3 ms·

How do you expect that the ECJ or individual EU countries would enforce their ruling against our hypothetical American company without the use of the American c

How do you expect that the ECJ or individual EU countries would enforce their ruling against our hypothetical American company without the use of the American courts? I presume that if they're blocking the EU, then they have no revenue or assets there. And how do you reconcile this with Facebook's public statement that they won't comply for those not covered? They obviously make money doing stuff that the GDPR prohibits; but they're target #1 and they even have EU presence, much more exposed than our hypothetical.

troydavis 8y ago
Disclaimer: This is not legal advice. Yes, the lack of assets and revenue would make it difficult to collect. Exposure could include a staff member wanting to visit an EU country, the company trying to hire an EU-based remote contractor, or trying to get credit in the US. That said, the reasoning is simpler: even if there's literally zero interaction with or exposure to the EU, by the time a complaint gets to litigation, the company's approach to GDPR has already failed. erely being party to a case in any court (let alone losing one) isn't a trivial matter -- it means at least consulting an attorney and thinking through the implications (like perhaps not being able to obtain an EU visa). A GDPR strategy which gets to that point, and relies on the inability to collect a judgment, has failed. Facebook - really, FANG and a handful of other name-brand, global, consumer-facing companies - differ from most businesses in 2 ways: 1. They expect litigation, complaints, and article 17 erasure requests. There's no way to avoid it, just plan around it and minimize the impact. Their goal isn't no impact, it's no catastrophic impact. 2. They have teams of attorneys analyzing the risk and benefit of every decision. If they've decided (not) to do something, it's because they've accepted that the risks are worth the benefits, not necessarily because they think it's risk-free. Even most mid-market businesses don't have that luxury. Note also that my original comment said that experts debate whether user-submitted location is sufficient. I explicitly didn't and don't claim that there's any certainty. There's no case law at all right now, so anyone who claims certainty about edge cases is making stuff up. What is close to certain is that IP-based geocoding (ie, what this vendor provides) doesn't eliminate anywhere near all visitors from the EU, and thus doesn't eliminate the need to consider GDPR. Perhaps they decide to also add a user-submitted location dropdown to their signup form and accept the risks I just described, or decide to do nothing else and accept the risk of litigation from EU visitors who the geocoding doesn't identify. My core point is that the geocoding service pitches "Just block EU IPs and you're done," and that's not the case at all. I think we're past the point where HN comments are adding value, so this will be my last comment in this thread.
- tripletao 8y ago
  I don't mean to endorse any strategy of blocking the EU, and I certainly don't mean to endorse the advertised service. I do think you overestimate the importance of the EU to many Americans' views and lives. The Americans that you interact with--here or otherwise--are a disproportionately cosmopolitan sample, simply by the fact that they're talking to you. A lot of people in this country have no desire to do business in the EU. They have no desire to visit. Any regulatory action against them would reconfirm all their worst thoughts about "foreigners", and otherwise not change their lives. If they read what you wrote above, then they'd take away nothing, beyond maybe that your legal system is so terrible that no one knows what the laws are. And really, does this kind of extraterritoriality feel like a good idea to you? Roughly two hundred countries exist. Can you imagine a world where each of them tried to enforce rules of similar complexity to the GDPR against every human alive (because remember, I might be a lying North Korean)? Would you comply with every country's rules? Or would you decide what set of countries mattered to you, and write the rest off as enemy territory? I'm pretty sure the answer is the latter. I expect that many Americans will do the same here, and that their set will not include the EU. I agree with the high-level goals of the GDPR, and with increased privacy regulation in general. I'm disturbed to see how quickly people will take the position that "every website is subject to the laws of every country" when it serves an end goal they agree with. Do you think the UK could export its super-injunctions (court orders enforcing censorship) by the same mechanism? If not, on what legal basis? I understand that you don't intend to comment further. I'm interested to discuss with anyone who thinks this kind of extraterritoriality is a good idea, and to understand what countries and what laws you think this should extend to.

troydavis 8y ago

Disclaimer: This is not legal advice. Yes, the lack of assets and revenue would make it difficult to collect. Exposure could include a staff member wanting to visit an EU country, the company trying to hire an EU-based remote contractor, or trying to get credit in the US. That said, the reasoning is simpler: even if there's literally zero interaction with or exposure to the EU, by the time a complaint gets to litigation, the company's approach to GDPR has already failed. erely being party to a case in any court (let alone losing one) isn't a trivial matter -- it means at least consulting an attorney and thinking through the implications (like perhaps not being able to obtain an EU visa). A GDPR strategy which gets to that point, and relies on the inability to collect a judgment, has failed. Facebook - really, FANG and a handful of other name-brand, global, consumer-facing companies - differ from most businesses in 2 ways: 1. They expect litigation, complaints, and article 17 erasure requests. There's no way to avoid it, just plan around it and minimize the impact. Their goal isn't no impact, it's no catastrophic impact. 2. They have teams of attorneys analyzing the risk and benefit of every decision. If they've decided (not) to do something, it's because they've accepted that the risks are worth the benefits, not necessarily because they think it's risk-free. Even most mid-market businesses don't have that luxury. Note also that my original comment said that experts debate whether user-submitted location is sufficient. I explicitly didn't and don't claim that there's any certainty. There's no case law at all right now, so anyone who claims certainty about edge cases is making stuff up. What is close to certain is that IP-based geocoding (ie, what this vendor provides) doesn't eliminate anywhere near all visitors from the EU, and thus doesn't eliminate the need to consider GDPR. Perhaps they decide to also add a user-submitted location dropdown to their signup form and accept the risks I just described, or decide to do nothing else and accept the risk of litigation from EU visitors who the geocoding doesn't identify. My core point is that the geocoding service pitches "Just block EU IPs and you're done," and that's not the case at all. I think we're past the point where HN comments are adding value, so this will be my last comment in this thread.

tripletao 8y ago
I don't mean to endorse any strategy of blocking the EU, and I certainly don't mean to endorse the advertised service. I do think you overestimate the importance of the EU to many Americans' views and lives. The Americans that you interact with--here or otherwise--are a disproportionately cosmopolitan sample, simply by the fact that they're talking to you. A lot of people in this country have no desire to do business in the EU. They have no desire to visit. Any regulatory action against them would reconfirm all their worst thoughts about "foreigners", and otherwise not change their lives. If they read what you wrote above, then they'd take away nothing, beyond maybe that your legal system is so terrible that no one knows what the laws are. And really, does this kind of extraterritoriality feel like a good idea to you? Roughly two hundred countries exist. Can you imagine a world where each of them tried to enforce rules of similar complexity to the GDPR against every human alive (because remember, I might be a lying North Korean)? Would you comply with every country's rules? Or would you decide what set of countries mattered to you, and write the rest off as enemy territory? I'm pretty sure the answer is the latter. I expect that many Americans will do the same here, and that their set will not include the EU. I agree with the high-level goals of the GDPR, and with increased privacy regulation in general. I'm disturbed to see how quickly people will take the position that "every website is subject to the laws of every country" when it serves an end goal they agree with. Do you think the UK could export its super-injunctions (court orders enforcing censorship) by the same mechanism? If not, on what legal basis? I understand that you don't intend to comment further. I'm interested to discuss with anyone who thinks this kind of extraterritoriality is a good idea, and to understand what countries and what laws you think this should extend to.