6 ms·

I simply don't understand how or why a law that has scope in the EU is causing trouble for companies which conduct no business in the EU beyond responding to HT

by shiado 8y ago

I simply don't understand how or why a law that has scope in the EU is causing trouble for companies which conduct no business in the EU beyond responding to HTTP requests on a global decentralized telecommunications network. Why would an American internet business which conducts no operations in Europe and has no servers in Europe be subject to regulation that affects the EU? What is going to happen? Is the EU going to target American banks of American businesses and try to extract fines? Is the EU going to extradite owners of these businesses? Are EU courts going to issue default judgements on businesses and individuals?

taf2 8y ago
yup, maybe, probably not... we'll find out
jacquesm 8y ago
> Is the EU going to target American banks of American businesses and try to extract fines? You mean like America? That time when the USA decided to enforce their embargo against Cuba by intercepting a payment from one of the Nordics for a bunch of Cuban cigars? No, that's unlikely. > Is the EU going to extradite owners of these businesses? Extremely unlikely, besides that would require the cooperation of the other country. But - and this is interesting - the other countries typically expect the EU to cooperate with extraditions when the law is broken and we do. So who knows. > Are EU courts going to issue default judgements on businesses and individuals? Against individuals: Unlikely, but it could happen, against businesses, that's typically how things go when one party doesn't show up. But note that for that to happen you first have to ignore the regulators for long enough to get them really pissed off, an action I would recommend against.
- emodendroket 8y ago
  There are plenty more examples of the US twisting Europe's arm. Currently it's looking like that is the plan for Iran.
  - s2g 8y ago
    I hope not. They really need to tell the US to go to hell on that front. Pissing away a deal that is seemingly working because Trump got made fun of by Obama.
    - mschuster91 8y ago
      > They really need to tell the US to go to hell on that front. Would be easier if Europe had a coherent voice. You got the former Eastern Bloc countries desperately clinging to the US (because they, rightfully, fear that Putin will screw them over), you got the UK which is trying to not fall apart due to Brexit, France is... France and Merkel is trying to prevent the worst of the shitshow, even though she's miserably failing at that (and under heavy pressure from the AfD nazis and her own sister party which is openly copying the nazis). In addition, Europe is so damn far behind the US when it comes to military power - jeez, German army is practicing tank shooters with broomsticks as munition, the NH90 marine helicopters are not allowed to fly over water and we all know what a fuckfest the A400M is. No money, no competence, but it wasn't a problem since WW2 as the USA had always covered the EU... now that Trump is, well, being Trump the EU has yet another giant problem to tackle.
      - Doctor_Fegg 8y ago
        > Europe is so damn far behind the US when it comes to military power As a European, I consider this a good thing.
        s2g 8y ago
        As a Canadian I'm fine with my country being behind too. Would like more spending to make sure soldiers don't die due to shitty equipment, but still largely fine.
        mschuster91 8y ago
        > As a European, I consider this a good thing. I am ideologically more aligned to pacifism, the problem is that it does not work in a world of wannabe highschool bullies (USA, China, Russia, Iran, Saudi-Arabia, Qatar) vying for regional dominance. Europe is so damn powerless and underfunded that we cannot even ensure that basic human rights are respected in conflict areas. On a bully stage, the tiny kid will always be the one that's bullied. No matter how economically powerful the EU is.
- falcon620 8y ago
  Jacques - I love the effort you've put into explaining the GDPR to clueless and needlessly exasperated (mostly) americans here on HN. To be honest I used to think you were just a shameless self-promoter like almost everyone else, but in this case you've risen to the occasion. Bravo. I think you're now rating quite high in most people's "mental books of good people". Or at the very least, in the minds of people who actually have a strong impact.
  - hueving 8y ago
    >clueless and needlessly exasperated (mostly) americans I'd love to see the dataset you have access to backing up any of that statement. It must be fascinating.
    - jacquesm 8y ago
      > I'd love to see the dataset you have access to backing up any of that statement. That would make you a sub-processor.
      - falcon620 8y ago
        Hehe.
- nostromo 8y ago
  > You mean like America? Yes, like America. This may shock you, but America isn't always right.
  - fao_ 8y ago
    > Yes, like America. This may shock you, but America isn't always right. That was exactly your parent's point?
    - hueving 8y ago
      So whataboutism is a valid justification to continue the practice?
      - __s 8y ago
        They're arguing that US companies are afraid of the EU behaving like the US, & then asserting that the EU will not behave like the US
      - jessaustin 8y ago
        It's always wrong to be the first in the thread to invoke "whataboutism".
  - HumanDrivenDev 8y ago
    Exactly. It's possible to criticise what the EU are doing without thinking the United States does everything right - or even that it does it better. Disappointing to see so many EU apologists defaulting to whataboutism.
- davesque 8y ago
  > You mean like America? Ahh yes, one of my favorite logical fallacies: https://en.wikipedia.org/wiki/Tu_quoque https://en.wikipedia.org/wiki/Tu_quoque
  - speakeron 8y ago
    Tu quoque is not a logical fallacy. There's no logical step that's violated. It's an informal fallacy.
    - davesque 8y ago
      Technically, yes. It's an informal logical fallacy. The point is that it's a pretty ineffective means of advancing the discussion.
    - hueving 8y ago
      Right FTA: it's an "informal logical fallacy.
  - orwin 8y ago
    But since the answer is no, is this still a fallacy?
  - CapacitorSet 8y ago
    It's not being used as a fallacy, since it's not part of an argument that proves a point.
    - davesque 8y ago
      I don't follow you. My interpretation was that OP said roughly, "I don't understand/approve of GDPR because of this and this." Child then responded by saying roughly, "but America does it too." Seems like the child was trying to imply that OP's claims/concerns are false because they are hypocritical.
      - orwin 8y ago
- jbfoo 8y ago
  >> Are EU courts going to issue default judgements on businesses and individuals? > Against individuals: Unlikely, but it could happen AFAIK IANAL: GDPR doesn't apply to individuals that e.g. host mastodon instance.
  - jacquesm 8y ago
    Agreed, but execs of companies violating the law are also individuals, and those were the individuals I had in mind.
    - weinzierl 8y ago
      > GDPR doesn't apply to individuals >> Agreed Not a lawyer too, but I'm interested what makes you (and jbfoo) believe that it doesn't apply to individuals. It's a EU regulation it should apply to natural and legal persons. Ok, it has an exception for the processing of data by natural persons in the course of a purely personal or household activity but that doesn't mean it doesn't apply to individuals in general.
      - jacquesm 8y ago
        > Ok, it has an exception for the processing of data by natural persons in the course of a purely personal or household activity but that doesn't mean it doesn't apply to individuals in general. If you set up a service that operates in the same way as a similar service would operate if it were done by a business then I suspect that you being a private individual is not going to be much protection, after all you are effectively roughly in the same situation as a sole proprietor business minus the incorporation. If you process data for family and friends then that would most likely be enough to trigger the exception. So the dividing line in the case of a Mastodon server would likely be whether or not you allow total strangers to make use of the service and whether or not you respect their rights.
  - ldjb 8y ago
    It's true that the GDPR has exemptions for "personal or household activity". Ideally, this should apply to non-commercial Mastodon instances. However, some non-commercial Mastodon instances are now supporting thousands of users. An argument could be made that operating such instances is no longer a "personal or household activity". Whilst I would hope that the local data protection agency would side with the Mastodon instance operator, it does put them in a rather difficult situation. I think this possibility raises a lot of concern for operators of Mastodon instances and other online services.
- guelo 8y ago
  > You mean like America? I get the impression that a big part of the motivation for GDPR is this type of resentment against America.
  - dlisboa 8y ago
    The companies that are most guilty of mishandling personal user data are American companies. If it could not apply to them in protection of EU citizens any regulation would be useless.
    - chernobogdan 8y ago
      Thats because the EU has no tech giants. If Facebook was german there's no way that GDPR would of passed.
- seanmcdirmid 8y ago
  That makes me wonder: what about wechat? Surely Tencent has many overseas Chinese users in Europe, and I’m sure they play as or more aggressively as the American majors. Is Europe going to sanction Chinese companies for violations along with American ones?
  - NeutronStar 8y ago
    Facebook is legally an Ireland company FYI.
    - seanmcdirmid 8y ago
      Facebook is most definitely American even if their European subsidiary is based in Ireland. That is all moot under the law anyways, as they consider global revenue of any parent company, not just that of the subsidiary.
downandout 8y ago
Recital 23 [1] of the GDPR excludes most US-based businesses from compliance with GDPR. It essentially says that sites that don’t “envisage” (their word) offering services in the EU are in fact not offering services there for the purposes of the GDPR and are thus are not subject to it. It also explicitly states that the mere accessibility of a foreign-based website from within the EU does not by itself subject the site to GDPR. So while blocking the EU isn’t required, the other tests they use to determine whether or not you intended to offer services to EU residents are a bit murky. In light of that, what better way is there to make your intention to not serve EU users clear to all than to block EU users? That’s the main reason to do it. This kind of blockade will not prevent all EU users from accessing your site, but it doesn’t matter. You’ll have made your intent to not serve EU users clear, which will preserve your immunity to GDPR. [1] http://www.privacy-regulation.eu/en/recital-23-GDPR.htm http://www.privacy-regulation.eu/en/recital-23-GDPR.htm
- johannes1234321 8y ago
  A point with many sites is that they use ad networks and those ad networks send localized ads to Europeans, thus the site targets (or "envisages") Europeans. Even if the actual content is about quite local things.
  - downandout 8y ago
    In my personal opinion, that would be both a stretch of this recital and an abusive use of the GDPR. You don’t control what ads are shown to anyone because they are served by a third party, and you have a good faith belief that you are not subject to GDPR under Recital 23. My guess is that if you used an ad network that specialized in EU ads, you’d be subject to it. But using code from a US ad network that may have some EU advertisers now or in the future shouldn’t expose you. But I don’t disagree that some EU countries that intend to abuse the GDPR for the purpose of generating massive amounts of revenue from fines may try to make this kind of claim. One of the problems with GDPR is that when you combine unclear regulation with the lack of moral hazard that government agencies enjoy and the financial incentive of massive fines, you create a monster that will constantly seek to expand who and what is covered under it.
mhw 8y ago
Read up on FATCA (https://en.m.wikipedia.org/wiki/Foreign_Account_Tax_Compliance_Act https://en.m.wikipedia.org/wiki/Foreign_Account_Tax_Complian...) before you argue further down that path. The US already has extraterritorial laws that have to be enforced by banks worldwide that don’t operate in the US.
- orangecat 8y ago
  Yes, and that sucks. Adding more overly broad extraterritorial laws is going in the wrong direction. Note that a common response by foreign banks to FATCA is to refuse to do business with Americans, which is very likely the best course of action. So it shouldn't be surprising when companies take similar precautions because of GDPR.
- taysic 8y ago
  There seems to be a big difference between enforcing a law on all financial institutions and enforcing a law on all websites basically that serve the EU. The latter seems next to impossible to enforce.
- seanmcdirmid 8y ago
  FACTA is why banks refuse US citizen or PR customers.
glibgil 8y ago
Yes, this is the way the law, prosecution and judgement works. If you violate GDPR and the EU prosecutes you and you don't even show up to court and there is judgement against you and you are fined, the EU can try to get paid from your bank. That's how law, prosecution and judgement work in America too. How else would it work? Why would anyone obey any regulation or ever show up to court otherwise? That being said, the starting point shouldn't be, "there's no need to imagine that I'm violating GDPR. I only serve Americans". The starting point should be, "I had better imagine that I might be violating GDPR even though I only intend to serve Americans. Are there things I haven't considered? Are there resources I should seek out? As a service provider of some kind, hadn't I better spend a day or two imagining the ways I might run into trouble and plan to avoid it?"
- icebraining 8y ago
  Playing Devil's advocate, there are 193 countries in the UN; is it reasonable to ask site owners to keep abreast of the Internet laws passed in each one, and spend a couple of days for each, even if you just serve your compatriots? I'm biased for the GDPR, since I think every site should follow its principles regardless of legal obligation, but I don't think the rationale you're proposing is scalable.
  - vbezhenar 8y ago
    Laws are made with physical borders in mind. Digital world doesn't have those borders. But it seems that politicians are expecting those borders to work. I'm not even sure about sane way to map IP address to country. There are some geolocation services, but I doubt that they are 100% precise and probably paid. Also if I'm using geolocation service passing IP of the incoming request, does that mean that I'm already violated someone's privacy? This is weird.
    - mirimir 8y ago
      With IPv4 stretched thin, there's a lot of international trade, even of small blocks. Also, multihomed servers can announce IPv4 from one ASN on another ASN, given permission. Anyway, it's nontrivial to really know where an IPv4 is located.
lima 8y ago
As long as you're just "responding to HTTP requests", there's nothing to worry about and the GDPR does not apply. It's when you start collecting personal data on EU residents, send their personal data to third parties for analytics/targeted advertising, and so on, that things get interesting.
- zmmmmm 8y ago
  I can't think of any web server that doesn't log ip addresses by default, and I think it's been established that satisfies the GDPR threshold test for personal data. So while what you say is true, I think you're being a little bit deceptive when you say 'As long as you're just "responding to HTTP requests"' because all practical and established means of doing that violate the GDPR by default.
  - progre 8y ago
    So hash the IP before you log. Now it cant be traced to a user and you are GDPR compliant. Its really not that hard.
    - weirdkid 8y ago
      What's the setting in httpd.conf for that?
      - gerdesj 8y ago
        Post process the bloody logfile on a regular basis. You can legitimately capture IPs etc for a while, provided that it is for a good reason - fixing a problem, or gathering aggregate trends but not for direct marketing reasons against individuals who have not given consent. So, your logrotate.d/ might get a few post/pre rotate scripts, if it really bothers you. I run a small UK based IT firm. So far I've turned down some of the logging on my HA Proxy instances and stopped logging IPs and user agents in general and a few other things. If I need to do some diags then I'll turn them on again. That's on the long term stored logs (due to backups). So far, my backups are smaller 8) I do keep very detailed logs with IPs (actually full packet capture) in the ES cluster for IDS purposes but those are turned over (deleted) within a few hours. Less detailed logs last a lot longer.
emodendroket 8y ago
Well, if you don't serve European customers, it doesn't.
manigandham 8y ago
The fact that the regulation is so vague around it in the first place is the whole problem. There are dozens of conflicting statements (from law firms, no less) about what exactly exposes you to GDPR.
- johannes1234321 8y ago
  ... which in part isn't since that law is that complicated, but buy law firms and consultancies looking for customers.
  - manigandham 8y ago
    Companies aren't that dumb, and law firms can't lie either so those conflicting articles show just how much interpretation is involved.
- phyzome 8y ago
  You should be glad that it's so vague. The alternative is a law that lays out technical details of how you handle information, and no one wants that.
zenovision 8y ago
EU will not be able to enforce GDPR law in other countries, unless company has a subsidiary in the EU. Otherwise any country in the world can create their laws and expect that anyone in the world following them.
- danieltillett 8y ago
  Unfortunately that horse has already left the barn. Have a look at the USA's FATCA law or any of their sanction laws against countries like Cuba or Iran.
vbezhenar 8y ago
Fun fact: Russia recently approved similar law which requires all personal data of Russian citizens to be stored in a server hosted in Russia. So theoretically many webmasters are already be in trouble :)
- saagarjha 8y ago
  > Russia recently approved similar law which requires all personal data of Russian citizens to be stored in a server hosted in Russia I wouldn't call that a similar law at all, because the spirit of it is so that the government can have access to that data…
  - HumanDrivenDev 8y ago
    Oh are European governments and intelligence agencies going to follow the GDPR as well?
  - vbezhenar 8y ago
    It's similar in the sense that government dictates how foreign companies can deal with personal data of its citizens. I agree that purpose seems to be different.
Jeema101 8y ago
It's because: A) The law seems to extend beyond the borders of the EU. B) It's extremely long and vague, doesn't really offer a lot of actionable advice, and nobody outside of privacy lawyers seems to really understand it fully. C) The penalties are harsh. Further muddying the waters, the EU and US already have some existing bilateral agreements with respect to data privacy [1], but does the GDPR supersede or unilaterally invalidate these...? Who knows? [1] https://en.wikipedia.org/wiki/EU%E2%80%93US_Privacy_Shield https://en.wikipedia.org/wiki/EU%E2%80%93US_Privacy_Shield
- olivierduval 8y ago
  GDPR is far stronger that Privacy Shield... so you can't use that
- chernobogdan 8y ago
  > The law seems to extend beyond the borders of the EU. Hi guys, It's Kim from the Best Korea, and we just decided that we are going to allow our people to access the Internet. There is a tiny little thing though, our internet policy stipulates that for every traffic hit to sites outside our borders, the country of origin either donates 1 nuke or if it doesn't have nukes an item of great value, or a 24 hour TV broadcast featuring me.
- gerdesj 8y ago
  You haven't actually read any of it have you? A) It covers behaviour towards the citizens (ie passport carrying members) of the EU. It basically says: "please do not be evil" - OK it says a lot more but I think you get the idea. B) It does cover a lot of ground but it is written in pretty accessible language for such a large and complex subject. C) The possible maximum penalties are set at a level that will not destroy a serial transgressor but should hopefully deter anyone from becoming such a beast in the first place. Overall, GDPR is really a manifesto for how people should be treated in the burgeoning data economy. I still find it hard to understand how such a reasonable and farsighted set of regs came to be designed in the first place. As a citizen of the UK, at least I am reasonably certain that the GDPR will stay on the local statute books post Brexit because to contemplate otherwise is economic suicide.
rightos 8y ago
I'm wondering this too actually, I run a small business, we collect only the bare minimum of information from our customers but we do have some European customers. I'm ignoring GDPR completely, is there any downside for me? Will they block customers from using my service? Will they sieze my European cloud servers? Or can I safely do nothing as I currently am because I don't reside or have a registered business in Europe?
- phyzome 8y ago
  You're probably fine. If you have a lawful basis for collecting the information, you're only passing it along to others as necessary to provide your service to your customers, the customers have clearly consented, and you employ reasonable protection of that data... it's extremely unlikely that you're in violation. And if you were, they'd come to you first with a warning (at least based on past behavior). They're not going to seize assets unless you seriously provoke them.
- orwin 8y ago
  You have two solution: 1: ignore GDPR, you'll probably fly under. And if you dont, fine are scaled for business and people affected, as well as privacy infraction. Encrypt your backups, encrypt PII if you can do it effortlessly, and you're good. If you are not using emails except for checking double inscription, encrypt them too, the entropy is low BUT this is better than nothing . 2: If you have some time and money to spend to try to improve your services: self-report. A public agent will point you the weakness of your data processing.
  - rightos 8y ago
    Is there some way they can fine me with me being in a country completely and totally unrelated to the EU?
    - deleted 8y ago
      [deleted]
    - _rpd 8y ago
SJetKaran 8y ago
Not directly related, but see FATCA. Because of a US law, individuals in many countries who don't deal with US securities/markets, have to fill a form saying they don't have any direct investments in US, or that they are not a citizen/resident of US.
- HumanDrivenDev 8y ago
  Interesting that the end result was the same - block people from the country using their services.
Msurrow 8y ago
Well thats because you dont understand GDPR. If the company doesnt conduct any business in EU - or more correctly with EU private persones - then GDPR doesnt apply to the company. It also doesnt apply for any Business-2-business relations. GDPR only applies if you are providing a service to a EU citizen. That also explains what EU will do if a company doesnt comply with GDPR (where it should); they will stop the company from providing those services to the EU citizen. This is also why blocking EU traffic doesnt make you GDPR compliant (I can use a vpn or visit your site when travelling, and then you are still providing a service to a EU citizen). If the case really is as you say, with just serving http request, then you have no issue with being GDPR compliant, because you dont store and information about the EU citizen. If however you are not just serving http requests, but track the user or otherwise store information on the site visitor, then you may have GDPR issues. But if you do store data about your users, you really should treat the data correctly. GDPR is common sense, and if you bother to understand it correctly, its fairly easy to be compliant. Though I’d say, the bigger the company the more complex the implementation.
- mychael 8y ago
  You're mistaking GDPR's intent with its implementation, an error that lots of people are making. As Americans we're particularly sensitive about having to follow rules made by people who don't represent us and are not accountable to us. This is a totally fair and justifiable reason to be against GDPR even if you agree with its objectives.
  - Msurrow 8y ago
    “As Americans we’re particularly sensitive about having to follow rules made by [others]” That may be one of the most ironic comments I’ve ever heard. I love americans, but as a super power you stick your nose into so many other countries business, directly or indirectly. So, lets just say that argument is not gonna change my view in any way. I don’t think I am mistaking intent with implementation. The regulation’s written text leavea many details to be answered along the way and the first couple of rulings on GDPR will (hopefully) bring us a lot of insigts into how to interpret and implement GDPR in practice. So I guess no one really knows the implementation yet. Until then we have to go by what is reasonable and the intent. And if you store data on private citizens you better treat it correctly.

by shiado 8y ago

taf2 8y ago

yup, maybe, probably not... we'll find out

jacquesm 8y ago

> Is the EU going to target American banks of American businesses and try to extract fines? You mean like America? That time when the USA decided to enforce their embargo against Cuba by intercepting a payment from one of the Nordics for a bunch of Cuban cigars? No, that's unlikely. > Is the EU going to extradite owners of these businesses? Extremely unlikely, besides that would require the cooperation of the other country. But - and this is interesting - the other countries typically expect the EU to cooperate with extraditions when the law is broken and we do. So who knows. > Are EU courts going to issue default judgements on businesses and individuals? Against individuals: Unlikely, but it could happen, against businesses, that's typically how things go when one party doesn't show up. But note that for that to happen you first have to ignore the regulators for long enough to get them really pissed off, an action I would recommend against.

emodendroket 8y ago
There are plenty more examples of the US twisting Europe's arm. Currently it's looking like that is the plan for Iran.
- s2g 8y ago
  I hope not. They really need to tell the US to go to hell on that front. Pissing away a deal that is seemingly working because Trump got made fun of by Obama.
  - mschuster91 8y ago
    > They really need to tell the US to go to hell on that front. Would be easier if Europe had a coherent voice. You got the former Eastern Bloc countries desperately clinging to the US (because they, rightfully, fear that Putin will screw them over), you got the UK which is trying to not fall apart due to Brexit, France is... France and Merkel is trying to prevent the worst of the shitshow, even though she's miserably failing at that (and under heavy pressure from the AfD nazis and her own sister party which is openly copying the nazis). In addition, Europe is so damn far behind the US when it comes to military power - jeez, German army is practicing tank shooters with broomsticks as munition, the NH90 marine helicopters are not allowed to fly over water and we all know what a fuckfest the A400M is. No money, no competence, but it wasn't a problem since WW2 as the USA had always covered the EU... now that Trump is, well, being Trump the EU has yet another giant problem to tackle.
    - Doctor_Fegg 8y ago
      > Europe is so damn far behind the US when it comes to military power As a European, I consider this a good thing.
      - s2g 8y ago
        As a Canadian I'm fine with my country being behind too. Would like more spending to make sure soldiers don't die due to shitty equipment, but still largely fine.
      - mschuster91 8y ago
        > As a European, I consider this a good thing. I am ideologically more aligned to pacifism, the problem is that it does not work in a world of wannabe highschool bullies (USA, China, Russia, Iran, Saudi-Arabia, Qatar) vying for regional dominance. Europe is so damn powerless and underfunded that we cannot even ensure that basic human rights are respected in conflict areas. On a bully stage, the tiny kid will always be the one that's bullied. No matter how economically powerful the EU is.
falcon620 8y ago
Jacques - I love the effort you've put into explaining the GDPR to clueless and needlessly exasperated (mostly) americans here on HN. To be honest I used to think you were just a shameless self-promoter like almost everyone else, but in this case you've risen to the occasion. Bravo. I think you're now rating quite high in most people's "mental books of good people". Or at the very least, in the minds of people who actually have a strong impact.
- hueving 8y ago
  >clueless and needlessly exasperated (mostly) americans I'd love to see the dataset you have access to backing up any of that statement. It must be fascinating.
  - jacquesm 8y ago
    > I'd love to see the dataset you have access to backing up any of that statement. That would make you a sub-processor.
    - falcon620 8y ago
      Hehe.
nostromo 8y ago
> You mean like America? Yes, like America. This may shock you, but America isn't always right.
- fao_ 8y ago
  > Yes, like America. This may shock you, but America isn't always right. That was exactly your parent's point?
  - hueving 8y ago
    So whataboutism is a valid justification to continue the practice?
    - __s 8y ago
      They're arguing that US companies are afraid of the EU behaving like the US, & then asserting that the EU will not behave like the US
    - jessaustin 8y ago
      It's always wrong to be the first in the thread to invoke "whataboutism".
- HumanDrivenDev 8y ago
  Exactly. It's possible to criticise what the EU are doing without thinking the United States does everything right - or even that it does it better. Disappointing to see so many EU apologists defaulting to whataboutism.
davesque 8y ago
> You mean like America? Ahh yes, one of my favorite logical fallacies: https://en.wikipedia.org/wiki/Tu_quoque https://en.wikipedia.org/wiki/Tu_quoque
- speakeron 8y ago
  Tu quoque is not a logical fallacy. There's no logical step that's violated. It's an informal fallacy.
  - davesque 8y ago
    Technically, yes. It's an informal logical fallacy. The point is that it's a pretty ineffective means of advancing the discussion.
  - hueving 8y ago
    Right FTA: it's an "informal logical fallacy.
- orwin 8y ago
  But since the answer is no, is this still a fallacy?
- CapacitorSet 8y ago
  It's not being used as a fallacy, since it's not part of an argument that proves a point.
  - davesque 8y ago
    I don't follow you. My interpretation was that OP said roughly, "I don't understand/approve of GDPR because of this and this." Child then responded by saying roughly, "but America does it too." Seems like the child was trying to imply that OP's claims/concerns are false because they are hypocritical.
    - orwin 8y ago
jbfoo 8y ago
>> Are EU courts going to issue default judgements on businesses and individuals? > Against individuals: Unlikely, but it could happen AFAIK IANAL: GDPR doesn't apply to individuals that e.g. host mastodon instance.
- jacquesm 8y ago
  Agreed, but execs of companies violating the law are also individuals, and those were the individuals I had in mind.
  - weinzierl 8y ago
    > GDPR doesn't apply to individuals >> Agreed Not a lawyer too, but I'm interested what makes you (and jbfoo) believe that it doesn't apply to individuals. It's a EU regulation it should apply to natural and legal persons. Ok, it has an exception for the processing of data by natural persons in the course of a purely personal or household activity but that doesn't mean it doesn't apply to individuals in general.
    - jacquesm 8y ago
      > Ok, it has an exception for the processing of data by natural persons in the course of a purely personal or household activity but that doesn't mean it doesn't apply to individuals in general. If you set up a service that operates in the same way as a similar service would operate if it were done by a business then I suspect that you being a private individual is not going to be much protection, after all you are effectively roughly in the same situation as a sole proprietor business minus the incorporation. If you process data for family and friends then that would most likely be enough to trigger the exception. So the dividing line in the case of a Mastodon server would likely be whether or not you allow total strangers to make use of the service and whether or not you respect their rights.
- ldjb 8y ago
  It's true that the GDPR has exemptions for "personal or household activity". Ideally, this should apply to non-commercial Mastodon instances. However, some non-commercial Mastodon instances are now supporting thousands of users. An argument could be made that operating such instances is no longer a "personal or household activity". Whilst I would hope that the local data protection agency would side with the Mastodon instance operator, it does put them in a rather difficult situation. I think this possibility raises a lot of concern for operators of Mastodon instances and other online services.
guelo 8y ago
> You mean like America? I get the impression that a big part of the motivation for GDPR is this type of resentment against America.
- dlisboa 8y ago
  The companies that are most guilty of mishandling personal user data are American companies. If it could not apply to them in protection of EU citizens any regulation would be useless.
  - chernobogdan 8y ago
    Thats because the EU has no tech giants. If Facebook was german there's no way that GDPR would of passed.
seanmcdirmid 8y ago
That makes me wonder: what about wechat? Surely Tencent has many overseas Chinese users in Europe, and I’m sure they play as or more aggressively as the American majors. Is Europe going to sanction Chinese companies for violations along with American ones?
- NeutronStar 8y ago
  Facebook is legally an Ireland company FYI.
  - seanmcdirmid 8y ago
    Facebook is most definitely American even if their European subsidiary is based in Ireland. That is all moot under the law anyways, as they consider global revenue of any parent company, not just that of the subsidiary.

downandout 8y ago

Recital 23 [1] of the GDPR excludes most US-based businesses from compliance with GDPR. It essentially says that sites that don’t “envisage” (their word) offering services in the EU are in fact not offering services there for the purposes of the GDPR and are thus are not subject to it. It also explicitly states that the mere accessibility of a foreign-based website from within the EU does not by itself subject the site to GDPR. So while blocking the EU isn’t required, the other tests they use to determine whether or not you intended to offer services to EU residents are a bit murky. In light of that, what better way is there to make your intention to not serve EU users clear to all than to block EU users? That’s the main reason to do it. This kind of blockade will not prevent all EU users from accessing your site, but it doesn’t matter. You’ll have made your intent to not serve EU users clear, which will preserve your immunity to GDPR. [1] http://www.privacy-regulation.eu/en/recital-23-GDPR.htm http://www.privacy-regulation.eu/en/recital-23-GDPR.htm

johannes1234321 8y ago
A point with many sites is that they use ad networks and those ad networks send localized ads to Europeans, thus the site targets (or "envisages") Europeans. Even if the actual content is about quite local things.
- downandout 8y ago
  In my personal opinion, that would be both a stretch of this recital and an abusive use of the GDPR. You don’t control what ads are shown to anyone because they are served by a third party, and you have a good faith belief that you are not subject to GDPR under Recital 23. My guess is that if you used an ad network that specialized in EU ads, you’d be subject to it. But using code from a US ad network that may have some EU advertisers now or in the future shouldn’t expose you. But I don’t disagree that some EU countries that intend to abuse the GDPR for the purpose of generating massive amounts of revenue from fines may try to make this kind of claim. One of the problems with GDPR is that when you combine unclear regulation with the lack of moral hazard that government agencies enjoy and the financial incentive of massive fines, you create a monster that will constantly seek to expand who and what is covered under it.

mhw 8y ago

Read up on FATCA (https://en.m.wikipedia.org/wiki/Foreign_Account_Tax_Compliance_Act https://en.m.wikipedia.org/wiki/Foreign_Account_Tax_Complian...) before you argue further down that path. The US already has extraterritorial laws that have to be enforced by banks worldwide that don’t operate in the US.

orangecat 8y ago
Yes, and that sucks. Adding more overly broad extraterritorial laws is going in the wrong direction. Note that a common response by foreign banks to FATCA is to refuse to do business with Americans, which is very likely the best course of action. So it shouldn't be surprising when companies take similar precautions because of GDPR.
taysic 8y ago
There seems to be a big difference between enforcing a law on all financial institutions and enforcing a law on all websites basically that serve the EU. The latter seems next to impossible to enforce.
seanmcdirmid 8y ago
FACTA is why banks refuse US citizen or PR customers.

glibgil 8y ago

Yes, this is the way the law, prosecution and judgement works. If you violate GDPR and the EU prosecutes you and you don't even show up to court and there is judgement against you and you are fined, the EU can try to get paid from your bank. That's how law, prosecution and judgement work in America too. How else would it work? Why would anyone obey any regulation or ever show up to court otherwise? That being said, the starting point shouldn't be, "there's no need to imagine that I'm violating GDPR. I only serve Americans". The starting point should be, "I had better imagine that I might be violating GDPR even though I only intend to serve Americans. Are there things I haven't considered? Are there resources I should seek out? As a service provider of some kind, hadn't I better spend a day or two imagining the ways I might run into trouble and plan to avoid it?"

icebraining 8y ago
Playing Devil's advocate, there are 193 countries in the UN; is it reasonable to ask site owners to keep abreast of the Internet laws passed in each one, and spend a couple of days for each, even if you just serve your compatriots? I'm biased for the GDPR, since I think every site should follow its principles regardless of legal obligation, but I don't think the rationale you're proposing is scalable.
- vbezhenar 8y ago
  Laws are made with physical borders in mind. Digital world doesn't have those borders. But it seems that politicians are expecting those borders to work. I'm not even sure about sane way to map IP address to country. There are some geolocation services, but I doubt that they are 100% precise and probably paid. Also if I'm using geolocation service passing IP of the incoming request, does that mean that I'm already violated someone's privacy? This is weird.
  - mirimir 8y ago
    With IPv4 stretched thin, there's a lot of international trade, even of small blocks. Also, multihomed servers can announce IPv4 from one ASN on another ASN, given permission. Anyway, it's nontrivial to really know where an IPv4 is located.

lima 8y ago

As long as you're just "responding to HTTP requests", there's nothing to worry about and the GDPR does not apply. It's when you start collecting personal data on EU residents, send their personal data to third parties for analytics/targeted advertising, and so on, that things get interesting.

zmmmmm 8y ago
I can't think of any web server that doesn't log ip addresses by default, and I think it's been established that satisfies the GDPR threshold test for personal data. So while what you say is true, I think you're being a little bit deceptive when you say 'As long as you're just "responding to HTTP requests"' because all practical and established means of doing that violate the GDPR by default.
- progre 8y ago
  So hash the IP before you log. Now it cant be traced to a user and you are GDPR compliant. Its really not that hard.
  - weirdkid 8y ago
    What's the setting in httpd.conf for that?
    - gerdesj 8y ago
      Post process the bloody logfile on a regular basis. You can legitimately capture IPs etc for a while, provided that it is for a good reason - fixing a problem, or gathering aggregate trends but not for direct marketing reasons against individuals who have not given consent. So, your logrotate.d/ might get a few post/pre rotate scripts, if it really bothers you. I run a small UK based IT firm. So far I've turned down some of the logging on my HA Proxy instances and stopped logging IPs and user agents in general and a few other things. If I need to do some diags then I'll turn them on again. That's on the long term stored logs (due to backups). So far, my backups are smaller 8) I do keep very detailed logs with IPs (actually full packet capture) in the ES cluster for IDS purposes but those are turned over (deleted) within a few hours. Less detailed logs last a lot longer.

emodendroket 8y ago

Well, if you don't serve European customers, it doesn't.

manigandham 8y ago

The fact that the regulation is so vague around it in the first place is the whole problem. There are dozens of conflicting statements (from law firms, no less) about what exactly exposes you to GDPR.

johannes1234321 8y ago
... which in part isn't since that law is that complicated, but buy law firms and consultancies looking for customers.
- manigandham 8y ago
  Companies aren't that dumb, and law firms can't lie either so those conflicting articles show just how much interpretation is involved.
phyzome 8y ago
You should be glad that it's so vague. The alternative is a law that lays out technical details of how you handle information, and no one wants that.

zenovision 8y ago

EU will not be able to enforce GDPR law in other countries, unless company has a subsidiary in the EU. Otherwise any country in the world can create their laws and expect that anyone in the world following them.

danieltillett 8y ago
Unfortunately that horse has already left the barn. Have a look at the USA's FATCA law or any of their sanction laws against countries like Cuba or Iran.

vbezhenar 8y ago

Fun fact: Russia recently approved similar law which requires all personal data of Russian citizens to be stored in a server hosted in Russia. So theoretically many webmasters are already be in trouble :)

saagarjha 8y ago
> Russia recently approved similar law which requires all personal data of Russian citizens to be stored in a server hosted in Russia I wouldn't call that a similar law at all, because the spirit of it is so that the government can have access to that data…
- HumanDrivenDev 8y ago
  Oh are European governments and intelligence agencies going to follow the GDPR as well?
- vbezhenar 8y ago
  It's similar in the sense that government dictates how foreign companies can deal with personal data of its citizens. I agree that purpose seems to be different.

Jeema101 8y ago

It's because: A) The law seems to extend beyond the borders of the EU. B) It's extremely long and vague, doesn't really offer a lot of actionable advice, and nobody outside of privacy lawyers seems to really understand it fully. C) The penalties are harsh. Further muddying the waters, the EU and US already have some existing bilateral agreements with respect to data privacy [1], but does the GDPR supersede or unilaterally invalidate these...? Who knows? [1] https://en.wikipedia.org/wiki/EU%E2%80%93US_Privacy_Shield https://en.wikipedia.org/wiki/EU%E2%80%93US_Privacy_Shield

olivierduval 8y ago
GDPR is far stronger that Privacy Shield... so you can't use that
chernobogdan 8y ago
> The law seems to extend beyond the borders of the EU. Hi guys, It's Kim from the Best Korea, and we just decided that we are going to allow our people to access the Internet. There is a tiny little thing though, our internet policy stipulates that for every traffic hit to sites outside our borders, the country of origin either donates 1 nuke or if it doesn't have nukes an item of great value, or a 24 hour TV broadcast featuring me.
gerdesj 8y ago
You haven't actually read any of it have you? A) It covers behaviour towards the citizens (ie passport carrying members) of the EU. It basically says: "please do not be evil" - OK it says a lot more but I think you get the idea. B) It does cover a lot of ground but it is written in pretty accessible language for such a large and complex subject. C) The possible maximum penalties are set at a level that will not destroy a serial transgressor but should hopefully deter anyone from becoming such a beast in the first place. Overall, GDPR is really a manifesto for how people should be treated in the burgeoning data economy. I still find it hard to understand how such a reasonable and farsighted set of regs came to be designed in the first place. As a citizen of the UK, at least I am reasonably certain that the GDPR will stay on the local statute books post Brexit because to contemplate otherwise is economic suicide.

rightos 8y ago

I'm wondering this too actually, I run a small business, we collect only the bare minimum of information from our customers but we do have some European customers. I'm ignoring GDPR completely, is there any downside for me? Will they block customers from using my service? Will they sieze my European cloud servers? Or can I safely do nothing as I currently am because I don't reside or have a registered business in Europe?

phyzome 8y ago
You're probably fine. If you have a lawful basis for collecting the information, you're only passing it along to others as necessary to provide your service to your customers, the customers have clearly consented, and you employ reasonable protection of that data... it's extremely unlikely that you're in violation. And if you were, they'd come to you first with a warning (at least based on past behavior). They're not going to seize assets unless you seriously provoke them.
orwin 8y ago
You have two solution: 1: ignore GDPR, you'll probably fly under. And if you dont, fine are scaled for business and people affected, as well as privacy infraction. Encrypt your backups, encrypt PII if you can do it effortlessly, and you're good. If you are not using emails except for checking double inscription, encrypt them too, the entropy is low BUT this is better than nothing . 2: If you have some time and money to spend to try to improve your services: self-report. A public agent will point you the weakness of your data processing.
- rightos 8y ago
  Is there some way they can fine me with me being in a country completely and totally unrelated to the EU?
  - deleted 8y ago
    [deleted]
  - _rpd 8y ago

SJetKaran 8y ago

Not directly related, but see FATCA. Because of a US law, individuals in many countries who don't deal with US securities/markets, have to fill a form saying they don't have any direct investments in US, or that they are not a citizen/resident of US.

HumanDrivenDev 8y ago
Interesting that the end result was the same - block people from the country using their services.

Msurrow 8y ago

Well thats because you dont understand GDPR. If the company doesnt conduct any business in EU - or more correctly with EU private persones - then GDPR doesnt apply to the company. It also doesnt apply for any Business-2-business relations. GDPR only applies if you are providing a service to a EU citizen. That also explains what EU will do if a company doesnt comply with GDPR (where it should); they will stop the company from providing those services to the EU citizen. This is also why blocking EU traffic doesnt make you GDPR compliant (I can use a vpn or visit your site when travelling, and then you are still providing a service to a EU citizen). If the case really is as you say, with just serving http request, then you have no issue with being GDPR compliant, because you dont store and information about the EU citizen. If however you are not just serving http requests, but track the user or otherwise store information on the site visitor, then you may have GDPR issues. But if you do store data about your users, you really should treat the data correctly. GDPR is common sense, and if you bother to understand it correctly, its fairly easy to be compliant. Though I’d say, the bigger the company the more complex the implementation.

mychael 8y ago
You're mistaking GDPR's intent with its implementation, an error that lots of people are making. As Americans we're particularly sensitive about having to follow rules made by people who don't represent us and are not accountable to us. This is a totally fair and justifiable reason to be against GDPR even if you agree with its objectives.
- Msurrow 8y ago
  “As Americans we’re particularly sensitive about having to follow rules made by [others]” That may be one of the most ironic comments I’ve ever heard. I love americans, but as a super power you stick your nose into so many other countries business, directly or indirectly. So, lets just say that argument is not gonna change my view in any way. I don’t think I am mistaking intent with implementation. The regulation’s written text leavea many details to be answered along the way and the first couple of rulings on GDPR will (hopefully) bring us a lot of insigts into how to interpret and implement GDPR in practice. So I guess no one really knows the implementation yet. Until then we have to go by what is reasonable and the intent. And if you store data on private citizens you better treat it correctly.