3 ms·

I argue Zoom does understand GDPR and the ePrivacy Directive from a legal perspective. The specific citation about the length of a cookie is a recommendation a

I argue Zoom does understand GDPR and the ePrivacy Directive from a legal perspective. The specific citation about the length of a cookie is a recommendation and not a law[0]. The key word is 'should'. I'm not a lawyer nor claim the ability to interpret GDPR legally, but I have seen companies that actively worked to edge case GDPR to their advantage (I was part of one). We would have lawyers and other 'GDPR experts' tell us what was possible and what wasn't then simply extend into the grey area. Here, I reject the Halon's Razor[1]. [0] https://gdpr.eu/cookies/#:~:text=All%20persistent%20cookies%20have%20an,you%20do%20not%20take%20action https://gdpr.eu/cookies/#:~:text=All%20persistent%20cookies%.... [1] https://en.wikipedia.org/wiki/Hanlon%27s_razor https://en.wikipedia.org/wiki/Hanlon%27s_razor

lmkg 6y ago
The website gdpr.eu is not official. It's just a website made by some people. The length of the cookie, as far as I can tell, is not even a recommendation in the law. It's just a thing someone said on the Internet. The ePrivacy Directive requires strict consent (as defined in GDPR) in order to read or write data from a user's computer, including cookies, except were strictly necessary to provision the service. There's potentially wiggle room for throttling, which is in the name of one of the cookies. I have doubts about a cookie tracking whether you've ever logged in.
dheera 6y ago
I imagine GDPR doesn't apply to Zoom, as a non-EU company. Much like China bans what it doesn't want, the onus is on the EU to set up a GFW of their own and ban Zoom (and other GDPR-non-compliant foreign websites) if they disagree with it. Otherwise, Zoom only needs to obey the laws of USA and wherever else they have offices. Disclaimer: IANAL Also: I'm not arguing for Zoom's sketchy practices but just saying that GDPR might be the wrong card here. The EU isn't the world police.
- andrewnicolalde 6y ago
  I'm pretty sure GDPR applies to any companies with dealings in the EU, or at least to that company's dealings which occur within the EU. Disclaimer: IAANAL
  - dheera 6y ago
    You could say that about China as well. China's laws say that you need to censor your search results of certain things. Google and Facebook don't censor. They get banned by the GFW. Plain and simple. The EU can do the same thing and set up their own firewall if they wish to enforce GDPR on foreign websites. The fact that their citizens would revolt over the idea of internet censorship, is irrelevant. The point I'm trying to make is that EU saying "you can't serve X to our citizens" and China saying "you can't serve Y to our citizens" is no different and it's upto them to enforce it within their borders if they wish. The EU doesn't get to play world police any more than China's government does. FWIW baidu.com and tencent.com are both pretty damn GDPR incompliant and the EU isn't doing anything about it. And yes there are Chinese-speaking EU nationals that use these companies' services.
    - vertex-four 6y ago
      You, uhh, you realise that we're stuck with restrictions on what we can do in significantly more important sectors than serving tracking cookies because of the US - like the financial industry - right? There's not a world power in existence which doesn't extend its power in order to attempt to either protect its citizens or protect its tax income.
- irjustin 6y ago
  Any company that has an operating entity in an EU country must comply or risk being fined by regulators. If the target is big enough, EU regulators will ask for help from other countries. Zoom operates offices in a few EU countries[0] so they'll definitely have some sort of entity(ies) setup - regulation pressure can be applied. [0] https://zoom.us/contact https://zoom.us/contact
  - dheera 6y ago
    You're right, I checked and Zoom does have offices in Paris and Amsterdam. I suppose then they have the choice of doing Google's playbook in China and just close their EU offices if they wanted, instead of complying. I mean, China wanting censorship and EU wanting GDPR aren't any different. Without arguing for or against either, China's censorship and GDPR are both local laws and foreign-based companies with no local offices don't need to comply. Foreign companies may be blocked, that's all. Not that I'm advocating for Zoom violating privacy, but I'm not in support of EU unilaterally setting rules for the world or their right to police EU laws outside their borders. They should set up a GFW if they don't like certain things being sent into their country borders over the web, but they can't tell me what to do if I haven't set foot in their jurisdiction. (Neither can Iran, Russia, or North Korea, so why does EU get a pass to police you? If Kim Jong Un sent you a fine for $1 million would you pay it?)
    - yjftsjthsd-h 6y ago
      > but they can't tell me what to do if I'm not in their jurisdiction. True, but if you have offices and do business in their jurisdiction, then you get to follow their laws.
    - _Microft 6y ago
      > they can't tell me what to do if I haven't set foot in their jurisdiction. By accepting customers from the EU you are setting a foot here albeit economically and not physically. You are free to not serve european costumers if you do not want to deal with the GDPR.
    - ryneandal 6y ago
- pacamara619 6y ago
  There's no need to ban Zoom itself. Just stop all money from the EU going to Zoom's accounts.
- iso947 6y ago
  > The EU isn't the world police. That’s not how the world works. Non US citizens have been arrested in the US for breaking US law when they aren’t in the US. Hell the US has tried to extradite people to the US who have never been to America.

lmkg 6y ago

The website gdpr.eu is not official. It's just a website made by some people. The length of the cookie, as far as I can tell, is not even a recommendation in the law. It's just a thing someone said on the Internet. The ePrivacy Directive requires strict consent (as defined in GDPR) in order to read or write data from a user's computer, including cookies, except were strictly necessary to provision the service. There's potentially wiggle room for throttling, which is in the name of one of the cookies. I have doubts about a cookie tracking whether you've ever logged in.

dheera 6y ago

I imagine GDPR doesn't apply to Zoom, as a non-EU company. Much like China bans what it doesn't want, the onus is on the EU to set up a GFW of their own and ban Zoom (and other GDPR-non-compliant foreign websites) if they disagree with it. Otherwise, Zoom only needs to obey the laws of USA and wherever else they have offices. Disclaimer: IANAL Also: I'm not arguing for Zoom's sketchy practices but just saying that GDPR might be the wrong card here. The EU isn't the world police.

andrewnicolalde 6y ago
I'm pretty sure GDPR applies to any companies with dealings in the EU, or at least to that company's dealings which occur within the EU. Disclaimer: IAANAL
- dheera 6y ago
  You could say that about China as well. China's laws say that you need to censor your search results of certain things. Google and Facebook don't censor. They get banned by the GFW. Plain and simple. The EU can do the same thing and set up their own firewall if they wish to enforce GDPR on foreign websites. The fact that their citizens would revolt over the idea of internet censorship, is irrelevant. The point I'm trying to make is that EU saying "you can't serve X to our citizens" and China saying "you can't serve Y to our citizens" is no different and it's upto them to enforce it within their borders if they wish. The EU doesn't get to play world police any more than China's government does. FWIW baidu.com and tencent.com are both pretty damn GDPR incompliant and the EU isn't doing anything about it. And yes there are Chinese-speaking EU nationals that use these companies' services.
  - vertex-four 6y ago
    You, uhh, you realise that we're stuck with restrictions on what we can do in significantly more important sectors than serving tracking cookies because of the US - like the financial industry - right? There's not a world power in existence which doesn't extend its power in order to attempt to either protect its citizens or protect its tax income.
irjustin 6y ago
Any company that has an operating entity in an EU country must comply or risk being fined by regulators. If the target is big enough, EU regulators will ask for help from other countries. Zoom operates offices in a few EU countries[0] so they'll definitely have some sort of entity(ies) setup - regulation pressure can be applied. [0] https://zoom.us/contact https://zoom.us/contact
- dheera 6y ago
  You're right, I checked and Zoom does have offices in Paris and Amsterdam. I suppose then they have the choice of doing Google's playbook in China and just close their EU offices if they wanted, instead of complying. I mean, China wanting censorship and EU wanting GDPR aren't any different. Without arguing for or against either, China's censorship and GDPR are both local laws and foreign-based companies with no local offices don't need to comply. Foreign companies may be blocked, that's all. Not that I'm advocating for Zoom violating privacy, but I'm not in support of EU unilaterally setting rules for the world or their right to police EU laws outside their borders. They should set up a GFW if they don't like certain things being sent into their country borders over the web, but they can't tell me what to do if I haven't set foot in their jurisdiction. (Neither can Iran, Russia, or North Korea, so why does EU get a pass to police you? If Kim Jong Un sent you a fine for $1 million would you pay it?)
  - yjftsjthsd-h 6y ago
    > but they can't tell me what to do if I'm not in their jurisdiction. True, but if you have offices and do business in their jurisdiction, then you get to follow their laws.
  - _Microft 6y ago
    > they can't tell me what to do if I haven't set foot in their jurisdiction. By accepting customers from the EU you are setting a foot here albeit economically and not physically. You are free to not serve european costumers if you do not want to deal with the GDPR.
  - ryneandal 6y ago
pacamara619 6y ago
There's no need to ban Zoom itself. Just stop all money from the EU going to Zoom's accounts.
iso947 6y ago
> The EU isn't the world police. That’s not how the world works. Non US citizens have been arrested in the US for breaking US law when they aren’t in the US. Hell the US has tried to extradite people to the US who have never been to America.