4 ms·

Very few websites comply with GDPR. Based on recent interpretations, it's essentially impossible for any US-owned or US-hosted site to comply with GDPR. The EU

Very few websites comply with GDPR. Based on recent interpretations, it's essentially impossible for any US-owned or US-hosted site to comply with GDPR. The EU is just being extremely selective about its enforcement. If they ever decided to follow the law to the letter, most of the Internet would have to disconnect the EU. Theoretically the EU could make clones of all international sites like China has with Baidu and Weibo, but it's hard to see how that would be good for them. The UK's law is obviously a bit different as international companies can comply with them, but it would essentially just limit legal websites to big tech who have enough market reach that all that compliance could pay for itself.

akavel 4y ago
Regarding GDPR, citation needed - do you have actual links you can share to those claimed "recent interpretations", and whose in particular they are? I'd be quite interested to see them, if true ,which I seriously doubt - for the time being, as an EU citizen, my understanding is, and continues to be, that it's totally possible for US corpos to adhere to GDPR; it would just require some money and effort to be spent by companies that blatantly hoover and hoard personally identifying data in hopes of squeezing some monies from it. And having to spend some money on anything that is not an investment into more money in the future seems to always trigger over-the-top allergic reaction in corporations. Until they feel the teeth of real law in painful fines, when suddenly "impossible" things will magically become possible.
- mminer237 4y ago
  They're decisions by the governments of Germany, France, and Italy: * https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/ https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/ * https://www.cnil.fr/en/use-google-analytics-and-data-transfers-united-states-cnil-orders-website-manageroperator-comply https://www.cnil.fr/en/use-google-analytics-and-data-transfe... * https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9782890 https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/d... So far they've just been enforced against companies that use Google Analytics, but the reasoning behind it has been that having users connect to a US server enables that server to know EU users' IP addresses (which are legally PII), which would be subject to US government subpoenas to collect such, and the US government has not agreed to handle data in compliance with the GDPR, therefore it's illegal to have users connect to any US servers. It has nothing to do with "hoover[ing] and hoard[ing]" data. The only way for an American website to comply would be to form a separate company not subject to US control at all. However, at that point it's not really an American website, since no data or control can go to the US. Theoretically you could use some international service to handle all primary routing and get users to waive their rights under the GDPR before connecting to your website proper, but I'm not aware of such a service at this time.
  - akavel 4y ago
    Doesn't seem so clear cut to me yet, but I see what you're hinting at. The first one seems about Google Fonts specifically, together with IPs indeed, but not mentioning US govt subpoenas at all (at least in the English translation of the abstract). Personally, I long believed Google Fonts are a risk from privacy standpoint and not really necessary, just easy - this seems to basically be reflected in the abstract and makes me quite happy. Interestingly, it seems to mention severity of the privacy abuse potential vs. benefit, which again sounds great to me. Now, the 2nd one mentions GA and subpoenas, so this becomes more tricky and I wonder what will come of it. Though for the time being, GA is exactly a target I hoped would be regulated, so again rather happy for now, though I see how this seems indeed a concern dealing with any US company. And how connecting the two (i.e. IPs as PII + US govt subpoenas) becomes a concern as well. IANAL, obviously, though. But interesting, thanks!
  - calvinmorrison 4y ago
    I don't really think being a good 'worldwide' business can exist when longterm there are conflicting views held by governments about what is right. The fact is some governments and societies values are objectively better than others
  - jhgb 4y ago
    How does any of those things make it "essentially impossible for any US-owned or US-hosted site to comply with GDPR"? Is it legally required in the US, for example, to use Google Analytics?
    - mminer237 4y ago
      No, but that's irrelevant. It's illegal for an American to host a home server with EU visitors for the same reason it's illegal for them to use AWS or Google Analytics. A GDPR-compliant website can't embed Google Analytics or Google Fonts or a US-hosted image because then the host could log those IP addresses and the host could be subject to a US warrant. Likewise, a GDPR-compliant site can't be operated or hosted by an American because then the operator/host could be logging visitor IP addresses and be subject to a warrant and be compelled to give the government the evidence.
- KptMarchewa 4y ago
  US cloud act makes it impossible for any US company to both collect any personal data and be fully compliant with GDPR.
lmm 4y ago
> Theoretically the EU could make clones of all international sites like China has with Baidu and Weibo, but it's hard to see how that would be good for them. We would have real privacy protection, and presumably in the very long term we'd see the benefits of that (more creative new ideas coming out of the EU, wealthy people preferring to live in the EU...).
- unmole 4y ago
  > wealthy people preferring to live in the EU Wealthy people care a lot more about taxes than vague notions of privacy protection.
  - lmm 4y ago
    > Wealthy people care a lot more about taxes than vague notions of privacy protection. Wealthy people are already willing to pay a premium for the sake of privacy. Look at Zuck buying his neighbours' houses.
    - unmole 4y ago
      Actual physical separation and privacy. Not vague notions of privacy protection.
- novok 4y ago
  Seeing how the EU political set also is trying to get rid of E2EE messengers and such, I get a feeling it will not shake out that way either. It might make it worse, because they would have full legal and extra legal thumbscrews to apply to these EU only companies.
ryandrake 4y ago
> If they ever decided to follow the law to the letter, most of the Internet would have to disconnect the EU. Or those sites would have to comply with GDPR. Why is that not an option?
- mminer237 4y ago
  Because no US company can exempt itself from complying with US warrants. Thus, the EU always views data as being potentially shared with the US government. The GDPR prohibits even making a log of IP addresses if there's any US control over it.
raxxorraxor 4y ago
Well, the EU itself adheres to law very selectively itself. For example for surveillance. They retroactively legalized mass surveillance by European authorities to make the impression that the law is more relevant than it actually is.
- doikor 4y ago
  Not really as GDPR has specific provisions for governments to collect data for national security/defence, prevention/investigation of crimes, etc . So they did not have to retroactively change anything as it was written into the law from the beginning.
pimterry 4y ago
> If they ever decided to follow the law to the letter, most of the Internet would have to disconnect the EU It's worth noting that it's the US that would be isolated here, not the EU. A very large number of other non-EU countries have implemented/are currently implementing extremely similar legislation to the GDPR, including Brazil, Israel, South Korea, Argentina, Canada, Japan, India, New Zealand, Indonesia, etc. If the world eventually splits into "privacy-required" vs "privacy-optional" internets, the US will be one of few major countries in the latter camp. Yes, clearly the US-based internet is a large chunk, but long-term isolating the US internet entirely from most of the rest of the world will have a meaningful impact. The EU has an list of countries whose current protections they officially recognize as already equivalent to the GDPR here: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en https://ec.europa.eu/info/law/law-topic/data-protection/inte...

akavel 4y ago

Regarding GDPR, citation needed - do you have actual links you can share to those claimed "recent interpretations", and whose in particular they are? I'd be quite interested to see them, if true ,which I seriously doubt - for the time being, as an EU citizen, my understanding is, and continues to be, that it's totally possible for US corpos to adhere to GDPR; it would just require some money and effort to be spent by companies that blatantly hoover and hoard personally identifying data in hopes of squeezing some monies from it. And having to spend some money on anything that is not an investment into more money in the future seems to always trigger over-the-top allergic reaction in corporations. Until they feel the teeth of real law in painful fines, when suddenly "impossible" things will magically become possible.

mminer237 4y ago
They're decisions by the governments of Germany, France, and Italy: * https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/ https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/ * https://www.cnil.fr/en/use-google-analytics-and-data-transfers-united-states-cnil-orders-website-manageroperator-comply https://www.cnil.fr/en/use-google-analytics-and-data-transfe... * https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9782890 https://www.gpdp.it/web/guest/home/docweb/-/docweb-display/d... So far they've just been enforced against companies that use Google Analytics, but the reasoning behind it has been that having users connect to a US server enables that server to know EU users' IP addresses (which are legally PII), which would be subject to US government subpoenas to collect such, and the US government has not agreed to handle data in compliance with the GDPR, therefore it's illegal to have users connect to any US servers. It has nothing to do with "hoover[ing] and hoard[ing]" data. The only way for an American website to comply would be to form a separate company not subject to US control at all. However, at that point it's not really an American website, since no data or control can go to the US. Theoretically you could use some international service to handle all primary routing and get users to waive their rights under the GDPR before connecting to your website proper, but I'm not aware of such a service at this time.
- akavel 4y ago
  Doesn't seem so clear cut to me yet, but I see what you're hinting at. The first one seems about Google Fonts specifically, together with IPs indeed, but not mentioning US govt subpoenas at all (at least in the English translation of the abstract). Personally, I long believed Google Fonts are a risk from privacy standpoint and not really necessary, just easy - this seems to basically be reflected in the abstract and makes me quite happy. Interestingly, it seems to mention severity of the privacy abuse potential vs. benefit, which again sounds great to me. Now, the 2nd one mentions GA and subpoenas, so this becomes more tricky and I wonder what will come of it. Though for the time being, GA is exactly a target I hoped would be regulated, so again rather happy for now, though I see how this seems indeed a concern dealing with any US company. And how connecting the two (i.e. IPs as PII + US govt subpoenas) becomes a concern as well. IANAL, obviously, though. But interesting, thanks!
- calvinmorrison 4y ago
  I don't really think being a good 'worldwide' business can exist when longterm there are conflicting views held by governments about what is right. The fact is some governments and societies values are objectively better than others
- jhgb 4y ago
  How does any of those things make it "essentially impossible for any US-owned or US-hosted site to comply with GDPR"? Is it legally required in the US, for example, to use Google Analytics?
  - mminer237 4y ago
    No, but that's irrelevant. It's illegal for an American to host a home server with EU visitors for the same reason it's illegal for them to use AWS or Google Analytics. A GDPR-compliant website can't embed Google Analytics or Google Fonts or a US-hosted image because then the host could log those IP addresses and the host could be subject to a US warrant. Likewise, a GDPR-compliant site can't be operated or hosted by an American because then the operator/host could be logging visitor IP addresses and be subject to a warrant and be compelled to give the government the evidence.
KptMarchewa 4y ago
US cloud act makes it impossible for any US company to both collect any personal data and be fully compliant with GDPR.

lmm 4y ago

> Theoretically the EU could make clones of all international sites like China has with Baidu and Weibo, but it's hard to see how that would be good for them. We would have real privacy protection, and presumably in the very long term we'd see the benefits of that (more creative new ideas coming out of the EU, wealthy people preferring to live in the EU...).

unmole 4y ago
> wealthy people preferring to live in the EU Wealthy people care a lot more about taxes than vague notions of privacy protection.
- lmm 4y ago
  > Wealthy people care a lot more about taxes than vague notions of privacy protection. Wealthy people are already willing to pay a premium for the sake of privacy. Look at Zuck buying his neighbours' houses.
  - unmole 4y ago
    Actual physical separation and privacy. Not vague notions of privacy protection.
novok 4y ago
Seeing how the EU political set also is trying to get rid of E2EE messengers and such, I get a feeling it will not shake out that way either. It might make it worse, because they would have full legal and extra legal thumbscrews to apply to these EU only companies.

ryandrake 4y ago

> If they ever decided to follow the law to the letter, most of the Internet would have to disconnect the EU. Or those sites would have to comply with GDPR. Why is that not an option?

mminer237 4y ago
Because no US company can exempt itself from complying with US warrants. Thus, the EU always views data as being potentially shared with the US government. The GDPR prohibits even making a log of IP addresses if there's any US control over it.

raxxorraxor 4y ago

Well, the EU itself adheres to law very selectively itself. For example for surveillance. They retroactively legalized mass surveillance by European authorities to make the impression that the law is more relevant than it actually is.

doikor 4y ago
Not really as GDPR has specific provisions for governments to collect data for national security/defence, prevention/investigation of crimes, etc . So they did not have to retroactively change anything as it was written into the law from the beginning.

pimterry 4y ago

> If they ever decided to follow the law to the letter, most of the Internet would have to disconnect the EU It's worth noting that it's the US that would be isolated here, not the EU. A very large number of other non-EU countries have implemented/are currently implementing extremely similar legislation to the GDPR, including Brazil, Israel, South Korea, Argentina, Canada, Japan, India, New Zealand, Indonesia, etc. If the world eventually splits into "privacy-required" vs "privacy-optional" internets, the US will be one of few major countries in the latter camp. Yes, clearly the US-based internet is a large chunk, but long-term isolating the US internet entirely from most of the rest of the world will have a meaningful impact. The EU has an list of countries whose current protections they officially recognize as already equivalent to the GDPR here: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en https://ec.europa.eu/info/law/law-topic/data-protection/inte...