3 ms·

If you don't respect the GDPR, don't have a representative/establishment in EU/EEA... I haven't heard of anything like this happening before, but an EU judge co

by mhitza 5y ago

If you don't respect the GDPR, don't have a representative/establishment in EU/EEA... I haven't heard of anything like this happening before, but an EU judge could sanction your company. And Stripe, Paddle, PayPal, or any other payment service provider would abide to. Likelyhood of that happening? 1/1mil? Who knows. EU GDPR enforcement is only getting better, and the scenario you have asked about is sure to be in the spotlight sooner or later.

msla 5y ago
> If you don't respect the GDPR, don't have a representative/establishment in EU/EEA... I haven't heard of anything like this happening before, but an EU judge could sanction your company. And Stripe, Paddle, PayPal, or any other payment service provider would abide to. That's interesting: Sanctioning you by going after business partners. That could be messy, and could spark laws about that here were a European court to actually try it. How much power do we want foreign courts to have over our citizens?
- mhitza 5y ago
  I'm an EU citizen so I want EU countries to have all the power over US citizens! Just joking! These EU/EEA laws are for consumer protection. To operate in EU is way easier for digital companies than it is for other companies. But as an EU resident you expect uniform application of consumer rights, and you definitely don't want to be surprised along the way. You have the option of not opening up your services to EU residents, and when the GDPR became effective I've seen websites that did just that. On the other hand GDPR and very similar regulation is going to become more prevalent. You have the CCPA, which is a distilled version of the GDPR, you have the Brazillian LGPD which is a derivation of the GDPR, and other countries are in the works of setting up their own. In the end, I think that GDPR, thus far, is the most strict of them all, and if you implement universally what the GDPR requires, on a technical level (needs to be emphasized), you'll comply with any other privacy regulation.
  - msla 5y ago
    I wonder how eager European businesses would be to implement some American law they had no hand in crafting, based on hand-wavy claims of enforceability and "eat your vegetables, it's good for you" type rhetoric.
    - mhitza 5y ago
      I think the same goes the other way around. Establishing an US entity is scary in terms of privacy cause then you automatically need to comply to the CLOUD Act (which creates an entirely different legal kerfuffle in regards to GDPR compliance). And even if not established within the US, a global company is still subject to US's export laws (which applies to goods, and services, including software). The US has a tighter track record on political/economical pressure, even in EU. All the copyright acts and regulation that almost succeed all the time in EU, and happily thus far got rejected, didn't come from within EU, but from the EU-US trade partnership. My opinion is that it's better to just check of compliance marks on a list, and move on with ones life. Politics are **, either way.

by mhitza 5y ago

msla 5y ago

> If you don't respect the GDPR, don't have a representative/establishment in EU/EEA... I haven't heard of anything like this happening before, but an EU judge could sanction your company. And Stripe, Paddle, PayPal, or any other payment service provider would abide to. That's interesting: Sanctioning you by going after business partners. That could be messy, and could spark laws about that here were a European court to actually try it. How much power do we want foreign courts to have over our citizens?

mhitza 5y ago
I'm an EU citizen so I want EU countries to have all the power over US citizens! Just joking! These EU/EEA laws are for consumer protection. To operate in EU is way easier for digital companies than it is for other companies. But as an EU resident you expect uniform application of consumer rights, and you definitely don't want to be surprised along the way. You have the option of not opening up your services to EU residents, and when the GDPR became effective I've seen websites that did just that. On the other hand GDPR and very similar regulation is going to become more prevalent. You have the CCPA, which is a distilled version of the GDPR, you have the Brazillian LGPD which is a derivation of the GDPR, and other countries are in the works of setting up their own. In the end, I think that GDPR, thus far, is the most strict of them all, and if you implement universally what the GDPR requires, on a technical level (needs to be emphasized), you'll comply with any other privacy regulation.
- msla 5y ago
  I wonder how eager European businesses would be to implement some American law they had no hand in crafting, based on hand-wavy claims of enforceability and "eat your vegetables, it's good for you" type rhetoric.
  - mhitza 5y ago
    I think the same goes the other way around. Establishing an US entity is scary in terms of privacy cause then you automatically need to comply to the CLOUD Act (which creates an entirely different legal kerfuffle in regards to GDPR compliance). And even if not established within the US, a global company is still subject to US's export laws (which applies to goods, and services, including software). The US has a tighter track record on political/economical pressure, even in EU. All the copyright acts and regulation that almost succeed all the time in EU, and happily thus far got rejected, didn't come from within EU, but from the EU-US trade partnership. My opinion is that it's better to just check of compliance marks on a list, and move on with ones life. Politics are **, either way.