5 ms·

And how would either scenario work exactly? Who maintains jurisdiction over foreign-held data? How would such provisions be enforced without violating a countie

And how would either scenario work exactly? Who maintains jurisdiction over foreign-held data? How would such provisions be enforced without violating a counties sovereignty? Could the foreign country in question claim jurisdiction over all data in within its borders as well as businesses and related subsidiaries registered in it? Usually these questions would be solved with treaties, but how would that work if the other country refuses to play ball?

eqvinox 4y ago
I would argue: an entity is liable for how it treats user data, in the country where that data is generated. This original country is where interactions and transactions take place. If it chooses to move that data elsewhere, that is its choice, and also liability if moving that data runs afoul of regulations in the original country. The foreign country itself doesn't really matter, the entity is doing business in the original country, and would be held liable there by its users/business partners according to local laws.
- Dracophoenix 4y ago
  How would you define "generated"? It's not necessarily the case that user data is generated in the country of origin. E.g. cloud computing, fully remote systems/edge computing, XaaS, MMOs, etc. >The foreign country itself doesn't really matter Of course it matters. Every country has legal differences on the definition of privacy and associated liabilities (if there any at all). In addition, it's unlikely that one country can establish jurisdiction over data in a foreign country without violating national sovereignty. Arguing that doing business establishes a legal nexus with someone of a particular citizenship opens up a massive can of worms about whose law applies where.
  - eqvinox 4y ago
    > How would you define "generated"? Data is generated in the location where a human user interacts with the system, whether that be with a fully local system, some random website with a server in who-knows-where, or just configuring a domain for e-mail. (Yes, AI actions are a separate can of worms.) > > The foreign country itself doesn't really matter > Of course it matters. It doesn't for suing for rights, that's the point of generation-based legal authority. The legal transaction is taking place in the user's location, and by offering services there, you are agreeing to the local legal framework. > Arguing that doing business establishes a legal nexus with someone of a particular citizenship opens up a massive can of worms about whose law applies where. This is already the case, except with location and not citizenship. Safe harbor agreements just used to make this much less of an issue until they disappeared. You really can't expect to do business somewhere without adhering to the local legal framework.

eqvinox 4y ago

I would argue: an entity is liable for how it treats user data, in the country where that data is generated. This original country is where interactions and transactions take place. If it chooses to move that data elsewhere, that is its choice, and also liability if moving that data runs afoul of regulations in the original country. The foreign country itself doesn't really matter, the entity is doing business in the original country, and would be held liable there by its users/business partners according to local laws.

Dracophoenix 4y ago
How would you define "generated"? It's not necessarily the case that user data is generated in the country of origin. E.g. cloud computing, fully remote systems/edge computing, XaaS, MMOs, etc. >The foreign country itself doesn't really matter Of course it matters. Every country has legal differences on the definition of privacy and associated liabilities (if there any at all). In addition, it's unlikely that one country can establish jurisdiction over data in a foreign country without violating national sovereignty. Arguing that doing business establishes a legal nexus with someone of a particular citizenship opens up a massive can of worms about whose law applies where.
- eqvinox 4y ago
  > How would you define "generated"? Data is generated in the location where a human user interacts with the system, whether that be with a fully local system, some random website with a server in who-knows-where, or just configuring a domain for e-mail. (Yes, AI actions are a separate can of worms.) > > The foreign country itself doesn't really matter > Of course it matters. It doesn't for suing for rights, that's the point of generation-based legal authority. The legal transaction is taking place in the user's location, and by offering services there, you are agreeing to the local legal framework. > Arguing that doing business establishes a legal nexus with someone of a particular citizenship opens up a massive can of worms about whose law applies where. This is already the case, except with location and not citizenship. Safe harbor agreements just used to make this much less of an issue until they disappeared. You really can't expect to do business somewhere without adhering to the local legal framework.