7 ms·

I mostly agree with you, but the penalties for non-compliance are so staggeringly large, the requirements are so vague, and the EU's love of fining American tec

I mostly agree with you, but the penalties for non-compliance are so staggeringly large, the requirements are so vague, and the EU's love of fining American tech companies is so great that Id' be awfully nervous about GDPR if I were a large American tech company.

paulie_a 9y ago
< Id' be awfully nervous about GDPR if I were a large American tech company. They should be and that is a great thing.
- pjschlic 9y ago
  Yours is not a unique sentiment, but I find it so disheartening. Vague laws enforced selectively are bad for the rule of law. Is the schadenfreude from sticking it to whatever American company is selected worth that?
  - jacquesm 9y ago
    No, it's just that American companies as a rule tend to have a dim view of privacy and some pushback against that is welcome. As for enforcement, if you're a European company you have much more to be worried about since it is going to be much easier to go after you. Selective enforcement is hopefully going to be limited to going after a couple of very prominent offenders after which the remainder will fall in line.
  - Barrin92 9y ago
    >Is the schadenfreude from sticking it to whatever American company is selected worth that? No, but a correction is long overdue to signal to international companies that the primacy of politics still exists. How companies conduct themselves is determined by European law and European citizens, not businesses. Companies have only themselves to blame for having brought it on. Whether it's skirting taxes, mistreating user-data or assisting in election-meddling, if companies are not willing to self-regulate they will be regulated. That's an overdue message to send.
    - pm90 9y ago
      It is not the business of companies to self-regulate. Unless there is some kind of certification involved. Eg the gaming industry self regulates by having different ratings for games depending on their content. Such a thing is likely not possible everywhere, and especially for something as general as data, and thus legislative rememedies are required
    - brisance 9y ago
      That is a pretty naïve view of affairs. Practically all the banks even the European ones like HSBC, RBS etc have been complicit in committing all sorts of crime and continue to do so with impunity.
      - Drakim 9y ago
        That's too close to what-about-ism for my tastes. I want those banks to be held responsible too, but I'll take just one or the other if I can't get both right now.
philwelch 9y ago
That'll hurt Google's competitors, and hence help Google, more than it hurts Google.
- namelost 9y ago
  Or Google and Facebook will be held to a higher standard of compliance.
  - deleted 9y ago
    [deleted]
  - ucaetano 9y ago
    Which goes back to the point of loving to target American companies.
    - amorroxic 9y ago
      European here and I feel this is a bit shortsighted. Not really sure the sentiment is to target US companies (if for nothing else ours are quite open/interconnected economies and there's lots of fondness for US services - check both market share as well as revenues) but really.. Facebook's tax of 5k/year in the UK, the double irish with a dutch sandwich, the backroom deals from the 80s with the Irish govt.. these are global practices which truly devastate everyone in the long run. I actually trust bureaucrats to step in and audit - and subjectively think they very often do a decent job of explaining rationales given europeans' known tendency of bickering on pretty much everything.
      - ucaetano 9y ago
        > European here Same. > Facebook's tax of 5k/year in the UK, the double irish with a dutch sandwich, the backroom deals from the 80s with the Irish govt.. these are global practices which truly devastate everyone in the long run. And are all legal, and designed as so by the government. Auditing won't make a difference, since it is legal. Don't like it? Make it illegal. Simple as that. > actually trust bureaucrats to step in and audit - and subjectively think they very often do a decent job of explaining rationales given europeans' known tendency of bickering on pretty much everything. Oh, no issue with that. My issue is with this: > Or Google and Facebook will be held to a higher standard of compliance.
tekkk 9y ago
Now that is just being prejudiced. It's not EU's agenda to try and bring down American tech companies for the sake of malice (or protectionism). You do not think they have not been at some fault? Or that there is something good about GDPR too? While it's easy to start mulling over why and how things are or could have done differently I'd argue that there is no animosity towards American companies per se. The data of its citizens however is a very sensitive issue for EU and in the light of Snowden leaks maybe they are rightfully fearful of US having too much technological hold over them. There is silly people over both sides of the ocean but let's not start willfully feeding rash preconceptions for no reason.
- joejerryronnie 9y ago
  You're right, it's not the EU's agenda to try and bring down American tech companies - it is strictly Margrethe Vestager's political ambition to ride the hardline, protectionist stance against American tech straight to the EU President's office. Thankfully, she's burned so many political bridges that her own country is railroading her plans.
- ucarion 9y ago
  The claim that EU may have a populist-fueled agenda against American tech companies is not entirely without basis. It's not lawless anti-Americanism, but the tone has certainly changed. Consider what the Economist has to say about Margrethe Vestager, who runs Europe's trustbusting agency. https://www.economist.com/news/business/21728979-she-rich-worlds-most-powerful-trustbuster-margrethe-vestager-championing-consumers-or https://www.economist.com/news/business/21728979-she-rich-wo...
  - allenz 9y ago
    The Economist criticizes Vestager for fining Google and Apple. It concedes that both were anticompetitive, but complains that there is no proof "that consumers were denied a superior service as a consequence". But that's an impossibly high bar: no one can guarantee that competition will emerge; regulation can only provide a level playing field. So I don't think that this is a good article to prove your point.
TheForumTroll 9y ago
They don't target American companies. American companies makes themselves targets. If anything it is the US that tries to hurt European companies (actually any business that isn't American). If US law can't control a business like Facebook, somebody has to. One can only hope it rubs off on American citizens too so they get a bit more privacy (let's forget NSA for a second).
- icelancer 9y ago
  >> They don't target American companies. American companies makes themselves targets. Sometimes the only reason they make themselves a target is because they make money, and American companies are the largest players in the space, not EU ones.
Angostura 9y ago
Which requirements do you think are ‘vague’?
- closeparen 9y ago
  Essentially the entire law rests on subjective judgements like “reasonable,” “legitimate,” and “appropriate.”
seanwilson 9y ago
> I mostly agree with you, but the penalties for non-compliance are so staggeringly large, the requirements are so vague It'll be interesting to see how the first few non-compliance cases go. I would like to think if a requirement was vague, a company had made a reasonable interpretation of it and the company was responsive in making changes to become compliant that no fines would be issued.
smueller1234 9y ago
One counter example would be Booking.com. It's a Dutch company through and through[0] and pays the vast majority of its taxes in the Netherlands. Yet at least one of the European competition (!) authorities has already tried to use GDPR as a means to try and prove wrongdoing before GDPR is even in effect. This is to say: you don't have to be an American company to end up in the crosshairs of overzealous and downright populist regulators. Source: used to work there, had to help respond to a rather ludicrous 40-page list of questions. [0] Headquarters in Amsterdam, culturally strongly influenced by the Dutch, the biggest concentration of staff and virtually all product development in Amsterdam, albeit owned by an American company.
- sbuk 9y ago
  > "before GDPR is even in effect." This is a common misconception - GDPR is already "in effect". It will be enforced from 25 May...
dmitriid 9y ago
I wonder if you know that as of this week the US government can request any data on any user ID an American company even if that user and their data are not on American soil? (Possibly thanks to GDPR) companies may object to that request if it costs local laws. But yeah. Go on pretending that the EU lives to target American companies. From a European's point of view, American companies are not find enough as they view privacy, data, sovereignty etc. as some abstract concepts that don't apply to them.
IAmEveryone 9y ago
i've previously researched this idea because it comes up rather frequently. This was in anti-trust, because privacy-related enforcement is actually left to the EU states and doesn't actually happen very often. But in anti-trust, there is no evidence of any bias against US companies. The distribution of (the sum of) fines among EU, American, and Asian companies actually tracks closely with their respective market shares in the EU. The only divergence I found was slightly fewer/lower fines being levied on US companies, and slightly higher numbers for Asian companies. I would attribute this divergence to the far more advanced oversight in the US vs. most Asian countries: the EU doesn't need to get involved if these companies are well-regulated in their home countries. It'd be interesting to do a similar analysis for the US. As a German, I've heard similar grumbling regarding the fines against Volkswagen and Deutsche Bank. Personally, I doubt that those fines are motived by nationalistic motives. They might just show different approaches to corporate wrongdoing, with Germany either being too chummy with its industry, or possibly putting too much trust in the force of negative publicity alone to change behaviour. Privacy will invariably generate more headline-worthy conflicts with US companies, simply because that's where all the large companies are located. But if you're in the US, I'll also point out a certain bias in what you'll see reported, considering EU fines against exclusively EU companies are unlikely to make the US news. Trust me when I say that privacy happens to be a major concern of many voters in the EU. There is robust and constant debate regarding, for example, data collection by governments and law enforcements. In Germany, there is major opposition against the increased use of video surveillance, the use of phone location data in law enforcement, and EU legislation requiring the retention of communication data. There is a low-hum undercurrent of anti-Americanism in some discussions of Facebook, Google et al, possibly more so in France than Germany or the UK. But Europeans are constantly exposed to US media and such familiarity breeds trust. If Facebook where Chinese, or Google were Russian, distrust and call for regulation would be far stronger than it is.

paulie_a 9y ago

< Id' be awfully nervous about GDPR if I were a large American tech company. They should be and that is a great thing.

pjschlic 9y ago
Yours is not a unique sentiment, but I find it so disheartening. Vague laws enforced selectively are bad for the rule of law. Is the schadenfreude from sticking it to whatever American company is selected worth that?
- jacquesm 9y ago
  No, it's just that American companies as a rule tend to have a dim view of privacy and some pushback against that is welcome. As for enforcement, if you're a European company you have much more to be worried about since it is going to be much easier to go after you. Selective enforcement is hopefully going to be limited to going after a couple of very prominent offenders after which the remainder will fall in line.
- Barrin92 9y ago
  >Is the schadenfreude from sticking it to whatever American company is selected worth that? No, but a correction is long overdue to signal to international companies that the primacy of politics still exists. How companies conduct themselves is determined by European law and European citizens, not businesses. Companies have only themselves to blame for having brought it on. Whether it's skirting taxes, mistreating user-data or assisting in election-meddling, if companies are not willing to self-regulate they will be regulated. That's an overdue message to send.
  - pm90 9y ago
    It is not the business of companies to self-regulate. Unless there is some kind of certification involved. Eg the gaming industry self regulates by having different ratings for games depending on their content. Such a thing is likely not possible everywhere, and especially for something as general as data, and thus legislative rememedies are required
  - brisance 9y ago
    That is a pretty naïve view of affairs. Practically all the banks even the European ones like HSBC, RBS etc have been complicit in committing all sorts of crime and continue to do so with impunity.
    - Drakim 9y ago
      That's too close to what-about-ism for my tastes. I want those banks to be held responsible too, but I'll take just one or the other if I can't get both right now.

philwelch 9y ago

That'll hurt Google's competitors, and hence help Google, more than it hurts Google.

namelost 9y ago
Or Google and Facebook will be held to a higher standard of compliance.
- deleted 9y ago
  [deleted]
- ucaetano 9y ago
  Which goes back to the point of loving to target American companies.
  - amorroxic 9y ago
    European here and I feel this is a bit shortsighted. Not really sure the sentiment is to target US companies (if for nothing else ours are quite open/interconnected economies and there's lots of fondness for US services - check both market share as well as revenues) but really.. Facebook's tax of 5k/year in the UK, the double irish with a dutch sandwich, the backroom deals from the 80s with the Irish govt.. these are global practices which truly devastate everyone in the long run. I actually trust bureaucrats to step in and audit - and subjectively think they very often do a decent job of explaining rationales given europeans' known tendency of bickering on pretty much everything.
    - ucaetano 9y ago
      > European here Same. > Facebook's tax of 5k/year in the UK, the double irish with a dutch sandwich, the backroom deals from the 80s with the Irish govt.. these are global practices which truly devastate everyone in the long run. And are all legal, and designed as so by the government. Auditing won't make a difference, since it is legal. Don't like it? Make it illegal. Simple as that. > actually trust bureaucrats to step in and audit - and subjectively think they very often do a decent job of explaining rationales given europeans' known tendency of bickering on pretty much everything. Oh, no issue with that. My issue is with this: > Or Google and Facebook will be held to a higher standard of compliance.

tekkk 9y ago

Now that is just being prejudiced. It's not EU's agenda to try and bring down American tech companies for the sake of malice (or protectionism). You do not think they have not been at some fault? Or that there is something good about GDPR too? While it's easy to start mulling over why and how things are or could have done differently I'd argue that there is no animosity towards American companies per se. The data of its citizens however is a very sensitive issue for EU and in the light of Snowden leaks maybe they are rightfully fearful of US having too much technological hold over them. There is silly people over both sides of the ocean but let's not start willfully feeding rash preconceptions for no reason.

joejerryronnie 9y ago
You're right, it's not the EU's agenda to try and bring down American tech companies - it is strictly Margrethe Vestager's political ambition to ride the hardline, protectionist stance against American tech straight to the EU President's office. Thankfully, she's burned so many political bridges that her own country is railroading her plans.
ucarion 9y ago
The claim that EU may have a populist-fueled agenda against American tech companies is not entirely without basis. It's not lawless anti-Americanism, but the tone has certainly changed. Consider what the Economist has to say about Margrethe Vestager, who runs Europe's trustbusting agency. https://www.economist.com/news/business/21728979-she-rich-worlds-most-powerful-trustbuster-margrethe-vestager-championing-consumers-or https://www.economist.com/news/business/21728979-she-rich-wo...
- allenz 9y ago
  The Economist criticizes Vestager for fining Google and Apple. It concedes that both were anticompetitive, but complains that there is no proof "that consumers were denied a superior service as a consequence". But that's an impossibly high bar: no one can guarantee that competition will emerge; regulation can only provide a level playing field. So I don't think that this is a good article to prove your point.

TheForumTroll 9y ago

They don't target American companies. American companies makes themselves targets. If anything it is the US that tries to hurt European companies (actually any business that isn't American). If US law can't control a business like Facebook, somebody has to. One can only hope it rubs off on American citizens too so they get a bit more privacy (let's forget NSA for a second).

icelancer 9y ago
>> They don't target American companies. American companies makes themselves targets. Sometimes the only reason they make themselves a target is because they make money, and American companies are the largest players in the space, not EU ones.

Angostura 9y ago

Which requirements do you think are ‘vague’?

closeparen 9y ago
Essentially the entire law rests on subjective judgements like “reasonable,” “legitimate,” and “appropriate.”

seanwilson 9y ago

> I mostly agree with you, but the penalties for non-compliance are so staggeringly large, the requirements are so vague It'll be interesting to see how the first few non-compliance cases go. I would like to think if a requirement was vague, a company had made a reasonable interpretation of it and the company was responsive in making changes to become compliant that no fines would be issued.

smueller1234 9y ago

One counter example would be Booking.com. It's a Dutch company through and through[0] and pays the vast majority of its taxes in the Netherlands. Yet at least one of the European competition (!) authorities has already tried to use GDPR as a means to try and prove wrongdoing before GDPR is even in effect. This is to say: you don't have to be an American company to end up in the crosshairs of overzealous and downright populist regulators. Source: used to work there, had to help respond to a rather ludicrous 40-page list of questions. [0] Headquarters in Amsterdam, culturally strongly influenced by the Dutch, the biggest concentration of staff and virtually all product development in Amsterdam, albeit owned by an American company.

sbuk 9y ago
> "before GDPR is even in effect." This is a common misconception - GDPR is already "in effect". It will be enforced from 25 May...

dmitriid 9y ago

I wonder if you know that as of this week the US government can request any data on any user ID an American company even if that user and their data are not on American soil? (Possibly thanks to GDPR) companies may object to that request if it costs local laws. But yeah. Go on pretending that the EU lives to target American companies. From a European's point of view, American companies are not find enough as they view privacy, data, sovereignty etc. as some abstract concepts that don't apply to them.

IAmEveryone 9y ago

i've previously researched this idea because it comes up rather frequently. This was in anti-trust, because privacy-related enforcement is actually left to the EU states and doesn't actually happen very often. But in anti-trust, there is no evidence of any bias against US companies. The distribution of (the sum of) fines among EU, American, and Asian companies actually tracks closely with their respective market shares in the EU. The only divergence I found was slightly fewer/lower fines being levied on US companies, and slightly higher numbers for Asian companies. I would attribute this divergence to the far more advanced oversight in the US vs. most Asian countries: the EU doesn't need to get involved if these companies are well-regulated in their home countries. It'd be interesting to do a similar analysis for the US. As a German, I've heard similar grumbling regarding the fines against Volkswagen and Deutsche Bank. Personally, I doubt that those fines are motived by nationalistic motives. They might just show different approaches to corporate wrongdoing, with Germany either being too chummy with its industry, or possibly putting too much trust in the force of negative publicity alone to change behaviour. Privacy will invariably generate more headline-worthy conflicts with US companies, simply because that's where all the large companies are located. But if you're in the US, I'll also point out a certain bias in what you'll see reported, considering EU fines against exclusively EU companies are unlikely to make the US news. Trust me when I say that privacy happens to be a major concern of many voters in the EU. There is robust and constant debate regarding, for example, data collection by governments and law enforcements. In Germany, there is major opposition against the increased use of video surveillance, the use of phone location data in law enforcement, and EU legislation requiring the retention of communication data. There is a low-hum undercurrent of anti-Americanism in some discussions of Facebook, Google et al, possibly more so in France than Germany or the UK. But Europeans are constantly exposed to US media and such familiarity breeds trust. If Facebook where Chinese, or Google were Russian, distrust and call for regulation would be far stronger than it is.