8 ms·

Suppose you were a small startup based in America, accepting online payments from users/advertisers using American platforms or financial institutions. Suppose

• woolvalley 9y ago
  Arrest when you have a layover in the EU for some reason, on purpose or because of an emergency. And a default judgement.
  • jacquesm 9y ago
    Not a chance. The only country that has a history of such actions is the United States.
    • woolvalley 9y ago
      So if I ignore a law in Canada or the EU (extradition request, default judgement, etc) as an officer of a corporation, I wouldn't get arrested when I show up on the border? Really?
      • jacquesm 9y ago
        For ignoring the GDPR as a small business owner operating on the internet the chances of individual consequences are nil. High profile cases would have a much higher risk and companies that went out of their way to advertise the fact that they are going to break the law would run a significant risk. Show me just one example of a company located outside the EU without a legal presence inside the EU that had an executive detained upon entry for breaking an EU law that does not normally result in criminal prosecution.
        • woolvalley 9y ago
          Does the EU have any other extra-territoral law as far reaching as the GDPR? Or any other extra-territoral law? A business shipping something to the EU doesn't count. The only other extra-territorial laws I know of currently is FATCA and the FCPA, which are from the USA.
          • jacquesm 9y ago
            The GDPR is not an extra-territorial law. It merely concerns itself with EU citizens.
            • prewett 9y ago
              If the law applies outside the EU (for instance, if EU citizens travel to a non-EU country), then it is an extra-territorial law. As far as I understand the discussion here (which may or may not correspond with the actual law), the GDPR goes with the person. Wherever an EU citize goes, that EU citizen must be able to be forgotten, despite if the location they are in is outside EU jurisdiction. That is practically the definition of extra-territorial. Now, would an EU court rule that someone who kept permanent records of an EU citizen be violating the GDPR if the business has no EU presence? In the American system (imagining if the US passed a GDPR and prosecuted a non-US citizen), no, because the government would not have standing to sue: the violation took place outside of US sovereignty. If the EU takes a similar approach, then the law is not extra-territorial in enforcement, otherwise it is.
              • jacquesm 9y ago
                EU citizens outside of the EU are out of scope for the GDPR.
                • com 9y ago
                  Could you point at the language that unambiguously says that? Edit: GDPR Recital 23, Article 3(2)(a). Excellent!
• wglb 9y ago
  So having been through the preliminaries of GDPR, I took away a few things. First of all, the enforcement path is as yet unclear. If they (europe) see you are doing something (like not responding to "right to be forgotten" request) it is not clear what enforcement they will attempt. Second, there is the customer perception. If you have one European customer that buys something from you, or enters their email for you to give them some product information, and they request later to be forgotten and you don't, there is then a chance of public perception that you don't comply. But there can be other avenues of exposure. For example, if you are dealing with a US bank that does comply with GDPR and you don't, there may be some pushback from the bank. So while EU may not come for you directly, there could be a secondary effect. From a little conversation with European partners, I got the sense that US was taking GDPR more seriously than some EU companies.
  • damontal 9y ago
    >and they request later to be forgotten and you don't How do you prove you have forgotten someone?
    • madez 9y ago
      You attest so legally binding. The legal system does not function on mathematical proofs. If it turns out you did not speak the truth, you can be fined, and maybe even jailed. That's how it works. Also, we are not talking about forgetting someone personally, but deleting their data. I assume that's clear.
      • freeone3000 9y ago
        So if you're willing to indefinitely lie, you just get out? This seems inefficient.
        • chopin 9y ago
          You better have not a breach in this case...
        • 9y ago
• estel 9y ago
  If your company is not targeting the EU as a market you are out of scope of GDPR. If you explicitly accept Sterling/Euros, provide localisations for EU countries, talk explicitly about your EU shipping options etc. then you would probably be seen as accommodating the EU market and might find yourself in scope.
  • deleted 9y ago
    [deleted]
  • tlrobinson 9y ago
    So basically this legislation will make it less likely websites will accept European currency and localize to European languages?
  • wglb 9y ago
    Consider the case of an EU citizen traveling in the US transaction in USD. This person is covered. Even if they are in the US.
    • politician 9y ago
      Technically true, but what does the enforcement action actually look like against the small town ice cream shop that doesn't know or care about the rights under the GDPR of a tourist from Spain?
      • icebraining 9y ago
        I don't think it's even technically true. The GDPR applies to EU businesses or businesses dealing with people in the EU, not all EU citizens.
    • jakeogh 9y ago
      Wrong. You don't get to make up new laws for the country you are visiting.
    • wuliwong 9y ago
      This is exactly what I was coming to HN to query about. Without some agreement with the US federal government, I don't believe they would have any mechanism of enforcement that would affect your business in the U.S. I imagine they could do something like block your site from EU ip addresses but nothing like coming after you or your company for damages.
• Sevii 9y ago
  Explicitly banning Eurozone citizens from using the service is the easiest solution I have thought of.
  • jacquesm 9y ago
    The collective economic effect of that will be massive. Please do. And realize that you are ceding the single largest market to your competition.
    • learc83 9y ago
      > single largest market The EU really isn't a single large market though for most practical purposes. For the purposes of complying with regulations and accepting payment it is, but for every other practical consideration that matters to a company doing business there, it's a few dozen separate markets.
      • notfromhere 9y ago
        and they're still in the eurozone, so banning eurozone users is still removing yourself from the largest economic bloc in the world
        • learc83 9y ago
          Are you arguing with my point or just trying to be contradictory? I never said blocking the EU was a good solution, but calling it a single market makes it sound more enticing than it is.
    • Silhouette 9y ago
      The collective economic effect of that will be massive. Please do. And realize that you are ceding the single largest market to your competition. That doesn't necessarily follow. For example, EU but non-UK customers represent only a small fraction of the user base for one of my businesses. With hindsight, we would have done better to exclude those customers entirely, avoid spending time and money complying with ever-more-onerous EU rules, and invest that time and money in growing our business in more lucrative markets instead. It is entirely possible for the EU to make itself so unattractive as a market that this will be the case for others too. Indeed several of the near-future measures it is already working on may have exactly that effect. The saddest part is that those running the EU have so little idea about how small business works that they don't even realise they're doing it.
• debt 9y ago
  If you have a customer from the EU, you must comply with GPDR. Full stop. Also, if any component of your cloud ecosystem(AWS, GCS, etc.) are based in the EU, you must comply with GPDR. Which in today's world means almost everyone is affected by this. Make sure those "American" platforms you speak have every single component of their infrastructure based physically in America. The whole thing may be difficult to enforce, but meh why risk it?
  • tlrobinson 9y ago
    So what's the definition of "customer from the EU"?
    • jacquesm 9y ago
      In the typical web/e-commerce context someone whose IP address geolocates to an EU based end point or someone who lists their delivery address as inside the union.
      • TomMarius 9y ago
        The problem is that the law applies to them even if they use a proxy. If they report/sue you afterwards, you might be looking at a huge amount of trouble.
        • jacquesm 9y ago
          Yes, but like with all this stuff: Your intent to comply with the law carries a lot more weight than actual compliance in edge cases.
          • prewett 9y ago
            That's not very comforting when your goal is avoid having unforeseen problems like being arrested on your European vacation due to violating a law that doesn't apply to your country but you still violated because it applies to all EU citizens regardless of their geographical location.
• jacquesm 9y ago
  What you do or do not do should not be grounded in the consequences that you will face but in what's the best for your users. If you feel that your users rights are of no concern to you then you are of course entirely able to ignore this law and to pretend it does not exist because in practice there will most likely not be any consequences whatsoever. You do not have a place of business in the EU, you do not transact any business there to begin with so you are free to ignore the law. And this is doubly true because you are 'small fry', nobody will notice. Except for your customers maybe. And then that time that you got hacked and you lost all the data you collected over the years because you forgot to implement life cycle management. And this will then marginally affect the ability of other companies like yours to be able to do business. And little by little the people that chose to ignore the law will start to become a large enough problem that something will be done about it (I hope). Which might mean harmonizing EU law and US law, or it might mean that you can be fined just as if you were in the EU for those breaches were you are clearly deficient. In the end I don't think that you will enjoy the results much. But since you are small fry you probably will get away with it. But collectively, you and your buddies will harm American enterprise more than you probably realize.
  • debt 9y ago
    "You do not have a place of business in the EU, you do not transact any business there to begin with so you are free to ignore the law. " Wrong. If you have a customer from the EU or any component of your infrastructure in the EU, you must comply with GPDR.
    • jacquesm 9y ago
      I'm not saying he's not in scope and should not comply I'm saying he can get away with ignoring it in practice, which was what he was asking about.
      • debt 9y ago
        He'd be exposed to increased risk by not complying(lawsuits, criminal action, etc.). It's based on his risk tolerance, the problem is it's hard to quantify at this point.
• dalbasal 9y ago
  It's hard to say at this point, or even after. It's on a nexus of vague things. First "internet laws" have a history of leading to nothing much, like the EU "cookie law" which everyone "complies" with by popping up a nag. Second because online jurisdictions and how these get enforced is ambiguous. Third, because the enforcement path is still pretty unclear. It may be all about a handful of high priority cases, with small sites getting a pass. Ultimately, there are all sorts of laws all over the world. With an online, potentially global business, you're breaking some of them. Turkey does not really expect some international user generated content site to comply with their political content laws. A bigger site based in Istanbul... You'll get a knock on the door. About ten years ago, I had a client with an e-commerce site, for workplace safety gear in Australia. They sold to the US, but rarely. During bird flue, they somehow got on the radar of some US advertising standard. There were some politicians actively policing it anyway they could (not courts). Tldr is that they had their payment gateway and PayPal shut them down immediately (someone got scary phone calls). Even shutting off all US shipping, and adding a big red "No US" sign didn't help. They had to drop the products. So.. jurisdiction is often erratic. I think the last (possibly most important) point is cultural. If it takes, GDPR may impact consumer expectations and you may need to do it for that reason. If you want to avoid GDPR, just hold back for 3-6 months until after the date. It'll get clearer as it progresses and if you're as outside the purview as you suggest, you're probably going to be fine ignoring it at the start (or forever).
• PeterisP 9y ago
  The realistic consequences would probably be the following: 1) When you grow sufficiently large to go global, it will suddenly start to matter a lot, as EU is one of the largest markets worldwide. In the best case scenario you'd have to change your processes and systems to comply (i.e. you'd have technical debt which you could've avoided if you did it properly in the first place); in the worst case you'd have some complaints from EU users resulting in fines that aren't enforced yet but would be as soon as you'd want to actually get money from EU. This would be a meaningful impact to your valuation at that point. 2) As the risks implied in the first part have an impact on your valuation if you succeed and go global (which is the only scenario that matters to investors, the exit valuation about which they're thinking), you'd expect this compliance to be included in the due diligence done by series B/C investors and any acquisitions; if you've made no effort to comply, this will result in a lower valuation in those rounds of funding. If you're a high-growth startup whose valuation is not based on current revenue but on the (long) future market size and you declare that you're choosing to be incompatible with, say, 25% of the global market (to a very rough approximation, EU revenue share is something like that for many major tech companies), then investors will discount your future value (and thus current value) by 25%. So at the very least this is something that you should have on your roadmap for investors i.e. "we're planning to do that diligence and related work in quarter X after we've done A, B and C" instead of simply ignoring the issue.
• _o_ 9y ago
  No one is forcing you to follow it, but I suspect this is just the begining, GDPR is comming from EU due to history reasons, Europe has a lot of bad memories about keeping lists and tracking users. From Nazis to Stasi, USSR and so on and on. What is today done by google, fb, twitter is a light years ahead of that. Try to understand that GDPR is not something bad, it is rasing credibility for your bussiness and is doing something right. I bet a lot of, lets say, USA cityzens will value text "we are GDPR compliant for whole world" on web site. It is oportunity that Backblaze grabbed and soon sites that don't follow it will be on fishy side of the internet. And I also believe, a lot of non EU contries will adapt similar laws, the attack on privacy has gone too far, don't blame EU, blame ggl and fb.
  • peoplewindow 9y ago
    It's not related to the Nazis. Please. If it were really related to memory of abusive governments they wouldn't have just written a law with phenomenal penalties and ultra-vague language that everyone can be argued to violate - exactly the sort of law that all totalitarian states love to have. GDPR exists because the EU wants to be the primary legislating entity in Europe, replacing local governments, and because it likes the idea of funding itself through huge fines. It exists to serve political ends.
• SeanOC 9y ago
  If you're consumer focused, you're probably fine and will just need to clean up some mess later when you get big enough to care. If you're B2B, it's going to be a problem from day one. GDPR has a defacto viral component for service providers. Basically, any the business that wants to become your customer that is itself GDPR compliant needs to ensure that you too are GDPR compliant. Accordingly, GDPR will come up with a large portion of web-facing B2B sales, even for US companies.