3 ms·

Threads like this make me like GDPR more and more. Arrogant Americans coming in 'It doesn't have jurisdiction over American companies'. Wholly misinformed.

by BLanen 8y ago

tripletao 8y ago
How do you expect the EU to enforce the GDPR extraterritorially? Like, do you expect the USA to comply with an EU request to impose a fine? Or do you think they'll be successful in pushing enforcement out through the target's customers and vendors, similar to US extraterritorial application of its financial laws on banks? My personal guess is that everyone with shady business models will move offshore, and the EU will play a marginal game of whack-a-mole trying to coerce them through their vendors and customers, especially payment processors, similar to American enforcement of online gambling laws. I expect the GDPR to be effective on large companies that want to portray themselves as respectable, and ineffective on everyone else.
- BLanen 8y ago
  EU can sue American companies without getting US government approval/ involvement as long as they have operations here. >Or do you think they'll be successful in pushing enforcement out through the target's customers and vendors, similar to US extraterritorial application of its financial laws on banks? At least somewhat of a deterrence. As if American KYC & AML laws are completely ineffective. >My personal guess is that everyone with shady business models will move offshore, and the EU will play a marginal game of whack-a-mole trying to coerce them through their vendors and customers, especially payment processors, similar to American enforcement of online gambling laws. I expect the GDPR to be effective on large companies that want to portray themselves as respectable, and ineffective on everyone else. Implying the big companies aren't the ones with the 'shady business models'? My view is that this is specifically made for the big companies.
  - tripletao 8y ago
    By "shady business model", I mean something like "business model dependent on breaking the GDPR". Facebook seems almost surely still profitable while complying, just not quite so spectacularly so. Many e.g. data brokers probably aren't. Their choice then becomes to disappear or go offshore. I think many will choose the latter. American extraterritorial enforcement of its financial laws is the most successful example of such enforcement that I know, and it's still easy to fund an online poker account. I'd agree that the GDPR is designed for large companies, and will genuinely improve their behavior. I think its effects will be similar e.g. to American cities with very strong and complex tenant protections--we create a class of large, politically-connected operators with the resources to comply, and a class of shady operators one step ahead of the law. There's little in between--if you lack the resources to be absolutely certain you comply, and the punishments for large and small noncompliance are both catastrophic, then you might as well go all the way. (Yes, I expect the regulators to mostly exercise reasonable discretion. No, I don't want the discretion of a mid-level bureaucrat to be the only thing between me and financial ruin.) That part doesn't seem positive to me. Aside: I wonder how many people promoting heavy-handed enforcement of data protection laws without regard for the second-order consequences have argued against heavy-handed enforcement of drug laws without regard for the second-order consequences...
ars 8y ago
You will like it until the day those "Arrogant Americans" have effectively banned you from most of the internet, with the exception of the largest sites, and those based in Europe. If you want the GDPR to have jurisdiction over American companies, American companies will simply refuse to do business with you.
- lompad 8y ago
  Even if this was the case - if companies treating their customers' data like shit vanish from the European market, I'd be really happy. Not a big loss at all. :) Additionally, leaving the European market opens up a big opportunity for EU-companies. Basically, that's the way to go if you want to wreck American dominance over the Internet (and the companies which matter know that very well, which is exactly why they are NOT dropping the EU). For European citizens it's a win either way. That's why nobody is impressed by your threats - they just look like people pissed off because the EU is now doing what the USA had been doing for decades - meddling in other countries sovereignity. (If you want to interpret it that way, which imho is wrong.)

Threads like this make me like GDPR more and more. Arrogant Americans coming in 'It doesn't have jurisdiction over American companies'. Wholly misinformed.

by BLanen 8y ago

Threads like this make me like GDPR more and more. Arrogant Americans coming in 'It doesn't have jurisdiction over American companies'. Wholly misinformed.

tripletao 8y ago

How do you expect the EU to enforce the GDPR extraterritorially? Like, do you expect the USA to comply with an EU request to impose a fine? Or do you think they'll be successful in pushing enforcement out through the target's customers and vendors, similar to US extraterritorial application of its financial laws on banks? My personal guess is that everyone with shady business models will move offshore, and the EU will play a marginal game of whack-a-mole trying to coerce them through their vendors and customers, especially payment processors, similar to American enforcement of online gambling laws. I expect the GDPR to be effective on large companies that want to portray themselves as respectable, and ineffective on everyone else.

BLanen 8y ago
EU can sue American companies without getting US government approval/ involvement as long as they have operations here. >Or do you think they'll be successful in pushing enforcement out through the target's customers and vendors, similar to US extraterritorial application of its financial laws on banks? At least somewhat of a deterrence. As if American KYC & AML laws are completely ineffective. >My personal guess is that everyone with shady business models will move offshore, and the EU will play a marginal game of whack-a-mole trying to coerce them through their vendors and customers, especially payment processors, similar to American enforcement of online gambling laws. I expect the GDPR to be effective on large companies that want to portray themselves as respectable, and ineffective on everyone else. Implying the big companies aren't the ones with the 'shady business models'? My view is that this is specifically made for the big companies.
- tripletao 8y ago
  By "shady business model", I mean something like "business model dependent on breaking the GDPR". Facebook seems almost surely still profitable while complying, just not quite so spectacularly so. Many e.g. data brokers probably aren't. Their choice then becomes to disappear or go offshore. I think many will choose the latter. American extraterritorial enforcement of its financial laws is the most successful example of such enforcement that I know, and it's still easy to fund an online poker account. I'd agree that the GDPR is designed for large companies, and will genuinely improve their behavior. I think its effects will be similar e.g. to American cities with very strong and complex tenant protections--we create a class of large, politically-connected operators with the resources to comply, and a class of shady operators one step ahead of the law. There's little in between--if you lack the resources to be absolutely certain you comply, and the punishments for large and small noncompliance are both catastrophic, then you might as well go all the way. (Yes, I expect the regulators to mostly exercise reasonable discretion. No, I don't want the discretion of a mid-level bureaucrat to be the only thing between me and financial ruin.) That part doesn't seem positive to me. Aside: I wonder how many people promoting heavy-handed enforcement of data protection laws without regard for the second-order consequences have argued against heavy-handed enforcement of drug laws without regard for the second-order consequences...

ars 8y ago

You will like it until the day those "Arrogant Americans" have effectively banned you from most of the internet, with the exception of the largest sites, and those based in Europe. If you want the GDPR to have jurisdiction over American companies, American companies will simply refuse to do business with you.

lompad 8y ago
Even if this was the case - if companies treating their customers' data like shit vanish from the European market, I'd be really happy. Not a big loss at all. :) Additionally, leaving the European market opens up a big opportunity for EU-companies. Basically, that's the way to go if you want to wreck American dominance over the Internet (and the companies which matter know that very well, which is exactly why they are NOT dropping the EU). For European citizens it's a win either way. That's why nobody is impressed by your threats - they just look like people pissed off because the EU is now doing what the USA had been doing for decades - meddling in other countries sovereignity. (If you want to interpret it that way, which imho is wrong.)