6 ms·

As long as the internet is global, but laws governing it are made locally, will not this and similar issues get increasingly messy until we are left with a effe

by nso 5y ago

As long as the internet is global, but laws governing it are made locally, will not this and similar issues get increasingly messy until we are left with a effed if you do effed if you don't? Could these laws that are increasingly unfriendly to the cooperation that the internet enables slow down innovation and make it too risky to invest in many kind of online services? Is it realistic to think that one day in the near future we will get some kind of global law governing these things, and if not what other options are there to resolve these issues?

lbotos 5y ago
GDPR sets a reasonable precedent (in the sense of what to expect, and it's a good thing for users, but also in this context, adds complexity for businesses.) "The GDPR applies to companies outside the EU because it is extra-territorial in scope. Specifically, the law is designed not so much to regulate businesses as it is to protect the data subjects’ rights. A “data subject” is any person in the EU, including citizens, residents, and even, perhaps, visitors. What this means in practice is that if you collect any personal data of people in the EU, you are required to comply with the GDPR. The data could be in the form of email addresses in a marketing list or the IP addresses of those who visit your website. (See our article explaining what is considered personal data under the GDPR.) You may be wondering how the European Union will enforce a law in territory it does not control. The fact is, foreign governments help other countries enforce their laws through mutual assistance treaties and other mechanisms all the time. GDPR Article 50 addresses this question directly. So far, the EU’s reach has not been tested, but no doubt data protection authorities are exploring their options on a case-by-case basis." - https://gdpr.eu/compliance-checklist-us-companies/ https://gdpr.eu/compliance-checklist-us-companies/
- bserge 5y ago
  An email address is PID? My PoV is that an email address + first name in a mailing list should not be covered under GDPR. William (billy69420@cbt.eu) does not identify anyone, does it?
  - gjs278 5y ago
    it definitely is someone
  - owlmirror 5y ago
    PII can be anything unique tied to a person. email addresses are definitely PII. even if you have not the full name of a person in the address, such an address usually is unique to a single person and as such one of the best identifiers you will usually have.
  - usr1106 5y ago
    IANAL, but IIRC PII/PID is a US concept. The GDPR does not talk about such thing at all. Back when GDPR was new there quite some discussion about the differences. Don't remember the details. Maybe someone can remind us.
    - deleted 5y ago
      [deleted]
  - BeniBoy 5y ago
    As a sibling comment said, the notion is "Personal Data". It is very wide and email address definitely fall within it. Also note IP is personal data, and an identifier like a UUID of the IDFA is personal data. The key point is that it must be related to an identified *or identifiable* data subject, ie even if that information is not enough to identify the person, the fact that it can contribute to it makes it personal data.
  - dafoex 5y ago
    With that information I can: • Say with a lot of confidence that billy69420@cbt.eu is owned by one person, called William. • Infer that, since the e-mail says Billy, but the name says William, the latter is probably what appears on any official documentation. • Infer that any services signed up to using billy69420@cbt.eu as the e-mail address are more than likely tied to this William person - including any services I run or otherwise have administrative access to. • Search for billy69420@cbt.eu on various public information repositories and reverse email searches. • Add an entry to a database using billy69420@cbt.eu as a primary key (e-mail addresses are necessarily unique) to enable me to keep track of my current and future information and inferences, thus building a profile on the person. I can also understand that the sex and weed references mean that you've probably not given a real e-mail in this example, but if it were real I might be able to infer an age range (or at least a level of maturity) of the user from that, although this would be unreliable as the user could have made the e-mail account some time ago and just still happen to be using it.
- rkagerer 5y ago
  Article 50 is not very specific. For enforcement to have teeth outside their jurisdiction don't they either need assets or revenue streams in the EU which can be confiscated/leveraged, or else good old fashioned extradition treaties? And don't the latter typically require said crime to be illegal in both jurisdictions?
  - rkagerer 5y ago
    Here are some musings on the subject from https://www.lepide.com/blog/is-gdpr-enforceable-in-practice-outside-of-the-eu/ https://www.lepide.com/blog/is-gdpr-enforceable-in-practice-... "In theory it could be that the EDPB could place embargoes, on sales of Acme Cola’s products within Europe, but if Acme Cola has a strong voice in the Senate, or indeed in Washington, would the US authorities play ball and encourage them to pay the fines, or would they be lobbied and fall on the side of Acme Cola to say no, we do not accept that US companies should have to adhere to someone else’s law?" And here's a potential test case unfolding: https://iapp.org/news/a/does-the-recent-fine-for-a-canadian-website-without-an-eu-representative-signal-a-change-in-gdpr-enforcement-priorities/ https://iapp.org/news/a/does-the-recent-fine-for-a-canadian-...
    - BeFlatXIII 5y ago
      Senators may agree with Acme Cola even without lobbying simply to flex national sovereignty (especially if they have a large America First demographic in their state and it's re-election year). "Your law = your enforcement problem"
  - remus 5y ago
    I don't think the theory is really so complicated. If you want to provide products or services within a country then you need to abide by the laws of that country, if you don't then the legal system of that country has various measures to make doing business in that country prohibitive. At a basic level you could imagine court ordered DNS blocking by ISPs (as is done for the pirate bay in many places), or if you were really naughty then extradition, arrests of key individuals in your org if they try and travel etc.
- orangeoxidation 5y ago
  > What this means in practice is that if you collect any personal data of people in the EU, you are required to comply with the GDPR. In practice almost everyone in and out of the EU violates the GDPR because it is simply not enforced. Not because it's impossible to hold foreign companies responsible, but because the authorities aren't even trying (except the very occasional headline grabber).
  - remus 5y ago
    > In practice almost everyone in and out of the EU violates the GDPR because it is simply not enforced. > Not because it's impossible to hold foreign companies responsible, but because the authorities aren't even trying (except the very occasional headline grabber). I think this is a fairly cynical take. I think data privacy as a whole is greatly improved since the introduction of GDPR, and difficult questions are being asked of companies doing dodgy things with personal data (e.g. google, facebook). I have some sympathy for the enforcement authorities who are relatively small organisations trying to enforce large changes across a huge swath of companies. They need to pick their battles, and going after lots of little fish is probably not a great strategy.
    - di4na 5y ago
      Keep in mind too that a lot of company registered to the Irish DPC which is quite... lax. And the rest of the EU enforcement agency and the ECJ are both in a constant fight to close that loophole. Which they are slowly winning. Ramping up regulations take time, but they work on tax schedule. They will win in the end.
    - OneTimePetes 5y ago
      It should have been standardized, so it can be auto-negotiated. Not these dark patern menues, but a popup screen: This site overreaches regarding privacy, in addition what you are usually willing to give - it demands: - List Are you willing to give in to the demands: - Just once - Fake my data - Always - Never This could and should have been all you see of GDPR. Maybee technical laws should also enforce a standard for consent interfaces.
pjc50 5y ago
I first got interested in this subject back in 2001 at the time of https://en.wikipedia.org/wiki/United_States_v._Elcom_Ltd https://en.wikipedia.org/wiki/United_States_v._Elcom_Ltd. , where a Russian developer who'd made an ebook cracking tool was arrested as soon as he stepped off a plane in the US. Since then there have been various problematic claims at universal jurisdiction, especially relating to money and gambling (poker sites serving the US, crypto regulation in general). The situation remains .. stable, but fragmented around the edges. There's going to be a slow tick over of cases like this. I don't think it will affect investment, the "break the law and hope you become big enough to make a political win later" approach of Uber and AirBnB has become popular. Global law is unlikely unless it's set by the US, and the US terms on privacy (very loose except for finances which are subject to total surveillance) is not in sync with the rest of the world.

by nso 5y ago

lbotos 5y ago

GDPR sets a reasonable precedent (in the sense of what to expect, and it's a good thing for users, but also in this context, adds complexity for businesses.) "The GDPR applies to companies outside the EU because it is extra-territorial in scope. Specifically, the law is designed not so much to regulate businesses as it is to protect the data subjects’ rights. A “data subject” is any person in the EU, including citizens, residents, and even, perhaps, visitors. What this means in practice is that if you collect any personal data of people in the EU, you are required to comply with the GDPR. The data could be in the form of email addresses in a marketing list or the IP addresses of those who visit your website. (See our article explaining what is considered personal data under the GDPR.) You may be wondering how the European Union will enforce a law in territory it does not control. The fact is, foreign governments help other countries enforce their laws through mutual assistance treaties and other mechanisms all the time. GDPR Article 50 addresses this question directly. So far, the EU’s reach has not been tested, but no doubt data protection authorities are exploring their options on a case-by-case basis." - https://gdpr.eu/compliance-checklist-us-companies/ https://gdpr.eu/compliance-checklist-us-companies/

bserge 5y ago
An email address is PID? My PoV is that an email address + first name in a mailing list should not be covered under GDPR. William (billy69420@cbt.eu) does not identify anyone, does it?
- gjs278 5y ago
  it definitely is someone
- owlmirror 5y ago
  PII can be anything unique tied to a person. email addresses are definitely PII. even if you have not the full name of a person in the address, such an address usually is unique to a single person and as such one of the best identifiers you will usually have.
- usr1106 5y ago
  IANAL, but IIRC PII/PID is a US concept. The GDPR does not talk about such thing at all. Back when GDPR was new there quite some discussion about the differences. Don't remember the details. Maybe someone can remind us.
  - deleted 5y ago
    [deleted]
- BeniBoy 5y ago
  As a sibling comment said, the notion is "Personal Data". It is very wide and email address definitely fall within it. Also note IP is personal data, and an identifier like a UUID of the IDFA is personal data. The key point is that it must be related to an identified *or identifiable* data subject, ie even if that information is not enough to identify the person, the fact that it can contribute to it makes it personal data.
- dafoex 5y ago
  With that information I can: • Say with a lot of confidence that billy69420@cbt.eu is owned by one person, called William. • Infer that, since the e-mail says Billy, but the name says William, the latter is probably what appears on any official documentation. • Infer that any services signed up to using billy69420@cbt.eu as the e-mail address are more than likely tied to this William person - including any services I run or otherwise have administrative access to. • Search for billy69420@cbt.eu on various public information repositories and reverse email searches. • Add an entry to a database using billy69420@cbt.eu as a primary key (e-mail addresses are necessarily unique) to enable me to keep track of my current and future information and inferences, thus building a profile on the person. I can also understand that the sex and weed references mean that you've probably not given a real e-mail in this example, but if it were real I might be able to infer an age range (or at least a level of maturity) of the user from that, although this would be unreliable as the user could have made the e-mail account some time ago and just still happen to be using it.
rkagerer 5y ago
Article 50 is not very specific. For enforcement to have teeth outside their jurisdiction don't they either need assets or revenue streams in the EU which can be confiscated/leveraged, or else good old fashioned extradition treaties? And don't the latter typically require said crime to be illegal in both jurisdictions?
- rkagerer 5y ago
  Here are some musings on the subject from https://www.lepide.com/blog/is-gdpr-enforceable-in-practice-outside-of-the-eu/ https://www.lepide.com/blog/is-gdpr-enforceable-in-practice-... "In theory it could be that the EDPB could place embargoes, on sales of Acme Cola’s products within Europe, but if Acme Cola has a strong voice in the Senate, or indeed in Washington, would the US authorities play ball and encourage them to pay the fines, or would they be lobbied and fall on the side of Acme Cola to say no, we do not accept that US companies should have to adhere to someone else’s law?" And here's a potential test case unfolding: https://iapp.org/news/a/does-the-recent-fine-for-a-canadian-website-without-an-eu-representative-signal-a-change-in-gdpr-enforcement-priorities/ https://iapp.org/news/a/does-the-recent-fine-for-a-canadian-...
  - BeFlatXIII 5y ago
    Senators may agree with Acme Cola even without lobbying simply to flex national sovereignty (especially if they have a large America First demographic in their state and it's re-election year). "Your law = your enforcement problem"
- remus 5y ago
  I don't think the theory is really so complicated. If you want to provide products or services within a country then you need to abide by the laws of that country, if you don't then the legal system of that country has various measures to make doing business in that country prohibitive. At a basic level you could imagine court ordered DNS blocking by ISPs (as is done for the pirate bay in many places), or if you were really naughty then extradition, arrests of key individuals in your org if they try and travel etc.
orangeoxidation 5y ago
> What this means in practice is that if you collect any personal data of people in the EU, you are required to comply with the GDPR. In practice almost everyone in and out of the EU violates the GDPR because it is simply not enforced. Not because it's impossible to hold foreign companies responsible, but because the authorities aren't even trying (except the very occasional headline grabber).
- remus 5y ago
  > In practice almost everyone in and out of the EU violates the GDPR because it is simply not enforced. > Not because it's impossible to hold foreign companies responsible, but because the authorities aren't even trying (except the very occasional headline grabber). I think this is a fairly cynical take. I think data privacy as a whole is greatly improved since the introduction of GDPR, and difficult questions are being asked of companies doing dodgy things with personal data (e.g. google, facebook). I have some sympathy for the enforcement authorities who are relatively small organisations trying to enforce large changes across a huge swath of companies. They need to pick their battles, and going after lots of little fish is probably not a great strategy.
  - di4na 5y ago
    Keep in mind too that a lot of company registered to the Irish DPC which is quite... lax. And the rest of the EU enforcement agency and the ECJ are both in a constant fight to close that loophole. Which they are slowly winning. Ramping up regulations take time, but they work on tax schedule. They will win in the end.
  - OneTimePetes 5y ago
    It should have been standardized, so it can be auto-negotiated. Not these dark patern menues, but a popup screen: This site overreaches regarding privacy, in addition what you are usually willing to give - it demands: - List Are you willing to give in to the demands: - Just once - Fake my data - Always - Never This could and should have been all you see of GDPR. Maybee technical laws should also enforce a standard for consent interfaces.

pjc50 5y ago

I first got interested in this subject back in 2001 at the time of https://en.wikipedia.org/wiki/United_States_v._Elcom_Ltd https://en.wikipedia.org/wiki/United_States_v._Elcom_Ltd. , where a Russian developer who'd made an ebook cracking tool was arrested as soon as he stepped off a plane in the US. Since then there have been various problematic claims at universal jurisdiction, especially relating to money and gambling (poker sites serving the US, crypto regulation in general). The situation remains .. stable, but fragmented around the edges. There's going to be a slow tick over of cases like this. I don't think it will affect investment, the "break the law and hope you become big enough to make a political win later" approach of Uber and AirBnB has become popular. Global law is unlikely unless it's set by the US, and the US terms on privacy (very loose except for finances which are subject to total surveillance) is not in sync with the rest of the world.