6 ms·

Because in European Union it is regulation, and you (as a company) are fined if you are not compliant. I recommend having a look over the Wikipedia page on the

by drclau 6y ago

Because in European Union it is regulation, and you (as a company) are fined if you are not compliant. I recommend having a look over the Wikipedia page on the subject: https://en.wikipedia.org/wiki/General_Data_Protection_Regulation https://en.wikipedia.org/wiki/General_Data_Protection_Regula...

fiddlerwoaroof 6y ago
If you’re not subject to the EU (I.e. don’t have any offices, servers, etc. in the EU) I don’t see how the GDPR is relevant: non-EU citizens generally aren’t subject to the laws of the EU.
- ekianjo 6y ago
  If some of your users are in the EU you need to be GDPR compliant.
  - fiddlerwoaroof 6y ago
    This is what the law says, but I don’t understand how this is expected to work: without some kind of treaty from the US government, the EU has no way to make US companies comply.
    - sneak 6y ago
      The US and EU have a treaty specifically about enforcing each other's laws. (More accurately, the nations that comprise the EU are individual signatories to such treaties.)
      - fiddlerwoaroof 6y ago
        Source? This lawyer seems to think that there’s no applicable treaty. https://tinyletter.com/mbutterick/letters/you-re-not-the-boss-of-me-gdpr-edition https://tinyletter.com/mbutterick/letters/you-re-not-the-bos...
        sneak 6y ago
        Here's the one between the US and the largest economy in the EU: https://www.congress.gov/treaty-document/108th-congress/27 https://www.congress.gov/treaty-document/108th-congress/27
        corty 6y ago
        There is no legal mechanism because such exist mostly for criminal law and civil and public debt collection. So the EU maybe cannot use most of the enforcement mechanisms, except one: You can be fined some amount of money, creating a public debt which can then be collected if there is a treaty about such collections.
    - anonymousab 6y ago
      There's a slew of individual things that can be done. EU companies can be prevented from doing business with a (willfully) noncompliant company. Wire transfers going through the EU and other operations can be blocked. And, of course, the service itself, its apps, its sites, its traffic, can be blocked from accessing the EU internet (or being accessed from it). That's not even getting into international pressure levers. I don't know that we've seen any of those kinds of actions yet, but they're clearly on the table if a company breaking the rules became a real "problem". The thing is, if you're just completely avoiding doing any business with the EU, having any EU customers or users, and just not touching the EU with a 1000 mile pole and avoiding the GDPR in such a fashion - well, then there's no reason to go after you. The legislation has done its job.
      - philwelch 6y ago
        > And, of course, the service itself, its apps, its sites, its traffic, can be blocked from accessing the EU internet (or being accessed from it). In other words, the EU can attempt to extend its internet regulations over the rest of the world by implementing a China-style firewall. Well, we'll see if that happens.
        gabaix 6y ago
        It is more akin to the US Sanctions. You don’t have to abide. If you do trade with sanctioned countries, you should not do any kind of business with the US, or pay a hefty penalty. Here’s a case example, BNP Paribas dealings with sanctioned countries. https://www.wsj.com/articles/bnp-agrees-to-pay-over-8-8-billion-to-settle-sanctions-probe-1404160117?mod=article_inline https://www.wsj.com/articles/bnp-agrees-to-pay-over-8-8-bill...
    - mattmanser 6y ago
      Have you not heard of extradition treaties? For example, that's what the US is using on Kim Dotcom.
- alvarlagerlof 6y ago
  If you're operating a business that interacts with customers in the EU, GDPR applies.
  - fiddlerwoaroof 6y ago
    The EU says it applies but, AFAICT there’s no legal mechanism by which it applies. Here’s a lawyer’s take on this: https://tinyletter.com/mbutterick/letters/you-re-not-the-boss-of-me-gdpr-edition https://tinyletter.com/mbutterick/letters/you-re-not-the-bos...
  - TedDoesntTalk 6y ago
    I thought US companies had to agree to Privacy Shield if they wanted to be considered GDPR-regulated. https://www.privacyshield.gov/welcome https://www.privacyshield.gov/welcome Why any US company would voluntarily agree to this is beyond me, unless one of its EU customers insisted on it.
- malka 6y ago
  Then you cannot have ue customers. Or make wire transfer through the ue.
  - Moru 6y ago
    You can also forget vacation trips in EU.
  - numpad0 6y ago
    If thoroughly enforced, which is currently not the case.
- drclau 6y ago
  "The GDPR also applies to data controllers and processors outside of the European Economic Area (EEA) if they are engaged in the "offering of goods or services" (regardless of whether a payment is required) to data subjects within the EEA, or are monitoring the behaviour of data subjects within the EEA (Article 3(2)). The regulation applies regardless of where the processing takes place. This has been interpreted as intentionally giving GDPR extraterritorial jurisdiction for non-EU establishments if they are doing business with people located in the EU." Source: https://en.wikipedia.org/wiki/General_Data_Protection_Regulation#Applicability_outside_of_the_European_Union https://en.wikipedia.org/wiki/General_Data_Protection_Regula...
  - msla 6y ago
    Countries or groups of countries don't get to impose their law on other countries. That's called colonialism, and Europe is supposed to have given it up.
    - drclau 6y ago
      I am not a lawyer, and I don't claim I understand the legal mechanisms involved. I don't even claim GDPR is perfect. But, as I see it, EU is protecting its citizens. If you want to do business with EU citizens you must abide by EU regulations. It's that simple. I don't get how this came to be all of a sudden about colonialism. Any business is free to stay out of EU.
      - cortesoft 6y ago
        And any EU citizen is free to not do business with a company outside the EU. Do you think the EU laws should apply to people selling things to EU citizens while they are on vacation in other parts of the world? If someone from Germany travels to Brazil and buys something from a store, are they required to abide by EU rules? If someone from the EU leaves the EU digitally to buy something in another country, it isn't up to the seller to enforce EU rules. Unless you have an entity (either yourself or your business) under EU jurisdiction, you don't have to follow their rules.
- deleted 6y ago
  [deleted]

by drclau 6y ago

fiddlerwoaroof 6y ago

If you’re not subject to the EU (I.e. don’t have any offices, servers, etc. in the EU) I don’t see how the GDPR is relevant: non-EU citizens generally aren’t subject to the laws of the EU.

ekianjo 6y ago
If some of your users are in the EU you need to be GDPR compliant.
- fiddlerwoaroof 6y ago
  This is what the law says, but I don’t understand how this is expected to work: without some kind of treaty from the US government, the EU has no way to make US companies comply.
  - sneak 6y ago
    The US and EU have a treaty specifically about enforcing each other's laws. (More accurately, the nations that comprise the EU are individual signatories to such treaties.)
    - fiddlerwoaroof 6y ago
      Source? This lawyer seems to think that there’s no applicable treaty. https://tinyletter.com/mbutterick/letters/you-re-not-the-boss-of-me-gdpr-edition https://tinyletter.com/mbutterick/letters/you-re-not-the-bos...
      - sneak 6y ago
        Here's the one between the US and the largest economy in the EU: https://www.congress.gov/treaty-document/108th-congress/27 https://www.congress.gov/treaty-document/108th-congress/27
      - corty 6y ago
        There is no legal mechanism because such exist mostly for criminal law and civil and public debt collection. So the EU maybe cannot use most of the enforcement mechanisms, except one: You can be fined some amount of money, creating a public debt which can then be collected if there is a treaty about such collections.
  - anonymousab 6y ago
    There's a slew of individual things that can be done. EU companies can be prevented from doing business with a (willfully) noncompliant company. Wire transfers going through the EU and other operations can be blocked. And, of course, the service itself, its apps, its sites, its traffic, can be blocked from accessing the EU internet (or being accessed from it). That's not even getting into international pressure levers. I don't know that we've seen any of those kinds of actions yet, but they're clearly on the table if a company breaking the rules became a real "problem". The thing is, if you're just completely avoiding doing any business with the EU, having any EU customers or users, and just not touching the EU with a 1000 mile pole and avoiding the GDPR in such a fashion - well, then there's no reason to go after you. The legislation has done its job.
    - philwelch 6y ago
      > And, of course, the service itself, its apps, its sites, its traffic, can be blocked from accessing the EU internet (or being accessed from it). In other words, the EU can attempt to extend its internet regulations over the rest of the world by implementing a China-style firewall. Well, we'll see if that happens.
      - gabaix 6y ago
        It is more akin to the US Sanctions. You don’t have to abide. If you do trade with sanctioned countries, you should not do any kind of business with the US, or pay a hefty penalty. Here’s a case example, BNP Paribas dealings with sanctioned countries. https://www.wsj.com/articles/bnp-agrees-to-pay-over-8-8-billion-to-settle-sanctions-probe-1404160117?mod=article_inline https://www.wsj.com/articles/bnp-agrees-to-pay-over-8-8-bill...
  - mattmanser 6y ago
    Have you not heard of extradition treaties? For example, that's what the US is using on Kim Dotcom.
alvarlagerlof 6y ago
If you're operating a business that interacts with customers in the EU, GDPR applies.
- fiddlerwoaroof 6y ago
  The EU says it applies but, AFAICT there’s no legal mechanism by which it applies. Here’s a lawyer’s take on this: https://tinyletter.com/mbutterick/letters/you-re-not-the-boss-of-me-gdpr-edition https://tinyletter.com/mbutterick/letters/you-re-not-the-bos...
- TedDoesntTalk 6y ago
  I thought US companies had to agree to Privacy Shield if they wanted to be considered GDPR-regulated. https://www.privacyshield.gov/welcome https://www.privacyshield.gov/welcome Why any US company would voluntarily agree to this is beyond me, unless one of its EU customers insisted on it.
malka 6y ago
Then you cannot have ue customers. Or make wire transfer through the ue.
- Moru 6y ago
  You can also forget vacation trips in EU.
- numpad0 6y ago
  If thoroughly enforced, which is currently not the case.
drclau 6y ago
"The GDPR also applies to data controllers and processors outside of the European Economic Area (EEA) if they are engaged in the "offering of goods or services" (regardless of whether a payment is required) to data subjects within the EEA, or are monitoring the behaviour of data subjects within the EEA (Article 3(2)). The regulation applies regardless of where the processing takes place. This has been interpreted as intentionally giving GDPR extraterritorial jurisdiction for non-EU establishments if they are doing business with people located in the EU." Source: https://en.wikipedia.org/wiki/General_Data_Protection_Regulation#Applicability_outside_of_the_European_Union https://en.wikipedia.org/wiki/General_Data_Protection_Regula...
- msla 6y ago
  Countries or groups of countries don't get to impose their law on other countries. That's called colonialism, and Europe is supposed to have given it up.
  - drclau 6y ago
    I am not a lawyer, and I don't claim I understand the legal mechanisms involved. I don't even claim GDPR is perfect. But, as I see it, EU is protecting its citizens. If you want to do business with EU citizens you must abide by EU regulations. It's that simple. I don't get how this came to be all of a sudden about colonialism. Any business is free to stay out of EU.
    - cortesoft 6y ago
      And any EU citizen is free to not do business with a company outside the EU. Do you think the EU laws should apply to people selling things to EU citizens while they are on vacation in other parts of the world? If someone from Germany travels to Brazil and buys something from a store, are they required to abide by EU rules? If someone from the EU leaves the EU digitally to buy something in another country, it isn't up to the seller to enforce EU rules. Unless you have an entity (either yourself or your business) under EU jurisdiction, you don't have to follow their rules.
deleted 6y ago
[deleted]