3 ms·

Question: What if a US company puts up a clickthrough agreement on their site that reads "It looks like you're accessing this site from the EU. This site is no

by Asooka 8y ago

Question: What if a US company puts up a clickthrough agreement on their site that reads "It looks like you're accessing this site from the EU. This site is not compliant with EU law and cannot be accessed from within the EU. If this is an error and you do not reside within the EU, please read the following: ... very long legalese about claiming that you are definitely not an EU citizen and the EU-seeming IP address is in fact a VPN or proxy, so you are definitely not subject to EU law. In case this agreement is signed fraudulently, damages will be ascertained by $US_STATE court (wherever company HQ is) ... [ ] I agree, under penalty of perjury, that the above applies to me. In the case that this agreement is signed fraudulently, I agree to pay the damages awarded by $US_STATE court and waive my right to sue within the US." Can this company continue doing business as usual, given that any EU user who tries to invoke GDPR will subsequently be fined and potentially deported to the US for hearing?

Animats 8y ago
"Consent: If the data subject’s consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. Any part of such a declaration which constitutes an infringement of this Regulation shall not be binding."[1] So, no. [1] https://gdpr-info.eu/art-7-gdpr/ https://gdpr-info.eu/art-7-gdpr/
- Asooka 8y ago
  I'm not saying the GDPR won't apply, the company will still have to spend resources on complying with GDPR requests. However, any user who invokes the GDPR will be in violation of the CFAA and face very seriouos consequences. The question is more "can we engineer a MAD situation where users won't dare invoke GDPR in fear of the consequences"?
  - Animats 8y ago
    No, because the user can both have a government agency do it for them, and delegate the right to apply the GDPR to a nonprofit advocacy organization.

by Asooka 8y ago

Animats 8y ago

"Consent: If the data subject’s consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. Any part of such a declaration which constitutes an infringement of this Regulation shall not be binding."[1] So, no. [1] https://gdpr-info.eu/art-7-gdpr/ https://gdpr-info.eu/art-7-gdpr/

Asooka 8y ago
I'm not saying the GDPR won't apply, the company will still have to spend resources on complying with GDPR requests. However, any user who invokes the GDPR will be in violation of the CFAA and face very seriouos consequences. The question is more "can we engineer a MAD situation where users won't dare invoke GDPR in fear of the consequences"?
- Animats 8y ago
  No, because the user can both have a government agency do it for them, and delegate the right to apply the GDPR to a nonprofit advocacy organization.