5 ms·

There's nothing US companies can do to make themselfes legal to use here. The legal framework in the US allows dragnet spying on every non-american and american

There's nothing US companies can do to make themselfes legal to use here. The legal framework in the US allows dragnet spying on every non-american and american companies are forced to participate in that effort.

jeroenhd 4y ago
They're perfectly legal if they don't process any PII. If a US company serves static content there's no need to fear the EU; they'll just have to disable illegal external integrations like Google Analytics/Fonts/etc. A company doing business with other companies might find themselves in a position where they can comply perfectly. Not every company needs to collect PII, though these days every company likes to pretend they do.
- IX-103 4y ago
  When PII includes IP addresses it's kind of hard not to process. How else are you supposed to group metrics over a session (since cookies are also forbidden)? This seems to ban third-party analytics by any US company. The cynic in me feels this is a little convenient in how it advantages EU organizations over foreign ones...
  - koyote 4y ago
    Do you have a source on PII including IP addresses?
    - tylerrobinson 4y ago
      The article says it: “The Italian SA reiterated that an IP address is a personal data”
    - walrusfromspace 4y ago
      The European Commission's official website[1] [1] https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-personal-data_en https://ec.europa.eu/info/law/law-topic/data-protection/refo...
  - jeroenhd 4y ago
    You don't strictly need automated analytics to sell services to foreign customers. Collecting most if not all analytics is forbidden, for sure, but analytics and metrics aren't inherently required for businesses.
  - dx034 4y ago
    Session cookies are allowed if the user agrees. And if the user doesn't agree, you have no right to process PII to group metrics over a session. That's the big shift here, assuming you have a right to build a profile on a user (or even evaluate their behavior) without their consent is not legal under GDPR. And as a European, I'm very glad that's the case. I know, we're still not close to compliance with GDPR, but it has changed the privacy discussion more than any other part.
  - denton-scratch 4y ago
    > group metrics over a session How is that something that is essential to providing a service? I suppose that it's somehow "commercially advantageous", but there are many other commercially advantageous techniques that are simply illegal - such as taking a customer's money, but supplying zero in exchange. A company's profit needs are not an end-run around consumer protection laws (which is what GDPR amounts to).
- M2Ys4U 4y ago
  >They're perfectly legal if they don't process any PII. Personal data, not PII. The GDPR does not care about PII (except to the extent that the set of things that are PII is a subset of things that are personal data).

jeroenhd 4y ago

They're perfectly legal if they don't process any PII. If a US company serves static content there's no need to fear the EU; they'll just have to disable illegal external integrations like Google Analytics/Fonts/etc. A company doing business with other companies might find themselves in a position where they can comply perfectly. Not every company needs to collect PII, though these days every company likes to pretend they do.

IX-103 4y ago
When PII includes IP addresses it's kind of hard not to process. How else are you supposed to group metrics over a session (since cookies are also forbidden)? This seems to ban third-party analytics by any US company. The cynic in me feels this is a little convenient in how it advantages EU organizations over foreign ones...
- koyote 4y ago
  Do you have a source on PII including IP addresses?
  - tylerrobinson 4y ago
    The article says it: “The Italian SA reiterated that an IP address is a personal data”
  - walrusfromspace 4y ago
    The European Commission's official website[1] [1] https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-personal-data_en https://ec.europa.eu/info/law/law-topic/data-protection/refo...
- jeroenhd 4y ago
  You don't strictly need automated analytics to sell services to foreign customers. Collecting most if not all analytics is forbidden, for sure, but analytics and metrics aren't inherently required for businesses.
- dx034 4y ago
  Session cookies are allowed if the user agrees. And if the user doesn't agree, you have no right to process PII to group metrics over a session. That's the big shift here, assuming you have a right to build a profile on a user (or even evaluate their behavior) without their consent is not legal under GDPR. And as a European, I'm very glad that's the case. I know, we're still not close to compliance with GDPR, but it has changed the privacy discussion more than any other part.
- denton-scratch 4y ago
  > group metrics over a session How is that something that is essential to providing a service? I suppose that it's somehow "commercially advantageous", but there are many other commercially advantageous techniques that are simply illegal - such as taking a customer's money, but supplying zero in exchange. A company's profit needs are not an end-run around consumer protection laws (which is what GDPR amounts to).
M2Ys4U 4y ago
>They're perfectly legal if they don't process any PII. Personal data, not PII. The GDPR does not care about PII (except to the extent that the set of things that are PII is a subset of things that are personal data).