6 ms·

This article actually points out my philosophical problem with GDPR. In one point he says you have to be compliant if you want to do business in the EU. In anot

This article actually points out my philosophical problem with GDPR. In one point he says you have to be compliant if you want to do business in the EU. In another he observed that it is difficult (maybe impossible) to block EU folks from coming to a web presence. It’s the expansive reach that bugs me. I’ll note that for real businesses this is just a thought excercise, but it’s one I keep coming back to. What if some less reasonable entity attempted to regulate in this way?

drtillberg 8y ago
GDPR lacks clear and unambiguous limiting principles and attempts to impose costs--a tax if you will-- on what you know. From a u.s private person perspective, that looks like a significant overreach. Yes, GDPR reigns in a data industry run amok. Great. But GDPR does not clearly stop there, and for the rest of us GDPR seems to hint ominously that if you know anything about anyone, that may be a problem. So overtly cut ties with Europe or forget what you know. Are we to become know-nothings? New-age luddites? Whatever happened to liberty, representation, and the freedom to learn about the world? The commentary largely focuses on online data, ips and such, but GDPR is not limited to such things. This has the flavor of regulation written by foreign bureaucrats in consultation with big business, having little concern for the significant risk of mystifying and annoying literally anyone else in the world. It's a negative development for interconnectivity and international comity.
pjc50 8y ago
> This article actually points out my philosophical problem with GDPR. In one point he says you have to be compliant if you want to do business in the EU. In another he observed that it is difficult (maybe impossible) to block EU folks from coming to a web presence. It’s the expansive reach that bugs me. Other countries have already had to deal with the US on this front. If you are a US national you may find it extremely hard to get a bank account in a non-US country, for example; non-US gambling services also have to be very careful about US users (PokerStars et al) https://en.wikipedia.org/wiki/United_States_v._Scheinberg https://en.wikipedia.org/wiki/United_States_v._Scheinberg There are also things like the Magnitsky Act and various other bits of human rights law that allow extremely serious crime and crimes against humanity to be pursued internationally. The one we'll have to watch out for are Chinese censorship laws going global. There's already some weird side effects of "One China".
dingaling 8y ago
'Doing business' requires two steps: 1. Invitation to treat: that is offering services for consumption 2. Offer to contract: fulfilling the invitation by making a contract of terms If you drop a potential customer at step 1, e.g. having your web-server decline the connection based on GeoIP, would that not constitute reasonable effort? We don't have case law regarding GDPR yet but I would certainly argue that it shows efforts being taken to exclude EU residents.
- kasey_junk 8y ago
  I think it probably would but there are 2 major issues there (under some interpretations): - the IP, under GDPR, is personal data. You need consent or a legitimate interest to process it. - it is very murky regarding EU persons abroad. So if I operate with a German citizen originating in Hong Kong, I may be subject to the law. Personally, I think that you'll be fine blocking EU IPs as long as you aren't doing anything more with them, but that doesn't change the philosophical problem. Someone else, through proactive work on their part, came to my site (say hosted outside of the EU), even though I did not want them to and I am on the hook for a law I had no agency in creating. Again, largely a thought exercise and not a real problem for real businesses, but it does beg the question...are websites liable for every law in the world? Do we just fall back on the 'well they can't enforce it' model of evaluating website legislation?
oblio 8y ago
Are you American, by any chance? The whole internet dances to the US tune, legally. Welcome to our world :)
- adventured 8y ago
  For 20+ years the US - as the dominate controlling agent regarding the Internet - ensured the modern (post early 1990s) Internet remained extremely non-regulated and non-interfered with by ~195 nations (when it came to the global Internet system). It worked globally out of the gate and required no special adherence to US laws. The Chinese did not have to adopt US freedom of speech approaches to use the Internet. The Iranians or Saudis did not have to adopt US freedom of religion approaches to use the Internet. The EU did not have to adopt US legal approaches or laws to use the Internet. Any other scenario than the one the US pursued would have resulted in a fractured, mostly useless global Internet. The US was about as good of a shepherd as any nation could have ever been: thus we got several billion users onto the Internet from wildly diverse background jurisdictions. The way the US built the Internet made it possible for the EU to say: hey, we're going to do GDPR, because that works for us (and yet the Internet still works); and for other jurisdictions to say: hey, we're going to do this that or something else because that works for us. > The whole internet dances to the US tune, legally. You've got that almost exactly backwards. The US approach has required almost no dancing at all to the US tune. That's precisely why ~4 billion people can use the Internet from 195 nations, all with dramatically varying laws. They're not adopting US law to use the Internet. That's why the Chinese have been able to implement their unique approach and still use the Internet (restricted to fit their tolerances at a government level). You very specifically do not have to dance to US legal tunes to use the Internet. Even when it comes to IP laws, you do not have to dance to the US tune (Europe has varied widely from the US on such, eg as it relates to piracy, and yet the Internet keeps on regardless).
  - oblio 8y ago
    While I agree the US was generally benevolent, it did it because it knew it had the tech superiority. It's the same thing with the Opium Wars and China or Perry's gunboat and Japan: we'll force you to trade with us because we know our goods are superior and you'll buy them. Same thing with the internet: the US was the biggest developed country, it had a large, stable, rich internal market, it had big universities churning out graduates (many of them coming from other countries!), it was the inventor of many tech things that make up the internet. So of course a less regulated internet would benefit it since its companies were best positioned to take advantage. My guestion for the next 30-40 years: unless China screws up badly, it will overtake the US. It's simple math: a moderately rich Chinese population will overtake the US one, as it outnumbers it 4 to 1 or so. Will the US be as benevolent and open when it's the underdog? Based on some reactions I've seen here, regarding the EU and the GDPR and also on reading a ton of comments about China, I'm not so convinced. TL;DR: The US is reasonable, for a super power, but it didn't do it out of the goodness of its heart.

drtillberg 8y ago

GDPR lacks clear and unambiguous limiting principles and attempts to impose costs--a tax if you will-- on what you know. From a u.s private person perspective, that looks like a significant overreach. Yes, GDPR reigns in a data industry run amok. Great. But GDPR does not clearly stop there, and for the rest of us GDPR seems to hint ominously that if you know anything about anyone, that may be a problem. So overtly cut ties with Europe or forget what you know. Are we to become know-nothings? New-age luddites? Whatever happened to liberty, representation, and the freedom to learn about the world? The commentary largely focuses on online data, ips and such, but GDPR is not limited to such things. This has the flavor of regulation written by foreign bureaucrats in consultation with big business, having little concern for the significant risk of mystifying and annoying literally anyone else in the world. It's a negative development for interconnectivity and international comity.

pjc50 8y ago

> This article actually points out my philosophical problem with GDPR. In one point he says you have to be compliant if you want to do business in the EU. In another he observed that it is difficult (maybe impossible) to block EU folks from coming to a web presence. It’s the expansive reach that bugs me. Other countries have already had to deal with the US on this front. If you are a US national you may find it extremely hard to get a bank account in a non-US country, for example; non-US gambling services also have to be very careful about US users (PokerStars et al) https://en.wikipedia.org/wiki/United_States_v._Scheinberg https://en.wikipedia.org/wiki/United_States_v._Scheinberg There are also things like the Magnitsky Act and various other bits of human rights law that allow extremely serious crime and crimes against humanity to be pursued internationally. The one we'll have to watch out for are Chinese censorship laws going global. There's already some weird side effects of "One China".

dingaling 8y ago

'Doing business' requires two steps: 1. Invitation to treat: that is offering services for consumption 2. Offer to contract: fulfilling the invitation by making a contract of terms If you drop a potential customer at step 1, e.g. having your web-server decline the connection based on GeoIP, would that not constitute reasonable effort? We don't have case law regarding GDPR yet but I would certainly argue that it shows efforts being taken to exclude EU residents.

kasey_junk 8y ago
I think it probably would but there are 2 major issues there (under some interpretations): - the IP, under GDPR, is personal data. You need consent or a legitimate interest to process it. - it is very murky regarding EU persons abroad. So if I operate with a German citizen originating in Hong Kong, I may be subject to the law. Personally, I think that you'll be fine blocking EU IPs as long as you aren't doing anything more with them, but that doesn't change the philosophical problem. Someone else, through proactive work on their part, came to my site (say hosted outside of the EU), even though I did not want them to and I am on the hook for a law I had no agency in creating. Again, largely a thought exercise and not a real problem for real businesses, but it does beg the question...are websites liable for every law in the world? Do we just fall back on the 'well they can't enforce it' model of evaluating website legislation?

oblio 8y ago

Are you American, by any chance? The whole internet dances to the US tune, legally. Welcome to our world :)

adventured 8y ago
For 20+ years the US - as the dominate controlling agent regarding the Internet - ensured the modern (post early 1990s) Internet remained extremely non-regulated and non-interfered with by ~195 nations (when it came to the global Internet system). It worked globally out of the gate and required no special adherence to US laws. The Chinese did not have to adopt US freedom of speech approaches to use the Internet. The Iranians or Saudis did not have to adopt US freedom of religion approaches to use the Internet. The EU did not have to adopt US legal approaches or laws to use the Internet. Any other scenario than the one the US pursued would have resulted in a fractured, mostly useless global Internet. The US was about as good of a shepherd as any nation could have ever been: thus we got several billion users onto the Internet from wildly diverse background jurisdictions. The way the US built the Internet made it possible for the EU to say: hey, we're going to do GDPR, because that works for us (and yet the Internet still works); and for other jurisdictions to say: hey, we're going to do this that or something else because that works for us. > The whole internet dances to the US tune, legally. You've got that almost exactly backwards. The US approach has required almost no dancing at all to the US tune. That's precisely why ~4 billion people can use the Internet from 195 nations, all with dramatically varying laws. They're not adopting US law to use the Internet. That's why the Chinese have been able to implement their unique approach and still use the Internet (restricted to fit their tolerances at a government level). You very specifically do not have to dance to US legal tunes to use the Internet. Even when it comes to IP laws, you do not have to dance to the US tune (Europe has varied widely from the US on such, eg as it relates to piracy, and yet the Internet keeps on regardless).
- oblio 8y ago
  While I agree the US was generally benevolent, it did it because it knew it had the tech superiority. It's the same thing with the Opium Wars and China or Perry's gunboat and Japan: we'll force you to trade with us because we know our goods are superior and you'll buy them. Same thing with the internet: the US was the biggest developed country, it had a large, stable, rich internal market, it had big universities churning out graduates (many of them coming from other countries!), it was the inventor of many tech things that make up the internet. So of course a less regulated internet would benefit it since its companies were best positioned to take advantage. My guestion for the next 30-40 years: unless China screws up badly, it will overtake the US. It's simple math: a moderately rich Chinese population will overtake the US one, as it outnumbers it 4 to 1 or so. Will the US be as benevolent and open when it's the underdog? Based on some reactions I've seen here, regarding the EU and the GDPR and also on reading a ton of comments about China, I'm not so convinced. TL;DR: The US is reasonable, for a super power, but it didn't do it out of the goodness of its heart.