5 ms·

Currently, a lot of US companies have significant financial presence in Ireland, for tax-loophole reasons. See [0] for the Microsoft example specifically. I'm

by nix0n 4y ago

Currently, a lot of US companies have significant financial presence in Ireland, for tax-loophole reasons. See [0] for the Microsoft example specifically. I'm not a lawyer, and I know nothing about New Relic specifically. But the worst offenders of the spirit of GDPR really are vulnerable to EU enforcement. [0] https://www.theguardian.com/world/2021/jun/03/microsoft-irish-subsidiary-paid-zero-corporate-tax-on-220bn-profit-last-year https://www.theguardian.com/world/2021/jun/03/microsoft-iris...

msla 4y ago
Right, I fully understand that, and it's an important fact. I'm talking about from the perspective of a small US company with no assets outside the US.
- mhitza 4y ago
  If you don't respect the GDPR, don't have a representative/establishment in EU/EEA... I haven't heard of anything like this happening before, but an EU judge could sanction your company. And Stripe, Paddle, PayPal, or any other payment service provider would abide to. Likelyhood of that happening? 1/1mil? Who knows. EU GDPR enforcement is only getting better, and the scenario you have asked about is sure to be in the spotlight sooner or later.
  - msla 4y ago
    > If you don't respect the GDPR, don't have a representative/establishment in EU/EEA... I haven't heard of anything like this happening before, but an EU judge could sanction your company. And Stripe, Paddle, PayPal, or any other payment service provider would abide to. That's interesting: Sanctioning you by going after business partners. That could be messy, and could spark laws about that here were a European court to actually try it. How much power do we want foreign courts to have over our citizens?
    - mhitza 4y ago
      I'm an EU citizen so I want EU countries to have all the power over US citizens! Just joking! These EU/EEA laws are for consumer protection. To operate in EU is way easier for digital companies than it is for other companies. But as an EU resident you expect uniform application of consumer rights, and you definitely don't want to be surprised along the way. You have the option of not opening up your services to EU residents, and when the GDPR became effective I've seen websites that did just that. On the other hand GDPR and very similar regulation is going to become more prevalent. You have the CCPA, which is a distilled version of the GDPR, you have the Brazillian LGPD which is a derivation of the GDPR, and other countries are in the works of setting up their own. In the end, I think that GDPR, thus far, is the most strict of them all, and if you implement universally what the GDPR requires, on a technical level (needs to be emphasized), you'll comply with any other privacy regulation.
      - msla 4y ago
        I wonder how eager European businesses would be to implement some American law they had no hand in crafting, based on hand-wavy claims of enforceability and "eat your vegetables, it's good for you" type rhetoric.
        mhitza 4y ago
        I think the same goes the other way around. Establishing an US entity is scary in terms of privacy cause then you automatically need to comply to the CLOUD Act (which creates an entirely different legal kerfuffle in regards to GDPR compliance). And even if not established within the US, a global company is still subject to US's export laws (which applies to goods, and services, including software). The US has a tighter track record on political/economical pressure, even in EU. All the copyright acts and regulation that almost succeed all the time in EU, and happily thus far got rejected, didn't come from within EU, but from the EU-US trade partnership. My opinion is that it's better to just check of compliance marks on a list, and move on with ones life. Politics are **, either way.
- jacquesm 4y ago
  The easiest way is then to simply not track your EU customers. That takes care of 99% of the problem.
  - msla 4y ago
    I'm interested in enforcement mechanisms a European court would have over a purely American company that did track European customers. People around here seem to assume that Europe has enforcement powers over the entire world, which seems bizarre to me. Do we also collectively assume North Korea can enforce its laws in Silicon Valley?
    - jacquesm 4y ago
      America seems to believe the exact same thing. The typical way is that they pluck execs out of airport lines. For instance: https://en.wikipedia.org/wiki/David_Carruthers https://en.wikipedia.org/wiki/David_Carruthers Was a pretty high profile case like that. You may of course disagree with that but I think that if you intend to do business in a country that you should abide by the laws of that country, even if there is no direct way to enforce them. Sooner or later you may find that nation states have pretty long reach.
- whakim 4y ago
  This may already be implicit in your question, but that putative company has to be clearly intending to offer goods or services to EU visitors (which isn't specifically defined but might mean something like accepting payment in Euros or advertising towards EU citizens). This seems like a vanishingly small percentage of "small US companies" although I do see your point re: enforcement.

by nix0n 4y ago

msla 4y ago

Right, I fully understand that, and it's an important fact. I'm talking about from the perspective of a small US company with no assets outside the US.

mhitza 4y ago
If you don't respect the GDPR, don't have a representative/establishment in EU/EEA... I haven't heard of anything like this happening before, but an EU judge could sanction your company. And Stripe, Paddle, PayPal, or any other payment service provider would abide to. Likelyhood of that happening? 1/1mil? Who knows. EU GDPR enforcement is only getting better, and the scenario you have asked about is sure to be in the spotlight sooner or later.
- msla 4y ago
  > If you don't respect the GDPR, don't have a representative/establishment in EU/EEA... I haven't heard of anything like this happening before, but an EU judge could sanction your company. And Stripe, Paddle, PayPal, or any other payment service provider would abide to. That's interesting: Sanctioning you by going after business partners. That could be messy, and could spark laws about that here were a European court to actually try it. How much power do we want foreign courts to have over our citizens?
  - mhitza 4y ago
    I'm an EU citizen so I want EU countries to have all the power over US citizens! Just joking! These EU/EEA laws are for consumer protection. To operate in EU is way easier for digital companies than it is for other companies. But as an EU resident you expect uniform application of consumer rights, and you definitely don't want to be surprised along the way. You have the option of not opening up your services to EU residents, and when the GDPR became effective I've seen websites that did just that. On the other hand GDPR and very similar regulation is going to become more prevalent. You have the CCPA, which is a distilled version of the GDPR, you have the Brazillian LGPD which is a derivation of the GDPR, and other countries are in the works of setting up their own. In the end, I think that GDPR, thus far, is the most strict of them all, and if you implement universally what the GDPR requires, on a technical level (needs to be emphasized), you'll comply with any other privacy regulation.
    - msla 4y ago
      I wonder how eager European businesses would be to implement some American law they had no hand in crafting, based on hand-wavy claims of enforceability and "eat your vegetables, it's good for you" type rhetoric.
      - mhitza 4y ago
        I think the same goes the other way around. Establishing an US entity is scary in terms of privacy cause then you automatically need to comply to the CLOUD Act (which creates an entirely different legal kerfuffle in regards to GDPR compliance). And even if not established within the US, a global company is still subject to US's export laws (which applies to goods, and services, including software). The US has a tighter track record on political/economical pressure, even in EU. All the copyright acts and regulation that almost succeed all the time in EU, and happily thus far got rejected, didn't come from within EU, but from the EU-US trade partnership. My opinion is that it's better to just check of compliance marks on a list, and move on with ones life. Politics are **, either way.
jacquesm 4y ago
The easiest way is then to simply not track your EU customers. That takes care of 99% of the problem.
- msla 4y ago
  I'm interested in enforcement mechanisms a European court would have over a purely American company that did track European customers. People around here seem to assume that Europe has enforcement powers over the entire world, which seems bizarre to me. Do we also collectively assume North Korea can enforce its laws in Silicon Valley?
  - jacquesm 4y ago
    America seems to believe the exact same thing. The typical way is that they pluck execs out of airport lines. For instance: https://en.wikipedia.org/wiki/David_Carruthers https://en.wikipedia.org/wiki/David_Carruthers Was a pretty high profile case like that. You may of course disagree with that but I think that if you intend to do business in a country that you should abide by the laws of that country, even if there is no direct way to enforce them. Sooner or later you may find that nation states have pretty long reach.
whakim 4y ago
This may already be implicit in your question, but that putative company has to be clearly intending to offer goods or services to EU visitors (which isn't specifically defined but might mean something like accepting payment in Euros or advertising towards EU citizens). This seems like a vanishingly small percentage of "small US companies" although I do see your point re: enforcement.