5 ms·

I'm not a lawyer, and at the risk of sounding ignorant, but I don't understand how a Polish law can be enforced on a company/service/piece of hardware under US

I'm not a lawyer, and at the risk of sounding ignorant, but I don't understand how a Polish law can be enforced on a company/service/piece of hardware under US (presumably, but could be any other) jurisdiction. At the end of the day, the data is sitting on a piece of hardware somewhere, isn't the "owning" place the one that dictates what laws can be enforced on it?

CalRobert 6y ago
Who mentioned the US?
- protonimitate 6y ago
  No one. > (presumably, but could be any other)
anonunivgrad 6y ago
If you want to do business in a country, then you have to follow the laws of that country. Polish courts would enter judgment against the company for violating Polish law, premising their jurisdiction on the activities of that company within their borders (e.g. accepting payment in polish currency, selling ads to polish businesses, charging for polish views/clicks). They can then seize the company's property in Poland to enforce that judgment. They can also introduce that judgment in foreign courts to do enforcement actions there. Those foreign courts would examine the validity of the Polish judgment (e.g. by reexamining jurisdiction) before issuing orders to enforce it. There's nothing novel about this. This is how civil judgments are enforced across borders every day.
- protonimitate 6y ago
  Makes sense, thanks.
paxys 6y ago
It can be enforced in a lot of ways, including fines on the company's operations in the country, charges against local employees and banning the site from the country's ISPs.
dharmab 6y ago
IANAL but as I understand it, most governments will consider something to be in their jurisdiction if the user is within their jurisdiction, even if the server is not. See GDPR, which applies to all EU citizens globally- even one residing in the United States using US web services.
- disabled 6y ago
  GDPR outside the European Union only applies to European Union based companies (headquartered in the EU). Otherwise, it is limited to internet traffic from people within the European Union. This rule was unclear in the beginning of the law implement, but there have been high court rulings clearing up the confusion. See this, for example “Google wins landmark right to be forgotten case”: https://www.bbc.com/news/technology-49808208 https://www.bbc.com/news/technology-49808208
  - erik_seaberg 6y ago
    Have the EU been able to impose GDPR penalties on an org with no staff or assets and no representation in the EU?
  - Jon_Lowtek 6y ago
    It is a bit more complicated: the EU considers the protection of personal data a basic human right (charta of fundamental rights article 8). As such there are cases where the EU considers itself to be the responsible authority, even if the company is not within the EU, as long as the data subject is. There are limits to that due to contract law, but there are also limits how many rights one can sign away, especially when dealing with predatory corporations. To give a less digital analogue: if you are robbed, your local police is the authority you talk to. They are not going to tell you that you need to find out who robbed you and talk to the police in their home town.
    - disabled 6y ago
      That’s a great point. Sorry I was not as inclusive as I should have been in my explanation. I am a dual US|EU citizen, but I am culturally American. I was trying to explain it from the perspective of Americans. Thank you again for the clarification.
Dma54rhs 6y ago
Presumably social media companies want to sell ads there and then it's rather easy to pressure them to cooperate or fine them.

CalRobert 6y ago

Who mentioned the US?

protonimitate 6y ago
No one. > (presumably, but could be any other)

anonunivgrad 6y ago

If you want to do business in a country, then you have to follow the laws of that country. Polish courts would enter judgment against the company for violating Polish law, premising their jurisdiction on the activities of that company within their borders (e.g. accepting payment in polish currency, selling ads to polish businesses, charging for polish views/clicks). They can then seize the company's property in Poland to enforce that judgment. They can also introduce that judgment in foreign courts to do enforcement actions there. Those foreign courts would examine the validity of the Polish judgment (e.g. by reexamining jurisdiction) before issuing orders to enforce it. There's nothing novel about this. This is how civil judgments are enforced across borders every day.

protonimitate 6y ago
Makes sense, thanks.

paxys 6y ago

It can be enforced in a lot of ways, including fines on the company's operations in the country, charges against local employees and banning the site from the country's ISPs.

dharmab 6y ago

IANAL but as I understand it, most governments will consider something to be in their jurisdiction if the user is within their jurisdiction, even if the server is not. See GDPR, which applies to all EU citizens globally- even one residing in the United States using US web services.

disabled 6y ago
GDPR outside the European Union only applies to European Union based companies (headquartered in the EU). Otherwise, it is limited to internet traffic from people within the European Union. This rule was unclear in the beginning of the law implement, but there have been high court rulings clearing up the confusion. See this, for example “Google wins landmark right to be forgotten case”: https://www.bbc.com/news/technology-49808208 https://www.bbc.com/news/technology-49808208
- erik_seaberg 6y ago
  Have the EU been able to impose GDPR penalties on an org with no staff or assets and no representation in the EU?
- Jon_Lowtek 6y ago
  It is a bit more complicated: the EU considers the protection of personal data a basic human right (charta of fundamental rights article 8). As such there are cases where the EU considers itself to be the responsible authority, even if the company is not within the EU, as long as the data subject is. There are limits to that due to contract law, but there are also limits how many rights one can sign away, especially when dealing with predatory corporations. To give a less digital analogue: if you are robbed, your local police is the authority you talk to. They are not going to tell you that you need to find out who robbed you and talk to the police in their home town.
  - disabled 6y ago
    That’s a great point. Sorry I was not as inclusive as I should have been in my explanation. I am a dual US|EU citizen, but I am culturally American. I was trying to explain it from the perspective of Americans. Thank you again for the clarification.

Dma54rhs 6y ago

Presumably social media companies want to sell ads there and then it's rather easy to pressure them to cooperate or fine them.