25 ms·

To be fair to them, it was the court that compelled them to do this. They didn't choose to do it.

by darawk 4y ago

hericium 4y ago
I wonder if asking European GDPR bodies to penalize US court for forcing someone to publish private data of EU citizens would generate a response.
- ayende 4y ago
  What would this "penalize" US court look like? And what do you think the US reaction to something like that would be?
  - lmm 4y ago
    > What would this "penalize" US court look like? Asking them to pay a fine, ultimately backed by the threat of perhaps imposing tarrifs or seizing their assets in the EU. > And what do you think the US reaction to something like that would be? It would be negotiated, there would be a line in some treaty somewhere, most likely a fraction of a percent in the next trade deal. Yes, the US is the mightiest country around, but that doesn't mean it can act with complete impunity. Publishing EU citizens' details without due process or compensation is no different from e.g. seizing the assets of an EU company without due process or compensation - something which would and should trigger a diplomatic protest.
    - Asparagirl 4y ago
      Your statement is fantasyland. It’s absolutely legal in the US to publish “EU citizens’ details”! It’s not a crime, and it’s not even against the GDPR at all. The GDPR is explicitly about EU companies (or American companies with EU subsidiaries) that have EU-based customer data. An American bankruptcy court, or any kind of court, is not an EU company, or any kind of company.
      - nielsole 4y ago
        Article 2 > This Regulation does not apply to the processing of personal data: in the course of an activity which falls outside the scope of Union law; Article 3 > This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or (b) the monitoring of their behaviour as far as their behaviour takes place within the Union. Article 4 > ‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; It is about data controllers, not companies - independent of the location of the controller. Celsius might be in the clear due to Article 2 (IANAL), but GDPR definitely applies to data controllers who have no EU subsidiaries irrespective of whether they are a company.
        raverbashing 4y ago
        Celsius is failing art 3 but court procedures usually fall outside of GDPR
        sgjohnson 4y ago
        GDPR is absolutely unenforceable in cases where the data controller has no presence in the EU. The EU can scream all they want, but they have no recourse whatsoever. Also, extraterritoriality is ass.
        lmm 4y ago
        The EU has armies and navies, they have recourse if they care enough.
        sgjohnson 4y ago
        Surely you’re not serious, and even if you were serious, you probably know full and well that only the United States can get away with that kind of behaviour...
- adastra22 4y ago
  Why would they have any jurisdiction over a US court?
- Asparagirl 4y ago
  GDPR applies to companies doing business in Europe. An American court is neither a company nor in Europe.
  - fxtentacle 4y ago
    GDPR applies to doing business with EU citizens. That's why a US company like Meta can be held responsible for data stored in the US if it's about EU subjects.
    - bee_rider 4y ago
      Putting aside the fact that a US court is not a company doing business, the distinction still seems sort of academic. Of course the EU can pass whatever laws they want, but entities doing business with EU citizens, which don't have a presence inside the EU, will be hard to prosecute in EU courts.
  - sofixa 4y ago
    No, the GDPR applies to processing or control of personal data of EU citizens. There's even an explicit "what about if neither of those are in the EU(not Europe): This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or the monitoring of their behaviour as far as their behaviour takes place within the Union. https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/ I'm not sure an American court fits either of those conditions, but it's absolutely not limited to companies doing business in Europe.
    - sgjohnson 4y ago
      They can claim extraterritoriality all they want, but they have no recourse whasoever if the data controller or processor has no presence in the EU. What are they going to do? Send them a mean letter?
  - 4y ago
- Ekaros 4y ago
  I don't think this goes against GDPR. There is legitimate reasons to handle and even publish this list. Now holding to this list or using it for unrelated purpose would go against GDRP.

To be fair to them, it was the court that compelled them to do this. They didn't choose to do it.

by darawk 4y ago

To be fair to them, it was the court that compelled them to do this. They didn't choose to do it.

I wonder if asking European GDPR bodies to penalize US court for forcing someone to publish private data of EU citizens would generate a response.

ayende 4y ago
What would this "penalize" US court look like? And what do you think the US reaction to something like that would be?
- lmm 4y ago
  > What would this "penalize" US court look like? Asking them to pay a fine, ultimately backed by the threat of perhaps imposing tarrifs or seizing their assets in the EU. > And what do you think the US reaction to something like that would be? It would be negotiated, there would be a line in some treaty somewhere, most likely a fraction of a percent in the next trade deal. Yes, the US is the mightiest country around, but that doesn't mean it can act with complete impunity. Publishing EU citizens' details without due process or compensation is no different from e.g. seizing the assets of an EU company without due process or compensation - something which would and should trigger a diplomatic protest.
  - Asparagirl 4y ago
    Your statement is fantasyland. It’s absolutely legal in the US to publish “EU citizens’ details”! It’s not a crime, and it’s not even against the GDPR at all. The GDPR is explicitly about EU companies (or American companies with EU subsidiaries) that have EU-based customer data. An American bankruptcy court, or any kind of court, is not an EU company, or any kind of company.
    - nielsole 4y ago
      Article 2 > This Regulation does not apply to the processing of personal data: in the course of an activity which falls outside the scope of Union law; Article 3 > This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or (b) the monitoring of their behaviour as far as their behaviour takes place within the Union. Article 4 > ‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; It is about data controllers, not companies - independent of the location of the controller. Celsius might be in the clear due to Article 2 (IANAL), but GDPR definitely applies to data controllers who have no EU subsidiaries irrespective of whether they are a company.
      - raverbashing 4y ago
        Celsius is failing art 3 but court procedures usually fall outside of GDPR
      - sgjohnson 4y ago
        GDPR is absolutely unenforceable in cases where the data controller has no presence in the EU. The EU can scream all they want, but they have no recourse whatsoever. Also, extraterritoriality is ass.
        lmm 4y ago
        The EU has armies and navies, they have recourse if they care enough.
        sgjohnson 4y ago
        Surely you’re not serious, and even if you were serious, you probably know full and well that only the United States can get away with that kind of behaviour...
adastra22 4y ago
Why would they have any jurisdiction over a US court?
Asparagirl 4y ago
GDPR applies to companies doing business in Europe. An American court is neither a company nor in Europe.
- fxtentacle 4y ago
  GDPR applies to doing business with EU citizens. That's why a US company like Meta can be held responsible for data stored in the US if it's about EU subjects.
  - bee_rider 4y ago
    Putting aside the fact that a US court is not a company doing business, the distinction still seems sort of academic. Of course the EU can pass whatever laws they want, but entities doing business with EU citizens, which don't have a presence inside the EU, will be hard to prosecute in EU courts.
- sofixa 4y ago
  No, the GDPR applies to processing or control of personal data of EU citizens. There's even an explicit "what about if neither of those are in the EU(not Europe): This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or the monitoring of their behaviour as far as their behaviour takes place within the Union. https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/ I'm not sure an American court fits either of those conditions, but it's absolutely not limited to companies doing business in Europe.
  - sgjohnson 4y ago
    They can claim extraterritoriality all they want, but they have no recourse whasoever if the data controller or processor has no presence in the EU. What are they going to do? Send them a mean letter?
- 4y ago
Ekaros 4y ago
I don't think this goes against GDPR. There is legitimate reasons to handle and even publish this list. Now holding to this list or using it for unrelated purpose would go against GDRP.