6 ms·

What relationship does a company need to have to UK to be subject to this? (Have an office in the UK? Use a SaaS/PaaS subject to UK? Have users from UK? Wan

by neilv 3y ago

What relationship does a company need to have to UK to be subject to this? (Have an office in the UK? Use a SaaS/PaaS subject to UK? Have users from UK? Want your iOS or Android app to be available from the official store to UK users? Want your DNS and routing to work in UK?)

olliej 3y ago
Most countries consider having users to be equivalent to having a presence, free or otherwise.
- awei 3y ago
  Would it apply to a website like Wikipedia for example ?
  - I_am_uncreative 3y ago
    Wikipedia is actually trying to figure that out. Right now WMF legal says no.
    - b800h 3y ago
      That surprises me. The legislation in the form I last saw it says that they're not allowed to show user generated content to children without an age-gated login.
      - ben_w 3y ago
        Your understanding of the law may be correct, but do remember that law is basically its own language with its own ideas of "common sense" and that if you're not legally trained (and even if you are but you've not read all the other laws that the law in question interacts with) then all sorts of weird misunderstandings can happen. (As your profile is empty, for all I know you've an actual lawyer in this specific field — NH is this kind of place after all — but most of us aren't, and I've been surprised by legal principles that LegalEagle has described as "law school 101, and I mean literally I taught XYZ in a 101 class").
    - awei 3y ago
      Thanks for your replies.
- lynx23 3y ago
  There you go. GDPR already made companies stop providing to users based on their location. This trend will likely continue.
  - jackjeff 3y ago
    How would these extra territorial laws be enforced? I mean I break Chinese law all the time; I have a blog without the necessary permits delivered by the PRC bureaucracy. How is this UK law any different? Unless you have some kind of tie to the UK why should you care? What are they going to do? They can’t fine you nor put you in jail. Are they going to block your sites? Then everybody in the UK will use VPNs (just like China) undermining the ability of the government to enforce such laws even further. GDPR was a EU law (much bigger than UK), it was not as tedious to comply with, and the PR would have been bad for any company breaching it. None of this is true here. The PR is actually good if you don’t follow this law; you can say you’re defending human rights and stuff.
    - b800h 3y ago
      All it'll do is kill off small businesses and hobby projects in the UK. I'm furious about it; the idiots just made BBSes, MUDs, Git and Telnet illegal. The big companies get regulatory capture of all social communications.
    - toyg 3y ago
      If you're not in the UK and not using major services, yes, you don't have to care. The problem is basically that the major services will likely have to comply, because they do have a sizeable UK presence they'll want to maintain, hence they will introduce anti-features that basically ruin it for everyone. And if they do comply, it gives rope for the government to go after smaller players that don't. As a UK resident, I hope this will go the way of anti-piracy legislation - i.e. enforced against big services only while everyone else just continues to do whatever they want.
    - saithound 3y ago
      How was Saudi law enforced on Jamal Khasogghi? How was Indian law enforced on Hardeep Nijjar? If the law won't be enforced on you in particular, it's because the UK government does not care enough to enforce it on you in particular. It has very little to do with where you live or what courts have "jurisdiction" over you. I doubt that social media execs would avoid traveling to the UK of all places in order to not piss off the handful (and I say this as a long-time EFF member) of people who really care about this law. To make things worse, major services tend to have presence in almost every country, especially the UK, and leadership tend to have personal connections and property in these places. They will just comply (as long as not offering their service in certain locations is an acceptabpe form of compliance, they might opt to do that if the financial calculus works out, but it's not necessarily an option at all). They don't even have to go straight to physical or financial punishment: if a service accept any kind of payment, they can get compliance by ezerting influence through various international card networks as well. If they don't have to comply, and can keep offering their service anyway, it's only because the UK didn't squeeze hard enough: but they could, and if they do, there'll be nothing your government or geographical location will do to protect you. There is no such thing as a sovereign entity "not having jurisdiction" over you: that would be an oxymoron, they do as they please by definition. If they don't make you comply with their orders, it's only because some economic factor prevents them from doing so.
- jauntywundrkind 3y ago
  [flagged]
  - dang 3y ago
    Please make your substantive points without fulminating. It's always possible, and it's in the site guidelines: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html.
    - lolrwtads 3y ago
      [flagged]
    - hackerdangluck 3y ago
      [flagged]
    - jauntywundrkind 3y ago
      [flagged]
      - dang 3y ago
        Users flagged those comments; mods didn't touch them.
        jauntywundrkind 3y ago
        Understood. I will work harder to try to insure my behavior always/consistently remains acceptable. It grates on me that discussions on national issues seems to be extra heavily shut down, and the yolk of moderation & being rate limited is an unceasing aggravation. But I will try to up my expectation of myself at all points, including my weakest. I wish there was some credit gained for being a good community poster, which I think I generally am. The only presence I see or feel is negative actions, is presence when things go bad. It's a one way relationship over only bad things.
b800h 3y ago
"Users in the UK". Yes, that means it applies to you if you run a Telnet server and a British person logs in to it and might find a text file created by someone from the US there. You need an age gate in front of the login, unless you can satisfactorily demonstrate that you have few under-18s as users. How to prove that? The law doesn't say.
- HeckFeck 3y ago
  IRCv3: now with age verification for our UK users!
- neilv 3y ago
  Under what circumstances is someone doing a startup in the US subject to this UK regulation?
  - b800h 3y ago
    If any of your users might conceivably be resident in Britain.
    - neilv 3y ago
      But we dumped all that tea in the harbor.
- msla 3y ago
  No. The UK doesn't get to enforce its law everywhere just because it says its law is enforceable everywhere. There's already precedent here: https://en.wikipedia.org/wiki/SPEECH_Act https://en.wikipedia.org/wiki/SPEECH_Act > The Securing the Protection of our Enduring and Established Constitutional Heritage (SPEECH) Act is a 2010 federal statutory law in the United States that makes foreign libel judgments unenforceable in U.S. courts, unless either the foreign legislation applied offers at least as much protection as the U.S. First Amendment (concerning freedom of speech), or the defendant would have been found liable even if the case had been heard under U.S. law. > The act was passed by the 111th United States Congress and signed into law by President Barack Obama. [snip] > The act was written as a response to libel tourism.[1] It creates a new cause of action and claim for damages against a foreign libel plaintiff, if they acted to deprive an American (or certain lawful aliens) of their right to free speech.[2] Despite its goals, it is seen as a weak response to the problem of libel tourism as, although it establishes a new cause of action in § 4104, and allows for the collection of "reasonable" attorneys' fees in § 4105,[note 1] it does not allow for damages to plaintiffs in contrast with stronger provisions in proposed bills which did not pass such as the Free Speech Protection Act of 2009 (H.R.1304, 111th Congress).[3]: 22 > It was inspired by the legal battle that ensued between Dr. Rachel Ehrenfeld and Saudi businessman Khalid bin Mahfouz over her 2003 book Funding Evil.[4] Just to make it even clearer: "Libel tourism" basically means taking your case to British courts, which are hilariously pro-plaintiff when it comes to libel. That's what happened with Ehrenfeld.
speak_plainly 3y ago
I wonder if you could just add a link to a terms of service for your site that explicitly states the site was not for use by users in the UK, and that they should ensure they’re following all laws and using the site at their own risk.
- WA 3y ago
  Nope, that's probably not enough. With regulation, you have to do two things: - Show that you are aware of the regulation - Implement some kind of thing to comply with the regulation. The degree of that is debatable and ultimately can only be decided by a court. Just pointing to a ToS is not enough, because nobody reads them. Implementing a geofence and denying service to UK ip addresses is probably a good start. If UK citizens want to access your service, they could still use a VPN, but then the "malice" is on them. The bigger/widespread your service, the more effort you might have to put in to prevent malicious intent. Think about this way: You are liable for the services you offer. You must comply with local laws. It's up to you how much liability you want to carry. If your compliance with laws is extremely weak, your liability is high.

by neilv 3y ago

olliej 3y ago

Most countries consider having users to be equivalent to having a presence, free or otherwise.

awei 3y ago
Would it apply to a website like Wikipedia for example ?
- I_am_uncreative 3y ago
  Wikipedia is actually trying to figure that out. Right now WMF legal says no.
  - b800h 3y ago
    That surprises me. The legislation in the form I last saw it says that they're not allowed to show user generated content to children without an age-gated login.
    - ben_w 3y ago
      Your understanding of the law may be correct, but do remember that law is basically its own language with its own ideas of "common sense" and that if you're not legally trained (and even if you are but you've not read all the other laws that the law in question interacts with) then all sorts of weird misunderstandings can happen. (As your profile is empty, for all I know you've an actual lawyer in this specific field — NH is this kind of place after all — but most of us aren't, and I've been surprised by legal principles that LegalEagle has described as "law school 101, and I mean literally I taught XYZ in a 101 class").
  - awei 3y ago
    Thanks for your replies.
lynx23 3y ago
There you go. GDPR already made companies stop providing to users based on their location. This trend will likely continue.
- jackjeff 3y ago
  How would these extra territorial laws be enforced? I mean I break Chinese law all the time; I have a blog without the necessary permits delivered by the PRC bureaucracy. How is this UK law any different? Unless you have some kind of tie to the UK why should you care? What are they going to do? They can’t fine you nor put you in jail. Are they going to block your sites? Then everybody in the UK will use VPNs (just like China) undermining the ability of the government to enforce such laws even further. GDPR was a EU law (much bigger than UK), it was not as tedious to comply with, and the PR would have been bad for any company breaching it. None of this is true here. The PR is actually good if you don’t follow this law; you can say you’re defending human rights and stuff.
  - b800h 3y ago
    All it'll do is kill off small businesses and hobby projects in the UK. I'm furious about it; the idiots just made BBSes, MUDs, Git and Telnet illegal. The big companies get regulatory capture of all social communications.
  - toyg 3y ago
    If you're not in the UK and not using major services, yes, you don't have to care. The problem is basically that the major services will likely have to comply, because they do have a sizeable UK presence they'll want to maintain, hence they will introduce anti-features that basically ruin it for everyone. And if they do comply, it gives rope for the government to go after smaller players that don't. As a UK resident, I hope this will go the way of anti-piracy legislation - i.e. enforced against big services only while everyone else just continues to do whatever they want.
  - saithound 3y ago
    How was Saudi law enforced on Jamal Khasogghi? How was Indian law enforced on Hardeep Nijjar? If the law won't be enforced on you in particular, it's because the UK government does not care enough to enforce it on you in particular. It has very little to do with where you live or what courts have "jurisdiction" over you. I doubt that social media execs would avoid traveling to the UK of all places in order to not piss off the handful (and I say this as a long-time EFF member) of people who really care about this law. To make things worse, major services tend to have presence in almost every country, especially the UK, and leadership tend to have personal connections and property in these places. They will just comply (as long as not offering their service in certain locations is an acceptabpe form of compliance, they might opt to do that if the financial calculus works out, but it's not necessarily an option at all). They don't even have to go straight to physical or financial punishment: if a service accept any kind of payment, they can get compliance by ezerting influence through various international card networks as well. If they don't have to comply, and can keep offering their service anyway, it's only because the UK didn't squeeze hard enough: but they could, and if they do, there'll be nothing your government or geographical location will do to protect you. There is no such thing as a sovereign entity "not having jurisdiction" over you: that would be an oxymoron, they do as they please by definition. If they don't make you comply with their orders, it's only because some economic factor prevents them from doing so.
jauntywundrkind 3y ago
[flagged]
- dang 3y ago
  Please make your substantive points without fulminating. It's always possible, and it's in the site guidelines: https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html.
  - lolrwtads 3y ago
    [flagged]
  - hackerdangluck 3y ago
    [flagged]
  - jauntywundrkind 3y ago
    [flagged]
    - dang 3y ago
      Users flagged those comments; mods didn't touch them.
      - jauntywundrkind 3y ago
        Understood. I will work harder to try to insure my behavior always/consistently remains acceptable. It grates on me that discussions on national issues seems to be extra heavily shut down, and the yolk of moderation & being rate limited is an unceasing aggravation. But I will try to up my expectation of myself at all points, including my weakest. I wish there was some credit gained for being a good community poster, which I think I generally am. The only presence I see or feel is negative actions, is presence when things go bad. It's a one way relationship over only bad things.

b800h 3y ago

"Users in the UK". Yes, that means it applies to you if you run a Telnet server and a British person logs in to it and might find a text file created by someone from the US there. You need an age gate in front of the login, unless you can satisfactorily demonstrate that you have few under-18s as users. How to prove that? The law doesn't say.

HeckFeck 3y ago
IRCv3: now with age verification for our UK users!
neilv 3y ago
Under what circumstances is someone doing a startup in the US subject to this UK regulation?
- b800h 3y ago
  If any of your users might conceivably be resident in Britain.
  - neilv 3y ago
    But we dumped all that tea in the harbor.
msla 3y ago
No. The UK doesn't get to enforce its law everywhere just because it says its law is enforceable everywhere. There's already precedent here: https://en.wikipedia.org/wiki/SPEECH_Act https://en.wikipedia.org/wiki/SPEECH_Act > The Securing the Protection of our Enduring and Established Constitutional Heritage (SPEECH) Act is a 2010 federal statutory law in the United States that makes foreign libel judgments unenforceable in U.S. courts, unless either the foreign legislation applied offers at least as much protection as the U.S. First Amendment (concerning freedom of speech), or the defendant would have been found liable even if the case had been heard under U.S. law. > The act was passed by the 111th United States Congress and signed into law by President Barack Obama. [snip] > The act was written as a response to libel tourism.[1] It creates a new cause of action and claim for damages against a foreign libel plaintiff, if they acted to deprive an American (or certain lawful aliens) of their right to free speech.[2] Despite its goals, it is seen as a weak response to the problem of libel tourism as, although it establishes a new cause of action in § 4104, and allows for the collection of "reasonable" attorneys' fees in § 4105,[note 1] it does not allow for damages to plaintiffs in contrast with stronger provisions in proposed bills which did not pass such as the Free Speech Protection Act of 2009 (H.R.1304, 111th Congress).[3]: 22 > It was inspired by the legal battle that ensued between Dr. Rachel Ehrenfeld and Saudi businessman Khalid bin Mahfouz over her 2003 book Funding Evil.[4] Just to make it even clearer: "Libel tourism" basically means taking your case to British courts, which are hilariously pro-plaintiff when it comes to libel. That's what happened with Ehrenfeld.

speak_plainly 3y ago

I wonder if you could just add a link to a terms of service for your site that explicitly states the site was not for use by users in the UK, and that they should ensure they’re following all laws and using the site at their own risk.

WA 3y ago
Nope, that's probably not enough. With regulation, you have to do two things: - Show that you are aware of the regulation - Implement some kind of thing to comply with the regulation. The degree of that is debatable and ultimately can only be decided by a court. Just pointing to a ToS is not enough, because nobody reads them. Implementing a geofence and denying service to UK ip addresses is probably a good start. If UK citizens want to access your service, they could still use a VPN, but then the "malice" is on them. The bigger/widespread your service, the more effort you might have to put in to prevent malicious intent. Think about this way: You are liable for the services you offer. You must comply with local laws. It's up to you how much liability you want to carry. If your compliance with laws is extremely weak, your liability is high.