12 ms·
There's still the issue of enforcement. If the operators and servers are all outside the EU, how would a user effectively get courts to enforce the GDPR?
by beefhash 8y ago
There's still the issue of enforcement. If the operators and servers are all outside the EU, how would a user effectively get courts to enforce the GDPR?
- w_t_payne 8y agoExtradition?
- Hermel 8y agoExtradition treaties usually limit extradition to things that are punishable in both countries.
- namibj 8y agoBut not being able to step foot on European soil due to an outstanding bench warrant is at least severely inconvenient.
- cdoxsey 8y agoIts ridiculous on its face. European laws don't apply to American companies if they don't do business in Europe. It will become a major international incident if people try to do this.
- deleted 8y ago[deleted]
- Bizarro 8y agoYes, extradition for EU officials who try to enforce illegal lawss against the citizens of sovereign nations.
- kuschku 8y agoBy that rule we’d have to arrest all US officials, for constantly interfering in Europe. Stuff like https://www.reddit.com/r/technology/comments/ka26b/paypal_blackmails_one_of_the_three_major_german/https://www.heise.de/newsticker/meldung/Lassen-uns-nicht-erpressen-Rossmann-schmeisst-Paypal-raus-1340041.html https://www.reddit.com/r/technology/comments/ka26b/paypal_bl... (a german company, in germany, selling cuban cigars, to a german, got as result threats from their payment processors (US companies)). Or cases like this https://en.wikipedia.org/wiki/Society_for_Worldwide_Interbank_Financial_Telecommunication#U.S._control_over_transactions_within_the_EU https://en.wikipedia.org/wiki/Society_for_Worldwide_Interban... The US has constantly stolen money from EU citizen doing business in the EU for violating US laws. And then there’s the Kim Dotcom case. Also similar story, US enforcing US law in New Zealand and Germany. The US deserves some of its own medicine.
- majewsky 8y agoIf the company does not have a data protection officer (or if the DPO doesn't comply with users' requests), users can go to their national government's data protection regulator. No need to go to court.
- Rjevski 8y agoYes but what will that regulator do once they determine the foreign government in which the offense occurred is indeed guilty?
- JumpCrisscross 8y ago> how would a user effectively get courts to enforce the GDPR? Most Americans would prefer not to have European court judgments against them. That said, I agree this is absurd. If I choose to do business in your country, that is one thing. But extending that to blocking my right not to do business in your jurisdiction is silly.
- CM30 8y agoArrests when an operator visits an EU country? I mean, that's how the US seems to get gambling company CEOs and internet betting site operators...
- Zak 8y agoI find it pretty problematic that the US does that to gambling site operators. People who do things that are legal where they live should not have to fear that they'll get arrested when they visit a foreign country just because those things are not legal in that country.
- deleted 8y ago[deleted]
- DanBC 8y agoIs anything in GDPR an arrestable offence?
- namibj 8y agoNot paying, and getting a bench warrant for an overdue fine?
- Bizarro 8y agoArrest for EU bureaucrats for when they go outside the EU for trying to enforce unlawful laws?
- TomK32 8y agoIt's not the EU but the member states that are enforcing the regulation. They are also free to make minor changes to the regulation (e.g. Austria won't allow NGOs to make complaints and releases state-run companies from the regulation's duties).
- deleted 8y ago[deleted]
- closeparen 8y agoDoes your bank need to maintain a good relationship with European governments? If not, does it need to remain connected to banks that do?
- krschultz 8y agoThat's not how most regulations work. If you are a chemical company selling something that is legal in the US but illegal in the EU, the EU doesn't use your bank to enforce their regulations on your business in the US. Using the banks to cut off commerce across borders is an enforcement action for what countries agree are crimes - terrorism, money laundering, fraud, etc. It takes a lot of political willpower and negotiation to use that tool. I sincerely doubt it would be used against American websites that choose to not serve the EU.
- kuschku 8y agoThe US used this against Rossmann GmbH, which was a German company, in Germany, selling cuban cigars to a German. And they got cut off from PayPal, and the credit card networks for quite a while. If the US can use it for selling a product in a store that’s entirely legal to sell under EU law, then the EU can also use the same rules for GDPR.
- deleted 8y ago[deleted]
- krschultz 8y agoThat's a perfect illustration of my point. The US went to pretty great lengths to have specific bans on import / export from Cuba. German train companies build plenty of things that would not meet FRA standards in the US, the US does nothing about it. But Cuba is seen as a special case. So do you think GDPR and PII are more like Cuba and terrorism, or more like chemicals and transportation standards? I think the latter.
- closeparen 8y ago
- Bizarro 8y agoThere is no enforcement because if GDPR claims that it has jurisdiction over entities not having physical presence in the EU, then the law isn't lawful to begin with. And if the EU started going after companies/individuals who don't have presence in the EU because they claim "we say so", well, then the rest of the world can play that game to. Maybe the rest of the world will put sanctions on EU bureaucrats if EU bureaucrats start trying to shake down companies that have no presence in the EU.
- Nokinside 8y agoFor U.S. companies that have a physical presence in the EU, the GDPR can be enforced directly. For the other cases, EU uses intentional law. EU-U.S. Privacy Shield data sharing agreement for example. In the case that the law can't be enforced directly against the violating company, EU can enforce it trough companies that provide the infrastructure for handling user data and have dealing with EU. This includes trackers, online ad-selling companies, clouds providers, CDN provides, ISP's that have physical presence in EU and who handle user data when people visit the site. Like Google, FB, Amazon, cloufare, Akamai, Rackspace, Digital Ocean, ...... Also, if the company takes any money from the user from EU, they can get into trouble when banks with business in EU stop transferring payments. Only if the company is handling all user data using companies with no EU presence and are not violating any US-EU privacy agreements, they should be safe.