only a few technical, minor points need to be spelled out in national regulations or laws.
    - x0x0 9y ago
      That's simply not true. Each country (or state, in the case of Germany I believe) will have their own privacy commissioner with substantial leeway. Now technically these differences won't be implemented as laws, but there will be substantial differences between eg the French and the UK privacy regulators. The GDPR also allows for individual states to strengthen its provisions, eg for genetic data.

ncallaway 9y ago

> How is the law reasonable? It's not even clear what is allowed under it and what isn't. The EU refuses to clarify anything, the only time any decision will be made is by courts, if there's an actual dispute in progress. How is that different from a US law like HIPAA? The structures of the law seem largely the same, in that they give you guidelines to follow, but provide no clarity about what specifically is required by it and what isn't. Understanding HIPAA has largely come from companies doing their best to comply with their understanding, and clarifications tend to come from courts when there's an actual dispute in progress. Then, the US (through it's various district courts, circuit courts, the supreme court, and regulatory bodies) acts as the "judge, jury, and executioner".

peoplewindow 9y ago
HIPAA and other mega-regulations like them have the same problems. And they do cause people to just give up rather than deal with the risk. I've listened in on various conversations around health products over the years. HIPAA is a common reason given for not getting into the healthcare space and focusing elsewhere. A lot of smart people and smart products that could have been focused on health just never turn up at all, because of the vagueness, poor drafting and expansive reach of such things. But this specific thread is about EU social network privacy fines, not US healthcare privacy fines. The US courts aren't quite the same. They're a lot more independent. The ECJ has a history of surprising things, like hearing cases where one of the appellants wasn't aware he was involved in a court case at all and both sides turned out to be the same law firm, or simply voiding parts of the treaties they found to be inconvenient to the EU, or inventing new 'rights' on the fly (legislating from the bench). Like the right to be forgotten, which was invented by the judges in response to a lawsuit and required massive responses similar to the creation of entirely new regulations. The Supreme Court is generally much better about following the Constitution, not inventing new laws on the fly and ensuring the cases before them are actually legitimate.
- ethbro 9y ago
  > I've listened in on various conversations around health products over the years. HIPAA is a common reason given for not getting into the healthcare space and focusing elsewhere. A lot of smart people and smart products that could have been focused on health just never turn up at all, because of the vagueness, poor drafting and expansive reach of such things. As someone who worked extensively on HIPAA covered data and systems, there are only three options here. Option 1) Mandate no data protection. This is how you end up with hidden security dumpster fires like Equifax, when public companies are involved (cost of security vs profit). Option 2) Strictly mandate how companies must behave to be compliant. Example: DoD (I believe?). Legal requirements always lag technical best practices. Option 3) Generally mandate what compliance results in. Example: HIPAA. Results in lack of clarity and legal challenges. Of these options, I'll take (3) every time. If a startup isn't willing to make a best effort to comply (which is specifically worded into HIPAA and substantially reduces penalties), then I'd rather they not be able to touch my health data anyway...

petre 9y ago

Vague laws = arbitrary justice. They will aid the EU's squeezing money out of US corporations under the pretense that they're protecting the consumer.

loup-vaillant 9y ago

> And the EU acts as judge, jury and executioner. Now, now, you make it sound like a single human actually endorses those three roles. Any state (or group of states) is judge, jury, and executioner. I also write and dictates laws… And that's okay.

TheAceOfHearts 9y ago

The real world is very complicated. As time goes on, there will be lots of court cases which set a precedent. Even though I dislike em, I think the laws surrounding fair use and copyright are another example. Due to its nature, it's incredibly difficult to provide exhaustive guidelines. As long as these large enterprises engage in a good faith attempt at complying with the law they shouldn't end up receiving huge fines.