3 ms·

The problem with EU legislation in that regard - or rather the current lack of pertinent agreements since the EU–US Privacy Shield has been declared invalid - i

The problem with EU legislation in that regard - or rather the current lack of pertinent agreements since the EU–US Privacy Shield has been declared invalid - is that it doesn't just apply to US-based services and US companies. Having a US subsidiary or even just a US-based supplier is enough for an entire company to theoretically be considered in violation of EU laws and GDPR in particular. This means that as a business, theoretically you'd have to vet every single customer and supplier regarding their involvement with US-based companies. Since realistically this would amount to most companies not being able to do any business at all anymore - and consequently the economy grinding to a halt - in most cases this doesn't have immediate repercussions. However, such unpredictability caused by regulations such as GDPR is a huge problem because you can't ever be sure you won't be issued a - potentially crippling - fine simply because some local authority considered this a good idea.

albertopv 5y ago
The problem is USA jurisdiction outside of USA, I'm not a lawyer but how can this be legal under international laws? How is it possible that EU citizen data is under USA jurisdiction?
- BjoernKW 5y ago
  International law simply is what countries agree upon, either bilaterally or multilaterally. Even if countries disagree and international law indeed favours one party, in most circumstances there's hardly any recourse if that party is the weaker one. Technically, the US can seize the assets of a US company that refuses to comply with these rules (or simply have their CEO arrested). That's what it comes down to: If a US company has a controlling stake in a subsidiary it's legally obligated to hand over any data that subsidiary controls. The EU on the other hand could escalate this further and prohibit American citizens and organizations from owning a majority stake in EU-based companies because that's what this boils down to on the other hand: Running or even just doing business with a company that's controlled by a US entity technically is illegal for EU businesses and citizens right now. This is not a pretty situation, but it's not one either where one side is clearly right and the other side is clearly wrong. In principle, I agree with the EU point of view. Privacy is a fundamental right that should be upheld. However, de facto outlawing most economic activity and then washing one's hands of any responsibility to provide a reasonable alternative is no solution at all, but makes the problem worse: Businesses might establish legal entities outside the EU, where they're not affected by this. Others might try to host and run everything themselves, which will result in much less secure data and infrastructure because most SMBs simply aren't able to provide the same security standards as Microsoft, Amazon or Google. It's on the EU und the US to provide a dependable legal framework for dealing with these types of situations. That's ultimately what entities like the EU are for, after all.

albertopv 5y ago

The problem is USA jurisdiction outside of USA, I'm not a lawyer but how can this be legal under international laws? How is it possible that EU citizen data is under USA jurisdiction?

BjoernKW 5y ago
International law simply is what countries agree upon, either bilaterally or multilaterally. Even if countries disagree and international law indeed favours one party, in most circumstances there's hardly any recourse if that party is the weaker one. Technically, the US can seize the assets of a US company that refuses to comply with these rules (or simply have their CEO arrested). That's what it comes down to: If a US company has a controlling stake in a subsidiary it's legally obligated to hand over any data that subsidiary controls. The EU on the other hand could escalate this further and prohibit American citizens and organizations from owning a majority stake in EU-based companies because that's what this boils down to on the other hand: Running or even just doing business with a company that's controlled by a US entity technically is illegal for EU businesses and citizens right now. This is not a pretty situation, but it's not one either where one side is clearly right and the other side is clearly wrong. In principle, I agree with the EU point of view. Privacy is a fundamental right that should be upheld. However, de facto outlawing most economic activity and then washing one's hands of any responsibility to provide a reasonable alternative is no solution at all, but makes the problem worse: Businesses might establish legal entities outside the EU, where they're not affected by this. Others might try to host and run everything themselves, which will result in much less secure data and infrastructure because most SMBs simply aren't able to provide the same security standards as Microsoft, Amazon or Google. It's on the EU und the US to provide a dependable legal framework for dealing with these types of situations. That's ultimately what entities like the EU are for, after all.