12 ms·

GDPR applies when you have EU users. Legal presence is irrelevant. Enforcement is obviously a different matter.

by _Algernon_ 3y ago

MichaelZuo 3y ago
Based on what reasoning? I don't think the US has signed a treaty with the EU regarding it?
- sebastiennight 3y ago
  We don't need you (whatever "you" means) to sign a treaty with "us" in order for "our" law to apply when you deal with "our" citizens. Sometimes there is zero leverage and "you" can't be found/sued/fined. But for large companies, there's no easy way out. That's why Meta is in hot waters ; they can't just say "oh we'll put our HQ back in California and now the EU can't say anything about how we collect data/show ads to EU users". That can't fly. Even if you made up a new country and went there (with no treaty), you'd still be outside the local law of the users you're dealing with, and there are many ways for the user's jurisdiction to apply leverage if you're enough of a big deal.
  - MichaelZuo 3y ago
    > We don't need you (whatever "you" means) to sign a treaty with "us" in order for "our" law to apply when you deal with "our" citizens. Because...?
  - Turing_Machine 3y ago
    > We don't need you (whatever "you" means) to sign a treaty with "us" in order for "our" law to apply when you deal with "our" citizens. "We're" not responsible for abiding by "your" laws, whether "your" citizens are involved or not. Do "you" abide by (one example among many) the US Second Amendment when "our" citizens are visiting "your" country? No, you do not. QED.
    - sebastiennight 3y ago
      Well, according to what I could find[1], > Like the General Data Protection Regulation (GDPR), the US laws apply to where consumers reside, not where the company is headquartered. It doesn’t matter if a company doesn’t have an office in California if it has customers, website visitors, etc. that reside there and their personal information is being processed by the company. So, yes, if I was an EU company, I would need to abide by California privacy laws. Now IIRC there's some fine print in California's laws that says this only matters if the company is over a certain size, has a minimum number of CA users, and resells information. But that "filter" is also part of CA law, not EU law. QED :) [1] https://usercentrics.com/knowledge-hub/us-privacy-law-compliance-for-eu-companies/ https://usercentrics.com/knowledge-hub/us-privacy-law-compli...
- _Algernon_ 3y ago
  "Enforcement is obviously a different matter"
TylerE 3y ago
So, how does this work with countries that have, say, strict porn laws. Does Singapore or Saudia Arabia get to impose it's morals on the rest of the world?

GDPR applies when you have EU users. Legal presence is irrelevant. Enforcement is obviously a different matter.

MichaelZuo 3y ago

Based on what reasoning? I don't think the US has signed a treaty with the EU regarding it?

sebastiennight 3y ago
We don't need you (whatever "you" means) to sign a treaty with "us" in order for "our" law to apply when you deal with "our" citizens. Sometimes there is zero leverage and "you" can't be found/sued/fined. But for large companies, there's no easy way out. That's why Meta is in hot waters ; they can't just say "oh we'll put our HQ back in California and now the EU can't say anything about how we collect data/show ads to EU users". That can't fly. Even if you made up a new country and went there (with no treaty), you'd still be outside the local law of the users you're dealing with, and there are many ways for the user's jurisdiction to apply leverage if you're enough of a big deal.
- MichaelZuo 3y ago
  > We don't need you (whatever "you" means) to sign a treaty with "us" in order for "our" law to apply when you deal with "our" citizens. Because...?
- Turing_Machine 3y ago
  > We don't need you (whatever "you" means) to sign a treaty with "us" in order for "our" law to apply when you deal with "our" citizens. "We're" not responsible for abiding by "your" laws, whether "your" citizens are involved or not. Do "you" abide by (one example among many) the US Second Amendment when "our" citizens are visiting "your" country? No, you do not. QED.
  - sebastiennight 3y ago
    Well, according to what I could find[1], > Like the General Data Protection Regulation (GDPR), the US laws apply to where consumers reside, not where the company is headquartered. It doesn’t matter if a company doesn’t have an office in California if it has customers, website visitors, etc. that reside there and their personal information is being processed by the company. So, yes, if I was an EU company, I would need to abide by California privacy laws. Now IIRC there's some fine print in California's laws that says this only matters if the company is over a certain size, has a minimum number of CA users, and resells information. But that "filter" is also part of CA law, not EU law. QED :) [1] https://usercentrics.com/knowledge-hub/us-privacy-law-compliance-for-eu-companies/ https://usercentrics.com/knowledge-hub/us-privacy-law-compli...
_Algernon_ 3y ago
"Enforcement is obviously a different matter"

TylerE 3y ago

So, how does this work with countries that have, say, strict porn laws. Does Singapore or Saudia Arabia get to impose it's morals on the rest of the world?