4 ms·

And a ton of non-EU companies don't, but are doing so for future purposes. Despite territorial scope, a company without any form of business in the EU, they can

And a ton of non-EU companies don't, but are doing so for future purposes. Despite territorial scope, a company without any form of business in the EU, they can't entorce this against non-EU businesses.

bausshf 8y ago
They can.
- daxorid 8y ago
  Care to elaborate? In which US court does the EU have standing to bring suit against a US citizen or corporation for violation of regulations the US does not recognize by either law or treaty?
  - jhall1468 8y ago
    Yeah, you aren't going to get what you asked for. There are no civil enforcement agreements between the EU and the US so they can do exactly nothing.
    - bausshf 8y ago
      https://politics.stackexchange.com/questions/30509/how-are-gdpr-fines-actually-enforced-for-us-companies-with-no-physical-presence https://politics.stackexchange.com/questions/30509/how-are-g...
deleted 8y ago
[deleted]
krageon 8y ago
You are wrong. This is a misconception that has thankfully died down a bit over the past week or so, but apparently it is still a bit alive. There are accords in place between (for example) the US and the EU, which allows the EU to hand out fines overseas. The reverse is also true (the US can and does litigate in the EU).
- jhall1468 8y ago
  Show me case law where an EU government fined a US company and how they enforced payment of that fine.
  - eatbitseveryday 8y ago
    https://en.m.wikipedia.org/wiki/Microsoft_Corp_v_Commission https://en.m.wikipedia.org/wiki/Microsoft_Corp_v_Commission
    - jhall1468 8y ago
      That's not an example of what I asked for. Microsoft had offices in the EU when this case started, which made them an EU company for all intents and purposes.
  - krageon 8y ago
    When did I mention case law? Shouldn't you be asking me for proof of the accords I mentioned, which is what I'm actually talking about?
    - jhall1468 8y ago
      I asked for case law because that would give me evidence that this actually happened. That's because it can't happen. That's because you're dead wrong: https://community.spiceworks.com/topic/2007530-how-the-eu-can-fine-us-companies-for-violating-gdpr https://community.spiceworks.com/topic/2007530-how-the-eu-ca... "While we don’t yet have U.S.-EU negotiated civil enforcement mechanisms for the GDPR (and it is unknown whether we ever will), there is still the application of international law and potential cooperation agreements between U.S. and EU law enforcement agencies, which have been increasing in recent years." That's politician for "We have absolutely no recourse if the company doesn't have an established business in the EU." EDIT: That's a nice article. It goes to explain that if a company has no presence in the EU, it has to identify an agent in the EU to act on its behalf. So any company can simply NOT do this if they never intend to have EU offices and the EU has no recourse.
pluma 8y ago
FWIW while you're right, that's awfully shortsighted unless you're a mom & pop shop with no intent of ever expanding beyond your backyard. A lot of devs hanging out on HN are working for companies that have at least some B2B aspect. Being GDPR non-compliant means these companies will have to avoid you too, because even if they're themselves not affected by GDPR they may have customers who are and need the compliance to be able to do business with those customers. But that said, as an EU company, US companies are only an option if they're Privacy Shield certified and offer a Data Processing Agreement. And even then it's safer to go for a company in the EU or in an "adequate"[0] country. You don't want to be caught unaware when some court or orange person decides to blatantly violate the Privacy Shield guarantees and you have to treat it as a breach. [0]: https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/adequacy-protection-personal-data-non-eu-countries_en https://ec.europa.eu/info/law/law-topic/data-protection/data...
- jhall1468 8y ago
  The US is an enormous market. You could easily be a multi-billion dollar company without having a single presence in the EU. Hell you don't even have to stay in the US market, since Asia is a thing. Calling it a "backyard" is disingenuous. Most companies are going to follow this because they have global aspirations, but that doesn't mean it's impossible... or even all that hard.

bausshf 8y ago

They can.

daxorid 8y ago
Care to elaborate? In which US court does the EU have standing to bring suit against a US citizen or corporation for violation of regulations the US does not recognize by either law or treaty?
- jhall1468 8y ago
  Yeah, you aren't going to get what you asked for. There are no civil enforcement agreements between the EU and the US so they can do exactly nothing.
  - bausshf 8y ago
    https://politics.stackexchange.com/questions/30509/how-are-gdpr-fines-actually-enforced-for-us-companies-with-no-physical-presence https://politics.stackexchange.com/questions/30509/how-are-g...

deleted 8y ago

[deleted]

krageon 8y ago

You are wrong. This is a misconception that has thankfully died down a bit over the past week or so, but apparently it is still a bit alive. There are accords in place between (for example) the US and the EU, which allows the EU to hand out fines overseas. The reverse is also true (the US can and does litigate in the EU).

jhall1468 8y ago
Show me case law where an EU government fined a US company and how they enforced payment of that fine.
- eatbitseveryday 8y ago
  https://en.m.wikipedia.org/wiki/Microsoft_Corp_v_Commission https://en.m.wikipedia.org/wiki/Microsoft_Corp_v_Commission
  - jhall1468 8y ago
    That's not an example of what I asked for. Microsoft had offices in the EU when this case started, which made them an EU company for all intents and purposes.
- krageon 8y ago
  When did I mention case law? Shouldn't you be asking me for proof of the accords I mentioned, which is what I'm actually talking about?
  - jhall1468 8y ago
    I asked for case law because that would give me evidence that this actually happened. That's because it can't happen. That's because you're dead wrong: https://community.spiceworks.com/topic/2007530-how-the-eu-can-fine-us-companies-for-violating-gdpr https://community.spiceworks.com/topic/2007530-how-the-eu-ca... "While we don’t yet have U.S.-EU negotiated civil enforcement mechanisms for the GDPR (and it is unknown whether we ever will), there is still the application of international law and potential cooperation agreements between U.S. and EU law enforcement agencies, which have been increasing in recent years." That's politician for "We have absolutely no recourse if the company doesn't have an established business in the EU." EDIT: That's a nice article. It goes to explain that if a company has no presence in the EU, it has to identify an agent in the EU to act on its behalf. So any company can simply NOT do this if they never intend to have EU offices and the EU has no recourse.

pluma 8y ago

FWIW while you're right, that's awfully shortsighted unless you're a mom & pop shop with no intent of ever expanding beyond your backyard. A lot of devs hanging out on HN are working for companies that have at least some B2B aspect. Being GDPR non-compliant means these companies will have to avoid you too, because even if they're themselves not affected by GDPR they may have customers who are and need the compliance to be able to do business with those customers. But that said, as an EU company, US companies are only an option if they're Privacy Shield certified and offer a Data Processing Agreement. And even then it's safer to go for a company in the EU or in an "adequate"[0] country. You don't want to be caught unaware when some court or orange person decides to blatantly violate the Privacy Shield guarantees and you have to treat it as a breach. [0]: https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/adequacy-protection-personal-data-non-eu-countries_en https://ec.europa.eu/info/law/law-topic/data-protection/data...

jhall1468 8y ago
The US is an enormous market. You could easily be a multi-billion dollar company without having a single presence in the EU. Hell you don't even have to stay in the US market, since Asia is a thing. Calling it a "backyard" is disingenuous. Most companies are going to follow this because they have global aspirations, but that doesn't mean it's impossible... or even all that hard.