7 ms·

The biggest 2 issues (at least for non-EU companies) are the extraterritorial reach, and the absurd maximum fines that can indeed be assessed for a first, singl

The biggest 2 issues (at least for non-EU companies) are the extraterritorial reach, and the absurd maximum fines that can indeed be assessed for a first, single violation. Whether or not that is the public's understanding of the law, that is how it is written, and when it comes to enforcement, the letter of the law is the only thing that matters. So we have a foreign government (to us) that has asserted authority to reach beyond its borders and into our pockets with an absurdly complex regulation, where a single violation would financially destroy the company. Since I don't have $20 million to give to them, and the families of my employees depend on their income for things like food and housing, I have to either carry expensive liability insurance to protect against that, or block EU traffic. For us, and I suspect most other sites on the planet, that's an easy decision to make. I'll take a 5%-10% hit in revenue from the loss of EU traffic and be able to sleep at night knowing that someone in a country I've never been to isn't out there filing documents that have the ability to destroy my and my employees' livelihoods. I won't go into the minutiae of why it's so easy to violate and why most of the experts we have spoken to agree that being compliant is an uncertain endeavor at best, even if you want to comply, because that would be a very long winded comment. But if you do a Google search, you'll see the gist of the problems.

lucb1e 8y ago
Thanks for responding! I was hoping someone would finally bring up concrete points after talking to a lawyer, and you have. It still doesn't sound like a big deal to me (you don't mention anything in-depth, only that the law can now actually harm you both in terms of jurisdiction and non-trivial fines), but I see where you're coming from.
- YeGoblynQueenne 8y ago
  >> Thanks for responding! I was hoping someone would finally bring up concrete points after talking to a lawyer, and you have. Can you please quote the "concrete points" made in the parent post?
  - lucb1e 8y ago
    Sure, it's in the first line: > the extraterritorial reach, and the absurd maximum fines that can indeed be assessed for a first, single violation As I said in my comment, I don't think those are big issues if you comply with the law (and 99% of the law is common sense or was already in place in most countries), but they are points that a lawyer might indeed have brought up.
amyjess 8y ago
If you don't have offices in the EU, and you don't keep your money in any accounts controlled by EU banks, then why not just refuse to pay the fines? Might be a good opportunity to make some contacts in the Trump administration too, who will be interested in asserting US sovereignty.
- downandout 8y ago
  According to the people we have spoken to, it's reasonably possible that judgments for GDPR fines can be domesticated in the US. Once domesticated, they carry the same force and effect as a judgment issued by a US court. The legal processes for this generally already exist, although there are no GDPR-specific treaties, and it isn't guaranteed that this would occur for GDPR fines - it would be up to the US court system. Like many other aspects of GDPR, it is uncertain at this time. However, I don't want to be the first test case.
- deecewan 8y ago
  And then also say goodbye to any chance of European expansion, ever. That's a big risk, given the size of Europe and the fact that it the US is your current target demographic, it's not a far stretch to think Europe might be, too.
  - jlarocco 8y ago
    > And then also say goodbye to any chance of European expansion, ever. Blocking the EU effectively means the same thing, though, because it's announcing to everybody that you're ignoring that market and leaving the door open for companies who can copy your business model but are willing to respect user's privacy. Not to mention the reputation damage from snubbing their privacy laws. The door's still technically open, but it's going to be much more difficult. I also wonder if this kind of announcement will backfire a bit for these companies. When I see a "We're dropping the EU over GDPR," article, I don't think about how bad the GDPR must be, but instead I wonder what shady activities these companies are doing that makes them unable to comply, and that makes me avoid them. The general public are pretty clueless on these things (look at the surprise around Facebook lately), but I do feel it'll cost them some users.
throwaway-hn123 8y ago
Really it's fine. You won't be missed, and if your service is indeed valuable, an EU company will spring up to take your place. Bye!
oldcynic 8y ago
> a single violation would financially destroy the company If you refer to the flowchart on how enforcement is to be handled (notably including referring to "proportionate"), the FAQs on regulator sites, and even the track record of penalties under DPA you'll find this is not the case. Why there are some who keep wanting to catastrophise this is beyond me.
- downandout 8y ago
  I’ve said this repeatedly throughout this thread, and hopefully this will be the last time I have to. So I’ll try to be extremely clear here. There is nothing written in the GDPR limiting the ability of regulators to issue maximum fines for any violation - even the first, minor violation. Not a single sentence. The limits are $10 million for less serious violations and $20 million for more serious ones. If I’m wrong, show me the clause. It simply doesn’t exist. If there were meant to be safeguards, those would have been written into it. They are not. The section you are referring to that uses the word “proportionate” gives a brief list of suggestions of the kinds of things that regulators should consider when issuing fines. But it no way limits their legal ability to issue maximum or multimillion dollar fines for minor violations, and doesn’t even define “proportionate”. A hardline country like Germany may easily decide that because they so value their privacy, “proportionate” is a maximum fine for a single violation.
  - germanier 8y ago
    No, Germany could not issue such a fine for a minor single violation. "Proportionate" is a so-called indeterminate legal term that is open to full judicial review with no interpretative power left to the administration. Our law is littered with clauses stating "fines up to 50 Mio. €" and courts have developed a system of how to make sure everyone gets treated fairly. Other European countries have the same. This is simply a difference in legal traditions between Europe and the US. We don't simply cling onto the exact text of a law and call it a day. Interpretation of laws goes far beyond that. It may be scary to someone not used to such clauses but I can assure you companies around here do business just fine even though they have to comply with a long list of such laws threatening fines this high. Anyway, "proportionate" isn't as ill-defined as you claim. It's a term of art used in many laws and we (and the courts) know pretty well what the legislator meant with it. Heck, they even list some criteria. If those aren't fulfilled a maximum fine isn't possible. Also, "proportionate" implies that a more severe violation must have a higher fine meaning the maximum can hardly ever be reached. A law isn't code and shouldn't be read as such.

lucb1e 8y ago

Thanks for responding! I was hoping someone would finally bring up concrete points after talking to a lawyer, and you have. It still doesn't sound like a big deal to me (you don't mention anything in-depth, only that the law can now actually harm you both in terms of jurisdiction and non-trivial fines), but I see where you're coming from.

YeGoblynQueenne 8y ago
>> Thanks for responding! I was hoping someone would finally bring up concrete points after talking to a lawyer, and you have. Can you please quote the "concrete points" made in the parent post?
- lucb1e 8y ago
  Sure, it's in the first line: > the extraterritorial reach, and the absurd maximum fines that can indeed be assessed for a first, single violation As I said in my comment, I don't think those are big issues if you comply with the law (and 99% of the law is common sense or was already in place in most countries), but they are points that a lawyer might indeed have brought up.

amyjess 8y ago

If you don't have offices in the EU, and you don't keep your money in any accounts controlled by EU banks, then why not just refuse to pay the fines? Might be a good opportunity to make some contacts in the Trump administration too, who will be interested in asserting US sovereignty.

downandout 8y ago
According to the people we have spoken to, it's reasonably possible that judgments for GDPR fines can be domesticated in the US. Once domesticated, they carry the same force and effect as a judgment issued by a US court. The legal processes for this generally already exist, although there are no GDPR-specific treaties, and it isn't guaranteed that this would occur for GDPR fines - it would be up to the US court system. Like many other aspects of GDPR, it is uncertain at this time. However, I don't want to be the first test case.
deecewan 8y ago
And then also say goodbye to any chance of European expansion, ever. That's a big risk, given the size of Europe and the fact that it the US is your current target demographic, it's not a far stretch to think Europe might be, too.
- jlarocco 8y ago
  > And then also say goodbye to any chance of European expansion, ever. Blocking the EU effectively means the same thing, though, because it's announcing to everybody that you're ignoring that market and leaving the door open for companies who can copy your business model but are willing to respect user's privacy. Not to mention the reputation damage from snubbing their privacy laws. The door's still technically open, but it's going to be much more difficult. I also wonder if this kind of announcement will backfire a bit for these companies. When I see a "We're dropping the EU over GDPR," article, I don't think about how bad the GDPR must be, but instead I wonder what shady activities these companies are doing that makes them unable to comply, and that makes me avoid them. The general public are pretty clueless on these things (look at the surprise around Facebook lately), but I do feel it'll cost them some users.

throwaway-hn123 8y ago

Really it's fine. You won't be missed, and if your service is indeed valuable, an EU company will spring up to take your place. Bye!

oldcynic 8y ago

> a single violation would financially destroy the company If you refer to the flowchart on how enforcement is to be handled (notably including referring to "proportionate"), the FAQs on regulator sites, and even the track record of penalties under DPA you'll find this is not the case. Why there are some who keep wanting to catastrophise this is beyond me.

downandout 8y ago
I’ve said this repeatedly throughout this thread, and hopefully this will be the last time I have to. So I’ll try to be extremely clear here. There is nothing written in the GDPR limiting the ability of regulators to issue maximum fines for any violation - even the first, minor violation. Not a single sentence. The limits are $10 million for less serious violations and $20 million for more serious ones. If I’m wrong, show me the clause. It simply doesn’t exist. If there were meant to be safeguards, those would have been written into it. They are not. The section you are referring to that uses the word “proportionate” gives a brief list of suggestions of the kinds of things that regulators should consider when issuing fines. But it no way limits their legal ability to issue maximum or multimillion dollar fines for minor violations, and doesn’t even define “proportionate”. A hardline country like Germany may easily decide that because they so value their privacy, “proportionate” is a maximum fine for a single violation.
- germanier 8y ago
  No, Germany could not issue such a fine for a minor single violation. "Proportionate" is a so-called indeterminate legal term that is open to full judicial review with no interpretative power left to the administration. Our law is littered with clauses stating "fines up to 50 Mio. €" and courts have developed a system of how to make sure everyone gets treated fairly. Other European countries have the same. This is simply a difference in legal traditions between Europe and the US. We don't simply cling onto the exact text of a law and call it a day. Interpretation of laws goes far beyond that. It may be scary to someone not used to such clauses but I can assure you companies around here do business just fine even though they have to comply with a long list of such laws threatening fines this high. Anyway, "proportionate" isn't as ill-defined as you claim. It's a term of art used in many laws and we (and the courts) know pretty well what the legislator meant with it. Heck, they even list some criteria. If those aren't fulfilled a maximum fine isn't possible. Also, "proportionate" implies that a more severe violation must have a higher fine meaning the maximum can hardly ever be reached. A law isn't code and shouldn't be read as such.