4 ms·

The presumption is that it's illegitimate but you can provide an affirmative defense of having a valid reason. Proving this can be expensive and is risky. Who

by ghein 8y ago

The presumption is that it's illegitimate but you can provide an affirmative defense of having a valid reason. Proving this can be expensive and is risky. Who knows what any individual judge in any EU country will decide is "reasonable"? Companies can easily be destroyed by filing multiple charges against them. Guilt, innocence, or reasonableness doesn't come into it: the process is the punishment. Look at Amanda Knox (Americans tend to think she's innocent, Brits tend to think she's guilty) - after appeals the Italian Justice System found her not guilty of the murder of her roommate. She still spent almost four years in prison in her early twenties and had to spend a huge amount of money on lawyers to arrive at this result. Just because you eventually get what you see as the right result doesn't mean you won't go through hell to get there. A major reason why Americans are having such a big problem with GDPR is because the EU system appears to change its interpretations and decisions abruptly, with retrospective effect. You set up companies in certain jurisdictions thanks to their tax rates and how transactions are treated. You follow every aspect of national and EU law. These arrangements are widely known, are accepted as legitimate practice, and they continue for decades. The EU commissioners change - suddenly your corporate arrangements are wildly illegal and you are subject to penalties and back taxes stretching over a decade. If staff changes and they say that they will interpret a rule differently going forward, you can adjust your behavior to comply. New legislation, sure abide by it. But when the rules change and your behavior 15 years ago is now viewed to be illegal you can't do anything. Retroactivity is accepted in Europe but it is explicitly unconstitutional in the US. It's a major reason why the US is not currently part of the UK. So the GDPR is terrifying because of the massive discretion granted to judges and prosecutors in every EU country and their habit for changing their interpretations. On its face it's not too threatening, but the fines are massive, there are no hard rules, and you can't be sure that today's interpretation will be tomorrow's. Facebook and Google will manage - they can write billion dollar checks and get the US government to protect them. Many of us can be completely wiped out by a $20MM fine. Just a court case would be existentially threatening in terms of the resources it requires and its impact on fundraising and gaining customers.

jacquesm 8y ago
More fearmongering. I will simply wait to see what actually is being done and if and when that oversteps the bounds of what I consider reasonable I will definitely make my voice heard but until then this is all totally besides the point and time spent on fearmongering would probably be better spent on studying the law, determining its intent and then doing your best to comply with that intent. The very small chance that some mom & pop shop will be taken to the cleaners by the EU courts 'just because they can' strikes me as not grounded in reality, there is no precedent for anything like that. And bringing up some unrelated (murder!) case has no effect at all than to point out that justice systems aren't perfect, they are not expected to be perfect and we have lots of evidence to that effect already. That's a totally different discussion.
- ghein 8y ago
  There's a presumption that every company in the world is violating EU citizens privacy. That storing IP addresses can be construed as illegal. That everyone is liable for a fine of $20MM for any mistake, innocent or malevolent. The EU itself is hyping up how fearsome this law is to win approval from their citizens and politicians. As well as to strongly encourage firms to take this change seriously. But I am at fault for taking the EU seriously rather than being blase. I am fearmongering for trying to explain why businesspeople who are not in the EU are afraid of its actions and are afraid of a brand new law that grants a huge amount of discretion to prosecutors and judges. What I know is that the EU can capriciously change its mind and go after the biggest companies for billions of dollars. I know that I don't have the resources to prove my innocence in a foreign country. I don't even have the resources to understand the charges against me, since legal translation is expensive and I could be faced with actions in any or all of the languages of the EU. If I get a package of documents in Estonian or Bulgarian I won't even know that I'm facing charges! Claiming universal jurisdiction against every company in the world with a reverse onus of proof is a dangerous and malevolent tactic. Because it's your local government that you have confidence in, you're comfortable with it. I doubt that you would be so blase about a similar approach by the US or Japan.
  - jacquesm 8y ago
    > There's a presumption that every company in the world is violating EU citizens privacy. That presumption is probably roughly in line with what I've seen in my daily practice over the last decade or so. Some to minor degrees, some in major ways. But overall, very very few companies take the privacy of their customers so serious that they would make choose for their users privacy if ther was a buck to be made, of the top of my head over the last 75 or so companies I looked at two would check that box. > That storing IP addresses can be construed as illegal. What's so surprising about that? You see a whole pile of lawsuits that - erroneously - hinge on IP addresses being PII (Copyright lawsuits) and at the same time you expect the law to treat IP addresses as through they are not PII? That simply won't fly. So yes, IP addresses are - in many places - seen as PII. > That everyone is liable for a fine of $20MM for any mistake, innocent or malevolent. Bullshit. > The EU itself is hyping up how fearsome this law is to win approval from their citizens and politicians. Where have they done so? All I've seen to date is some pretty dispassionate pieces and the text of the law itself. > As well as to strongly encourage firms to take this change seriously. Yes, you should take it seriously. Of course you should, it is the law. > But I am at fault for taking the EU seriously rather than being blase. No, you're at fault by drawing this out of proportion, just like you are doing in this comment. > I am fearmongering for trying to explain why businesspeople who are not in the EU are afraid of its actions and are afraid of a brand new law that grants a huge amount of discretion to prosecutors and judges. Your fearmongering is to exaggerate, to focus on the edge cases rather than on the bulk and then to start assuming that all cases are edge cases. They're not. The bulk of the businesses will be just fine. Those that chose to creatively interpret the law to see how far they can push things will hopefully find out that the EU actually means business. By your reasoning we never should make new laws to deal with changing conditions. The EU tried a gentle approach aka the cookie law, companies tried hard to work their way around the law rather than to stop tracking users every which way they could so now you get this. Self regulation -> mild regulation -> strong regulation+ (+ you are here now). > What I know is that the EU can capriciously change its mind and go after the biggest companies for billions of dollars. Capriciously? I have not seen the EU act capriciously yet. I've seen them act too slow and too late. > I know that I don't have the resources to prove my innocence in a foreign country. Poor you. Well, then better not to commit any crimes. That's a pretty good protection against having to defend yourself, stay well clear of that bright line. > I don't even have the resources to understand the charges against me, since legal translation is expensive and I could be faced with actions in any or all of the languages of the EU. More bullshit, the law is written in English and if you want to go so far as to take something to court - which I would highly advise against, it is much easier to comply with the law - you will find that the EU courts are set up to deal in English just fine. Lucky you, as opposed to say someone from Latin America, China or Outer Mongolia who does not speak or write English. > If I get a package of documents in Estonian or Bulgarian I won't even know that I'm facing charges! The chances of that happening are nil. Really, could you please stop the fearmongering, it does not serve any purpose. > Claiming universal jurisdiction against every company in the world with a reverse onus of proof is a dangerous and malevolent tactic. As opposed to what the US does? See: David Carruthers. > Because it's your local government that you have confidence in, you're comfortable with it. Yep. > I doubt that you would be so blase about a similar approach by the US or Japan. If the US or Japan has laws that apply to my situation I will take great care to comply with them. One such law (the DMCA) has caused me a lot of work over the years and I see this as a cost of doing business. If you don't want to comply with the law then you are taking your chances. Similar to speeding or deciding to kill someone: it's not what you can get away with that determines what is legal or not and if you are caught breaking the law you can expect trouble. So better don't break the law.

by ghein 8y ago

jacquesm 8y ago

More fearmongering. I will simply wait to see what actually is being done and if and when that oversteps the bounds of what I consider reasonable I will definitely make my voice heard but until then this is all totally besides the point and time spent on fearmongering would probably be better spent on studying the law, determining its intent and then doing your best to comply with that intent. The very small chance that some mom & pop shop will be taken to the cleaners by the EU courts 'just because they can' strikes me as not grounded in reality, there is no precedent for anything like that. And bringing up some unrelated (murder!) case has no effect at all than to point out that justice systems aren't perfect, they are not expected to be perfect and we have lots of evidence to that effect already. That's a totally different discussion.

ghein 8y ago
There's a presumption that every company in the world is violating EU citizens privacy. That storing IP addresses can be construed as illegal. That everyone is liable for a fine of $20MM for any mistake, innocent or malevolent. The EU itself is hyping up how fearsome this law is to win approval from their citizens and politicians. As well as to strongly encourage firms to take this change seriously. But I am at fault for taking the EU seriously rather than being blase. I am fearmongering for trying to explain why businesspeople who are not in the EU are afraid of its actions and are afraid of a brand new law that grants a huge amount of discretion to prosecutors and judges. What I know is that the EU can capriciously change its mind and go after the biggest companies for billions of dollars. I know that I don't have the resources to prove my innocence in a foreign country. I don't even have the resources to understand the charges against me, since legal translation is expensive and I could be faced with actions in any or all of the languages of the EU. If I get a package of documents in Estonian or Bulgarian I won't even know that I'm facing charges! Claiming universal jurisdiction against every company in the world with a reverse onus of proof is a dangerous and malevolent tactic. Because it's your local government that you have confidence in, you're comfortable with it. I doubt that you would be so blase about a similar approach by the US or Japan.
- jacquesm 8y ago
  > There's a presumption that every company in the world is violating EU citizens privacy. That presumption is probably roughly in line with what I've seen in my daily practice over the last decade or so. Some to minor degrees, some in major ways. But overall, very very few companies take the privacy of their customers so serious that they would make choose for their users privacy if ther was a buck to be made, of the top of my head over the last 75 or so companies I looked at two would check that box. > That storing IP addresses can be construed as illegal. What's so surprising about that? You see a whole pile of lawsuits that - erroneously - hinge on IP addresses being PII (Copyright lawsuits) and at the same time you expect the law to treat IP addresses as through they are not PII? That simply won't fly. So yes, IP addresses are - in many places - seen as PII. > That everyone is liable for a fine of $20MM for any mistake, innocent or malevolent. Bullshit. > The EU itself is hyping up how fearsome this law is to win approval from their citizens and politicians. Where have they done so? All I've seen to date is some pretty dispassionate pieces and the text of the law itself. > As well as to strongly encourage firms to take this change seriously. Yes, you should take it seriously. Of course you should, it is the law. > But I am at fault for taking the EU seriously rather than being blase. No, you're at fault by drawing this out of proportion, just like you are doing in this comment. > I am fearmongering for trying to explain why businesspeople who are not in the EU are afraid of its actions and are afraid of a brand new law that grants a huge amount of discretion to prosecutors and judges. Your fearmongering is to exaggerate, to focus on the edge cases rather than on the bulk and then to start assuming that all cases are edge cases. They're not. The bulk of the businesses will be just fine. Those that chose to creatively interpret the law to see how far they can push things will hopefully find out that the EU actually means business. By your reasoning we never should make new laws to deal with changing conditions. The EU tried a gentle approach aka the cookie law, companies tried hard to work their way around the law rather than to stop tracking users every which way they could so now you get this. Self regulation -> mild regulation -> strong regulation+ (+ you are here now). > What I know is that the EU can capriciously change its mind and go after the biggest companies for billions of dollars. Capriciously? I have not seen the EU act capriciously yet. I've seen them act too slow and too late. > I know that I don't have the resources to prove my innocence in a foreign country. Poor you. Well, then better not to commit any crimes. That's a pretty good protection against having to defend yourself, stay well clear of that bright line. > I don't even have the resources to understand the charges against me, since legal translation is expensive and I could be faced with actions in any or all of the languages of the EU. More bullshit, the law is written in English and if you want to go so far as to take something to court - which I would highly advise against, it is much easier to comply with the law - you will find that the EU courts are set up to deal in English just fine. Lucky you, as opposed to say someone from Latin America, China or Outer Mongolia who does not speak or write English. > If I get a package of documents in Estonian or Bulgarian I won't even know that I'm facing charges! The chances of that happening are nil. Really, could you please stop the fearmongering, it does not serve any purpose. > Claiming universal jurisdiction against every company in the world with a reverse onus of proof is a dangerous and malevolent tactic. As opposed to what the US does? See: David Carruthers. > Because it's your local government that you have confidence in, you're comfortable with it. Yep. > I doubt that you would be so blase about a similar approach by the US or Japan. If the US or Japan has laws that apply to my situation I will take great care to comply with them. One such law (the DMCA) has caused me a lot of work over the years and I see this as a cost of doing business. If you don't want to comply with the law then you are taking your chances. Similar to speeding or deciding to kill someone: it's not what you can get away with that determines what is legal or not and if you are caught breaking the law you can expect trouble. So better don't break the law.