5 ms·
I'd like to see someone take this analysis on. Is it valid? If not, why not, assuming American law? https://web.archive.org/web/20200813235643/http://slawsonan
by msla 5y ago
I'd like to see someone take this analysis on. Is it valid? If not, why not, assuming American law?
https://web.archive.org/web/20200813235643/http://slawsonandslawson.com/article-32-the-hole-in-the-gdpr-wall/ https://web.archive.org/web/20200813235643/http://slawsonand...
> Article 3(2), a new feature of the GDPR, creates extraterritorial jurisdiction over companies that have nothing but an internet presence in the EU and offer goods or services to EU residents[1]. While the GDPR requires these companies[2] to follow its data processing rules, it leaves the question of enforcement unanswered. Regulations that cannot be enforced do little to protect the personal data of EU citizens.
> This article discusses how U.S. law affects the enforcement of Article 3(2). In reality, enforcing the GDPR on U.S. companies may be almost impossible. First, the U.S. prohibits enforcing of foreign-country fines. Thus, the EU enforcement power of fines for noncompliance is negligible. Second, enforcing the GDPR through the designated representative can be easily circumvented. Finally, a private lawsuit brought by in the EU may be impossible to enforce under U.S. law.
[snip]
> Currently, there is a hole in the GDPR wall that protects European Union personal data. Even with extraterritorial jurisdiction over U.S. companies with only an internet presence in the EU, the GDPR gives little in the way of tools to enforce it. Fines from supervisory authorities would be stopped by the prohibition on enforcing foreign fines. The company can evade enforcement through a representative simply by not designating one. Finally, private actions may be stalled on issues of personal jurisdiction. If a U.S. company completely disregards the GDPR while targeting customers in the EU, it can use the personal data of EU citizens without much fear of the consequences. While the extraterritorial jurisdiction created by Article 3(2) may have seemed like a good way to solve the problem of foreign companies who do not have a physical presence in the EU, it turns out to be practically useless.
- nix0n 5y agoCurrently, a lot of US companies have significant financial presence in Ireland, for tax-loophole reasons. See [0] for the Microsoft example specifically. I'm not a lawyer, and I know nothing about New Relic specifically. But the worst offenders of the spirit of GDPR really are vulnerable to EU enforcement. [0] https://www.theguardian.com/world/2021/jun/03/microsoft-irish-subsidiary-paid-zero-corporate-tax-on-220bn-profit-last-year https://www.theguardian.com/world/2021/jun/03/microsoft-iris...
- msla 5y agoRight, I fully understand that, and it's an important fact. I'm talking about from the perspective of a small US company with no assets outside the US.
- mhitza 5y agoIf you don't respect the GDPR, don't have a representative/establishment in EU/EEA... I haven't heard of anything like this happening before, but an EU judge could sanction your company. And Stripe, Paddle, PayPal, or any other payment service provider would abide to. Likelyhood of that happening? 1/1mil? Who knows. EU GDPR enforcement is only getting better, and the scenario you have asked about is sure to be in the spotlight sooner or later.
- msla 5y ago> If you don't respect the GDPR, don't have a representative/establishment in EU/EEA... I haven't heard of anything like this happening before, but an EU judge could sanction your company. And Stripe, Paddle, PayPal, or any other payment service provider would abide to. That's interesting: Sanctioning you by going after business partners. That could be messy, and could spark laws about that here were a European court to actually try it. How much power do we want foreign courts to have over our citizens?
- mhitza 5y agoI'm an EU citizen so I want EU countries to have all the power over US citizens! Just joking! These EU/EEA laws are for consumer protection. To operate in EU is way easier for digital companies than it is for other companies. But as an EU resident you expect uniform application of consumer rights, and you definitely don't want to be surprised along the way. You have the option of not opening up your services to EU residents, and when the GDPR became effective I've seen websites that did just that. On the other hand GDPR and very similar regulation is going to become more prevalent. You have the CCPA, which is a distilled version of the GDPR, you have the Brazillian LGPD which is a derivation of the GDPR, and other countries are in the works of setting up their own. In the end, I think that GDPR, thus far, is the most strict of them all, and if you implement universally what the GDPR requires, on a technical level (needs to be emphasized), you'll comply with any other privacy regulation.
- makeitdouble 5y agoApplying the same principle to other rules would make for weird situations. For instance, let’s imagine a US business decides to make surprise changes to its T&CO and put penalties on some random behavior, but only applicable to EU users. It would proceed to take exorbitant amounts from EU cards, and refuse chargebacks pointing at the T&CO. Would it be completely shielded from any fines and lawsuit from EU users ? My gut instinct would be that even if the US company doesn’t have a EU presence, its service providers do, and a gov. could request any of them to recover legal fines on behalf of the country.