4 ms·

Wait...you mean that referring to the people in charge of GDPR as "good natured enforcers" who will "first warn you with a notice that you are not in compliance

Wait...you mean that referring to the people in charge of GDPR as "good natured enforcers" who will "first warn you with a notice that you are not in compliance with the law, give you some period of time to become compliant and will - if you ignore them - fine you," even though no requirement for warnings exists in GDPR, might be unrealistic? Perish the thought. /s

jimnotgym 8y ago
You could however look at the MO of the agencies themselves. They have existed for a long time and have not attempted to overreach. In fact the opposite is true.
- downandout 8y ago
  They have also never had the power to collect from any but the largest of companies outside their own borders. Now they are at least claiming that they do have this power. That sets a dangerous precedent and opens up the floodgates of abuse, because they don't have to deal with the PR or economic damage that the fines they assess internationally will cause - they import the money and export the problems. They simply see a massive inflow of money and get to hobble foreign competitors of local companies. It's a protectionist law, with the added bonus of extreme financial incentives for aggressive enforcement.
  - jimnotgym 8y ago
    > They simply see a massive inflow of money and get to hobble foreign competitors of local companies. That appears to be a baseless comment. > It's a protectionist law Or another way to look at it the US tech sector is no longer going to pick and choose which of our laws apply to it.
    - downandout 8y ago
      That appears to be a baseless comment. I'm intrigued. How is it baseless to say that a given EU country, say Germany, would not see a massive inflow of foreign money and a bunch of hobbled foreign competitors of German companies if they chose to engage in aggressive enforcement of GDPR against foreign companies?
      - oldcynic 8y ago
        Because we have an entire legal framework with centuries of precedent. Just about every law and regulation gives just a maximum penalty without countless cases of those being used to hobble foreign competitors. See also the answer to when you asked 17 days ago: https://news.ycombinator.com/item?id=17005603 https://news.ycombinator.com/item?id=17005603
        downandout 8y ago
        Since we are beating dead horses, I will again repeat that nothing stated in the GDPR requires warnings or requires that fines not be very large. Is it, or is it not, legally possible for a regulator to seek fines against you under GDPR without first issuing a warning? Please link to the specific law that exists outside the GDPR that requires such warnings. It has to be written somewhere...you (and other fans of GDPR) keep making this argument, so such a law must exist. The "answer" you linked to was just more of the same stuff you keep spouting, not a written law. If I can see such a law in the "old and large legal framework" you GDPR fans keep referring to that is somehow supposed to protect us from abuses, I'll happily admit that I'm wrong.
        oldcynic 8y ago
        I think, though I could be mistaken, that it originates from German law. The UK had a very similar requirement established in case law. Nonetheless the EU views proportionality as a central principle enshrined in Article 49 of the EU Charter of Fundamental Rights [0]. "The severity of penalties must not be disproportionate to the criminal offence" You're no doubt going to tell me that's far too vague and woolly. So this link might give you a flavour of how EU fundamental principles[1] came about from a bunch of centuries old separate national legal systems: http://blogs.northampton.ac.uk/law/2015/11/02/proportionality-%E2%80%93-an-increasingly-important-principle-of-eu-law/ http://blogs.northampton.ac.uk/law/2015/11/02/proportionalit... Just a random result on first page - there may be better or more easily readable sources. That proportionality applies to everything in EU law, and there have been numerous cases through the courts, national Judicial Review, and taking cases to the EU Courts of Justice. The principle is firmly enshrined. As with anything human mistakes are made, so of course there are appeals from time to time. That's how case law gets made. [0] http://fra.europa.eu/en/charterpedia/article/49-principles-legality-and-proportionality-criminal-offences-and-penalties http://fra.europa.eu/en/charterpedia/article/49-principles-l... [1] https://en.wikipedia.org/wiki/General_principles_of_European_Union_law https://en.wikipedia.org/wiki/General_principles_of_European...
Angostura 8y ago
Wait, you think it is ludicrous to take how the enforcers behave with current privacy regulations as a rough guide to gow they will treat enforcement of future regulation? Perish the thought.
- ryanwaggoner 8y ago
  Yes. It’s absolutely ludicrous for me to say “ah, some random people on the internet say the EU regulators in their country have been fine, so I’ll be A-OK with dozens of countries all assuming vague and unchecked power over my business in perpetuity.” I didn’t elect these governments, I don’t know them or trust them, and I don’t know or trust you either. I don’t trust unaccountable power as a general rule.
  - tombone12 8y ago
    I don't know any accountability processes for the moderation on hackernews, but I'm sure you've considered that already.
    - ryanwaggoner 8y ago
      What? Not sure what point you’re trying to make here, but if it’s the point that the HN moderators are not accountable to me, it’s kind of a pointless one. Of course they’re not, but I’m free to leave. The EU is claiming jurisdiction over my business because of something their citizens have done, not anything I’ve done. If you don’t want me to have your citizens’ data, tell them to stop sending it to me.
      - henrikschroder 8y ago
        > The EU is claiming jurisdiction over my business I think this is a huge strawman argument that you've constructed and hinged your entire line of reasoning on. The EU claims jurisdiction over EU businesses. The reason very large US businesses are caring about GDPR, is because they are multinational businesses with a significant presence in the EU, i.e. they are also EU businesses. And if you're doing business in a country, you have to comply with local law. There's nothing new or weird or over-reaching about that. When Facebook constructs a data center somewhere in the EU, the local Facebook subsidiary has to comply with local zoning laws, building codes, and labour laws. When Facebook gathers personal data about EU citizens, the local Facebook subsidiaries have to comply with local privacy laws. Note that Facebook isn't extending the GDPR protections to non-EU users, because it doesn't have to! It only has to extend GDPR protections to EU users, if they wish to keep their European subsidiaries.
ryanwaggoner 8y ago
Even if they are realistic for some agencies now, they’re not guaranteed to be for all agencies forever. But what irritates me a lot more is the many GDPR fans here who not just disagree with this assessment but accuse the other side of ill intent. It’s disgusting to call people evil and shady because they are uncomfortable with relying on the voluntary goodwill of some faceless overseas bureaucrat that they did not elect and who has been given the power of life and death over one’s livelihood. 99% of people here who have concerns don’t want to violate user privacy, but this law is so shitty that they don’t even know how to comply. And every single thread is packed with people exclaiming that it’s so obvious and easy, while all spouting totally different and contradictory advice. What a shitshow.
- jimnotgym 8y ago
  Perhaps us Europeans should demand that US law is drafted in a way that is more familiar to us? In fact I find the hierarchy of state and federal law really complicated compared to UK law, so you should change that too. Sarbanes-Oxley in particular is much more draconian than any UK corporate law, and this is a barrier to me coming and breaking the law in the US, so you should change that too. I didn't vote for your overseas faceless bureaucrat either, so I can I treat US law as optional? Sorry Team America, you don't get to choose our laws
  - ryanwaggoner 8y ago
    And you don’t get to decide that your laws apply to us just because your citizens are voluntarily sending us data. If you don’t want us to have the data, don’t send it. My server receiving a request from an EU citizen doesn’t give you jurisdiction over my business. I know you think it does, and I’m sure I’ll be downvoted, but you can pass whatever laws you want and if they don’t apply to me, I’ll continue to ignore them.
    - deleted 8y ago
      [deleted]

jimnotgym 8y ago

You could however look at the MO of the agencies themselves. They have existed for a long time and have not attempted to overreach. In fact the opposite is true.

downandout 8y ago
They have also never had the power to collect from any but the largest of companies outside their own borders. Now they are at least claiming that they do have this power. That sets a dangerous precedent and opens up the floodgates of abuse, because they don't have to deal with the PR or economic damage that the fines they assess internationally will cause - they import the money and export the problems. They simply see a massive inflow of money and get to hobble foreign competitors of local companies. It's a protectionist law, with the added bonus of extreme financial incentives for aggressive enforcement.
- jimnotgym 8y ago
  > They simply see a massive inflow of money and get to hobble foreign competitors of local companies. That appears to be a baseless comment. > It's a protectionist law Or another way to look at it the US tech sector is no longer going to pick and choose which of our laws apply to it.
  - downandout 8y ago
    That appears to be a baseless comment. I'm intrigued. How is it baseless to say that a given EU country, say Germany, would not see a massive inflow of foreign money and a bunch of hobbled foreign competitors of German companies if they chose to engage in aggressive enforcement of GDPR against foreign companies?
    - oldcynic 8y ago
      Because we have an entire legal framework with centuries of precedent. Just about every law and regulation gives just a maximum penalty without countless cases of those being used to hobble foreign competitors. See also the answer to when you asked 17 days ago: https://news.ycombinator.com/item?id=17005603 https://news.ycombinator.com/item?id=17005603
      - downandout 8y ago
        Since we are beating dead horses, I will again repeat that nothing stated in the GDPR requires warnings or requires that fines not be very large. Is it, or is it not, legally possible for a regulator to seek fines against you under GDPR without first issuing a warning? Please link to the specific law that exists outside the GDPR that requires such warnings. It has to be written somewhere...you (and other fans of GDPR) keep making this argument, so such a law must exist. The "answer" you linked to was just more of the same stuff you keep spouting, not a written law. If I can see such a law in the "old and large legal framework" you GDPR fans keep referring to that is somehow supposed to protect us from abuses, I'll happily admit that I'm wrong.
        oldcynic 8y ago
        I think, though I could be mistaken, that it originates from German law. The UK had a very similar requirement established in case law. Nonetheless the EU views proportionality as a central principle enshrined in Article 49 of the EU Charter of Fundamental Rights [0]. "The severity of penalties must not be disproportionate to the criminal offence" You're no doubt going to tell me that's far too vague and woolly. So this link might give you a flavour of how EU fundamental principles[1] came about from a bunch of centuries old separate national legal systems: http://blogs.northampton.ac.uk/law/2015/11/02/proportionality-%E2%80%93-an-increasingly-important-principle-of-eu-law/ http://blogs.northampton.ac.uk/law/2015/11/02/proportionalit... Just a random result on first page - there may be better or more easily readable sources. That proportionality applies to everything in EU law, and there have been numerous cases through the courts, national Judicial Review, and taking cases to the EU Courts of Justice. The principle is firmly enshrined. As with anything human mistakes are made, so of course there are appeals from time to time. That's how case law gets made. [0] http://fra.europa.eu/en/charterpedia/article/49-principles-legality-and-proportionality-criminal-offences-and-penalties http://fra.europa.eu/en/charterpedia/article/49-principles-l... [1] https://en.wikipedia.org/wiki/General_principles_of_European_Union_law https://en.wikipedia.org/wiki/General_principles_of_European...

Angostura 8y ago

Wait, you think it is ludicrous to take how the enforcers behave with current privacy regulations as a rough guide to gow they will treat enforcement of future regulation? Perish the thought.

ryanwaggoner 8y ago
Yes. It’s absolutely ludicrous for me to say “ah, some random people on the internet say the EU regulators in their country have been fine, so I’ll be A-OK with dozens of countries all assuming vague and unchecked power over my business in perpetuity.” I didn’t elect these governments, I don’t know them or trust them, and I don’t know or trust you either. I don’t trust unaccountable power as a general rule.
- tombone12 8y ago
  I don't know any accountability processes for the moderation on hackernews, but I'm sure you've considered that already.
  - ryanwaggoner 8y ago
    What? Not sure what point you’re trying to make here, but if it’s the point that the HN moderators are not accountable to me, it’s kind of a pointless one. Of course they’re not, but I’m free to leave. The EU is claiming jurisdiction over my business because of something their citizens have done, not anything I’ve done. If you don’t want me to have your citizens’ data, tell them to stop sending it to me.
    - henrikschroder 8y ago
      > The EU is claiming jurisdiction over my business I think this is a huge strawman argument that you've constructed and hinged your entire line of reasoning on. The EU claims jurisdiction over EU businesses. The reason very large US businesses are caring about GDPR, is because they are multinational businesses with a significant presence in the EU, i.e. they are also EU businesses. And if you're doing business in a country, you have to comply with local law. There's nothing new or weird or over-reaching about that. When Facebook constructs a data center somewhere in the EU, the local Facebook subsidiary has to comply with local zoning laws, building codes, and labour laws. When Facebook gathers personal data about EU citizens, the local Facebook subsidiaries have to comply with local privacy laws. Note that Facebook isn't extending the GDPR protections to non-EU users, because it doesn't have to! It only has to extend GDPR protections to EU users, if they wish to keep their European subsidiaries.

ryanwaggoner 8y ago

Even if they are realistic for some agencies now, they’re not guaranteed to be for all agencies forever. But what irritates me a lot more is the many GDPR fans here who not just disagree with this assessment but accuse the other side of ill intent. It’s disgusting to call people evil and shady because they are uncomfortable with relying on the voluntary goodwill of some faceless overseas bureaucrat that they did not elect and who has been given the power of life and death over one’s livelihood. 99% of people here who have concerns don’t want to violate user privacy, but this law is so shitty that they don’t even know how to comply. And every single thread is packed with people exclaiming that it’s so obvious and easy, while all spouting totally different and contradictory advice. What a shitshow.

jimnotgym 8y ago
Perhaps us Europeans should demand that US law is drafted in a way that is more familiar to us? In fact I find the hierarchy of state and federal law really complicated compared to UK law, so you should change that too. Sarbanes-Oxley in particular is much more draconian than any UK corporate law, and this is a barrier to me coming and breaking the law in the US, so you should change that too. I didn't vote for your overseas faceless bureaucrat either, so I can I treat US law as optional? Sorry Team America, you don't get to choose our laws
- ryanwaggoner 8y ago
  And you don’t get to decide that your laws apply to us just because your citizens are voluntarily sending us data. If you don’t want us to have the data, don’t send it. My server receiving a request from an EU citizen doesn’t give you jurisdiction over my business. I know you think it does, and I’m sure I’ll be downvoted, but you can pass whatever laws you want and if they don’t apply to me, I’ll continue to ignore them.
  - deleted 8y ago
    [deleted]