4 ms·

So if I’m an American company and have no offices in Europe and ignore GDPR for my free customers, what happens? Will I get arrested by the Polizei when I land

by wincy 4y ago

So if I’m an American company and have no offices in Europe and ignore GDPR for my free customers, what happens? Will I get arrested by the Polizei when I land in Berlin? Will the US force me to pay these fines?

femboy 4y ago
Yes, the European Commission will collaborate with international governments to impose fines.
- knaekhoved 4y ago
  Which international governments? Why would the US agree to impose an EU fine, and under what legal basis?
  - akuji1993 4y ago
    Why would European countries extradite american criminals to the US? Because we established a trust in each other and want to keep it that way for both sides benefits.
    - eldaisfish 4y ago
      this is a poor comparison. Extradition treaties exist and contain specific legal obligations. It is not based on trust and there are several pairs of countries that do not have specific extradition treaties.
      - xphx 4y ago
        > treaties [...] not based on trust How are these treaties enforced? All international treaties are ultimately based on trust. There is no higher authority, only elective councils of and voluntary commitment to procedures (a.k.a. promises) by sovereign states. Specifically not even these formal promises have been given by e.g. the United States of America which to this day has signed but never ratified either the VCLT[1] or the VCLTIO[2], so is figuratively giving a lukewarm "let's see about the convenience of that when it comes up". 1: https://en.wikipedia.org/wiki/Vienna_Convention_on_the_Law_of_Treaties https://en.wikipedia.org/wiki/Vienna_Convention_on_the_Law_o... 2: https://en.wikipedia.org/wiki/Vienna_Convention_on_the_Law_of_Treaties_between_States_and_International_Organizations_or_Between_International_Organizations https://en.wikipedia.org/wiki/Vienna_Convention_on_the_Law_o...
- JaredLee 4y ago
  No, they will not. If you're a company with a substantial enough userbase in their country to be investigated under their regulations, then failing to follow them and/or ignoring fines will most likely result in them preventing your services from being accessed in their country.
knaekhoved 4y ago
My question as well. Can a non-EU company simply refuse to pay, and also refuse to block users from the EU? I wonder if the EU would decide to block access to the foreign service as a result. It would at least force them to be honest about the fact that they're effectively turning the internet into a legal-regional network rather than a global one.
- oblio 4y ago
  > It would at least force them to be honest about the fact that they're effectively turning the internet into a legal-regional network rather than a global one. This happened a long time ago. And it was started by the US, I'm quite sure. More than that, the American way to manage the "global network" is basically to impose US laws everywhere in the world. You can receive DMCA notices outside the US, for example. Or even crazier: https://en.wikipedia.org/wiki/United_States_v._Elcom_Ltd https://en.wikipedia.org/wiki/United_States_v._Elcom_Ltd. Someone arrested, in the US, for a "crime" in another country, that wasn't even a crime in his country.
  - swores 4y ago
    > The case raised some concerns of civil rights and legal process in the United States, and ended in the charges against Sklyarov dropped and Elcomsoft ruled not guilty under the applicable jurisdiction. So it's an example of "law enforcement can and sometimes do illegally attest / cause other issues unfairly", but not really a good example of a law being imposed outside the country which made that law.
    - oblio 4y ago
      That's just an egregious example, but there were also literal international trade treaties where the US basically imposed adoption of the DMCA as a condition. Also the fact that many major tech companies are American means that US laws are basically enforced on all of their users, which is super crazy. Including stuff like... https://en.wikipedia.org/wiki/CLOUD_Act https://en.wikipedia.org/wiki/CLOUD_Act > The CLOUD Act primarily amends the Stored Communications Act (SCA) of 1986 to allow federal law enforcement to compel U.S.-based technology companies via warrant or subpoena to provide requested data stored on servers regardless of whether the data are stored in the U.S. or on foreign soil. This includes foreign based subsidiaries! So if the US Gov decides that Facebook needs to give something over, everything and everyone owned by Facebook, everywhere around the world, needs to comply. So Facebook Zambia needs to hand over the data to Facebook US. On paper there are some protections, but I'd really, really want to see how well they're enforced (I doubt it). It's so bad cloud providers have pages about it: https://aws.amazon.com/compliance/cloud-act/ https://aws.amazon.com/compliance/cloud-act/ Where they basically say: "yeah, it's true, we'll fight in a court of law on your behalf, because otherwise a huge chunk of you in other countries would never use us".
sva_ 4y ago
Basically, if you do business in the EU (have customers there) then you'll be held accountable.
- spiffytech 4y ago
  Or if you have non-paying users. Commerce is not a requirement for being subject to the GDPR.
kome 4y ago
I think, de facto, nothing will happen. But if you start to evade taxes on your foreigner paying costumers, and you avoid local regulations, then you expose yourself to a risk.
dandellion 4y ago
Probably nothing happens. I doubt they're going to spend time investigating a company that doesn't do any business in Europe, when there's a very long list of bigger companies that do operate here and break our privacy and sell our data.
- akuji1993 4y ago
  If the company doesn't do any business in Europe it has no users in Europe, therefore it doesn't have to comply with the GDRP at all.
  - blibble 4y ago
    GDPR is extra-territorial and its rights apply to EU citizens wherever they are in the world if a EU user is in the US ON HOLIDAY! and they're using your service, you're subject to the GDPR (in theory)
    - buzer 4y ago
      No. GDPR isn't tied to citizenship. EU citizens & residents are not covered by GDPR when they are outside of EU unless member state's law applies by virtue of public international law (https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/). A bit more unclear situation is if non-resident is visiting EU and uses services from their home country.
      - blibble 4y ago
        like most EU law it's badly written, but it states "to such data subjects in the Union" given "within the Union" is used separately in the next sub-article to mean physically located within, it's arguable that "in the Union" could mean citizen of
matkoniecz 4y ago
Seizing income originating from Europe, seizing payments to European companies seems obvious steps. > Will I get arrested by the Polizei when I land in Berlin? Maybe also this. > Will the US force me to pay these fines? I am also curious.
muspimerol 4y ago
My suspicion is that only companies with significant business interests in the EU are targeted, investigated and fined. Otherwise they could just ignore it.
- thefz 4y ago
  You sure? Lots of small fish are caught in this net. https://www.enforcementtracker.com/ https://www.enforcementtracker.com/

by wincy 4y ago

femboy 4y ago

Yes, the European Commission will collaborate with international governments to impose fines.

knaekhoved 4y ago
Which international governments? Why would the US agree to impose an EU fine, and under what legal basis?
- akuji1993 4y ago
  Why would European countries extradite american criminals to the US? Because we established a trust in each other and want to keep it that way for both sides benefits.
  - eldaisfish 4y ago
    this is a poor comparison. Extradition treaties exist and contain specific legal obligations. It is not based on trust and there are several pairs of countries that do not have specific extradition treaties.
    - xphx 4y ago
      > treaties [...] not based on trust How are these treaties enforced? All international treaties are ultimately based on trust. There is no higher authority, only elective councils of and voluntary commitment to procedures (a.k.a. promises) by sovereign states. Specifically not even these formal promises have been given by e.g. the United States of America which to this day has signed but never ratified either the VCLT[1] or the VCLTIO[2], so is figuratively giving a lukewarm "let's see about the convenience of that when it comes up". 1: https://en.wikipedia.org/wiki/Vienna_Convention_on_the_Law_of_Treaties https://en.wikipedia.org/wiki/Vienna_Convention_on_the_Law_o... 2: https://en.wikipedia.org/wiki/Vienna_Convention_on_the_Law_of_Treaties_between_States_and_International_Organizations_or_Between_International_Organizations https://en.wikipedia.org/wiki/Vienna_Convention_on_the_Law_o...
JaredLee 4y ago
No, they will not. If you're a company with a substantial enough userbase in their country to be investigated under their regulations, then failing to follow them and/or ignoring fines will most likely result in them preventing your services from being accessed in their country.

knaekhoved 4y ago

My question as well. Can a non-EU company simply refuse to pay, and also refuse to block users from the EU? I wonder if the EU would decide to block access to the foreign service as a result. It would at least force them to be honest about the fact that they're effectively turning the internet into a legal-regional network rather than a global one.

oblio 4y ago
> It would at least force them to be honest about the fact that they're effectively turning the internet into a legal-regional network rather than a global one. This happened a long time ago. And it was started by the US, I'm quite sure. More than that, the American way to manage the "global network" is basically to impose US laws everywhere in the world. You can receive DMCA notices outside the US, for example. Or even crazier: https://en.wikipedia.org/wiki/United_States_v._Elcom_Ltd https://en.wikipedia.org/wiki/United_States_v._Elcom_Ltd. Someone arrested, in the US, for a "crime" in another country, that wasn't even a crime in his country.
- swores 4y ago
  > The case raised some concerns of civil rights and legal process in the United States, and ended in the charges against Sklyarov dropped and Elcomsoft ruled not guilty under the applicable jurisdiction. So it's an example of "law enforcement can and sometimes do illegally attest / cause other issues unfairly", but not really a good example of a law being imposed outside the country which made that law.
  - oblio 4y ago
    That's just an egregious example, but there were also literal international trade treaties where the US basically imposed adoption of the DMCA as a condition. Also the fact that many major tech companies are American means that US laws are basically enforced on all of their users, which is super crazy. Including stuff like... https://en.wikipedia.org/wiki/CLOUD_Act https://en.wikipedia.org/wiki/CLOUD_Act > The CLOUD Act primarily amends the Stored Communications Act (SCA) of 1986 to allow federal law enforcement to compel U.S.-based technology companies via warrant or subpoena to provide requested data stored on servers regardless of whether the data are stored in the U.S. or on foreign soil. This includes foreign based subsidiaries! So if the US Gov decides that Facebook needs to give something over, everything and everyone owned by Facebook, everywhere around the world, needs to comply. So Facebook Zambia needs to hand over the data to Facebook US. On paper there are some protections, but I'd really, really want to see how well they're enforced (I doubt it). It's so bad cloud providers have pages about it: https://aws.amazon.com/compliance/cloud-act/ https://aws.amazon.com/compliance/cloud-act/ Where they basically say: "yeah, it's true, we'll fight in a court of law on your behalf, because otherwise a huge chunk of you in other countries would never use us".

sva_ 4y ago

Basically, if you do business in the EU (have customers there) then you'll be held accountable.

spiffytech 4y ago
Or if you have non-paying users. Commerce is not a requirement for being subject to the GDPR.

kome 4y ago

I think, de facto, nothing will happen. But if you start to evade taxes on your foreigner paying costumers, and you avoid local regulations, then you expose yourself to a risk.

dandellion 4y ago

Probably nothing happens. I doubt they're going to spend time investigating a company that doesn't do any business in Europe, when there's a very long list of bigger companies that do operate here and break our privacy and sell our data.

akuji1993 4y ago
If the company doesn't do any business in Europe it has no users in Europe, therefore it doesn't have to comply with the GDRP at all.
- blibble 4y ago
  GDPR is extra-territorial and its rights apply to EU citizens wherever they are in the world if a EU user is in the US ON HOLIDAY! and they're using your service, you're subject to the GDPR (in theory)
  - buzer 4y ago
    No. GDPR isn't tied to citizenship. EU citizens & residents are not covered by GDPR when they are outside of EU unless member state's law applies by virtue of public international law (https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/). A bit more unclear situation is if non-resident is visiting EU and uses services from their home country.
    - blibble 4y ago
      like most EU law it's badly written, but it states "to such data subjects in the Union" given "within the Union" is used separately in the next sub-article to mean physically located within, it's arguable that "in the Union" could mean citizen of

matkoniecz 4y ago

Seizing income originating from Europe, seizing payments to European companies seems obvious steps. > Will I get arrested by the Polizei when I land in Berlin? Maybe also this. > Will the US force me to pay these fines? I am also curious.

muspimerol 4y ago

My suspicion is that only companies with significant business interests in the EU are targeted, investigated and fined. Otherwise they could just ignore it.

thefz 4y ago
You sure? Lots of small fish are caught in this net. https://www.enforcementtracker.com/ https://www.enforcementtracker.com/