8 ms·

> a bunch of american sites just block the whole EU due to GDPR laws. Which is incredibly reasonable. If the EU didn't try to claim EU law applies globally, th

> a bunch of american sites just block the whole EU due to GDPR laws. Which is incredibly reasonable. If the EU didn't try to claim EU law applies globally, those sites might still be up.

robin_reala 2y ago
The US is just as bad at extraterritorial law, see FATCA for just one example. https://en.wikipedia.org/wiki/Foreign_Account_Tax_Compliance_Act#Criticism https://en.wikipedia.org/wiki/Foreign_Account_Tax_Compliance...
- DEADMINCE 2y ago
  That situation is quite different. The US is using its significant power and weight to coerce those non-US banks into compliance with FACTA. Those banks don't have to comply, but they want to do business with the US and US companies, then they don't have much of a choice. It's not like they just made a law and now insisted it applies globally, which is what the EU did.
  - echoangle 2y ago
    Isn’t it actually exactly the same? The website doesn’t have to comply (and many don’t), but if they want to do business in the EU, they have to. How is that different?
    - DEADMINCE 2y ago
      No, it's not remotely the same. The US is using the fact that people want to do business with them to coerce compliance, and as written the law only applies to US persons. The EU claims the GDPR applies globally, regardless of if people want to do business with the EU, or even if people ever set foot in the EU. It's amusing nonsense.
  - mratsim 2y ago
    Why is it different? People don't have to comply to GDPR but if they want to serve EU folks then they don't have a choice.
    - DEADMINCE 2y ago
      The EU claims their law applies globally regardless of if people set foot in or do business in the EU. According to the EU, an EU citizen just needs to visit a site and the law applies, regardless of where the site is hosted. According to the EU, the GDPR applies to some small shop owner in China with a website that harvests all data it can that isn't advertising in the EU, courting EU citizens in any way, has no business with the EU, etc.
      - mratsim 2y ago
        According to the US, an US citizen just have to open a bank account anywhere in the world and the law applies, regardless of where the bank is hosted.
      - simonmysun 2y ago
        Once privacy is considered as a fundamental human right, everything makes sense. When an EU citizen visit a site and the site collects their data in an unbounded way, their privacy is violated and any goverment should be responsible of protecting its citizen. In my point of view, this is a difference of how much we define privacy as human right and what data are considered private.
        DEADMINCE 2y ago
        > Once privacy is considered as a fundamental human right, everything makes sense. Does it? I agree it should be, and I want to work towards a better world also, but pretending you have jurisdiction when you clearly do not, doesn't seem helpful in any way.
        simonmysun 2y ago
        I suppose it will be treated as other international jurisprudence. However it is indeed not practical for individuals.
  - belk 2y ago
    it's effectively the same, small banks just shove you out of the building and refuse to open a bank account for you if FATCA applies to you, their compliance is through just not accepting US tax payers. This is a real issue that leaves US citizens only able to open accounts at bigger banks (with shittier services but enough budget to hire a FATCA compliance department)
    - DEADMINCE 2y ago
      > it's effectively the same Nope. Not even close. Practically the GDPR law has no teeth at all because its claim of extraterritorial jurisdiction is nothing but nonsense. FATCA applies because the US has a carrot or stick to enforce it. Also, the US law as written is entirely reasonable and doesn't try to claim the law applies to US citizens anywhere in the world.
      - shkkmo 2y ago
        > US law as written is entirely reasonable and doesn't try to claim the law applies to US citizens anywhere in the world. It absolutely does. The USA has laws that govern what it's own citizens do abroad like. You aren't allowed to have sex with minors or pay bribes when abroad. The USA also recently passed a law that allows it to prosecute foreign officials who solicit bribes from USA entities. https://www.ropesgray.com/en/insights/alerts/2023/12/us-congress-passes-law-to-criminally-prosecute-corrupt-foreign-officials https://www.ropesgray.com/en/insights/alerts/2023/12/us-cong...
        DEADMINCE 2y ago
        > It absolutely does. Absolutely, absolutely, it does not. The USA law is saying US law applies to US persons wherever they may be in the world. The EU law is saying EU laws applies to ANYONE in the world if an EU person interacts with them via the internet. You realize those two things are not the same, right?
        bmicraft 2y ago
- throwawaysm 2y ago
  https://en.wikipedia.org/wiki/CLOUD_Act https://en.wikipedia.org/wiki/CLOUD_Act strikes me an example
3836293648 2y ago
What? No Claiming jurisdiction by server location is the stupidest thing ever if you trying to have any kind of customer protection laws. You have to go by customer location. However, the claim that they have jurisdiction over EU citizens abroad is very questionable.
- DEADMINCE 2y ago
  > Claiming jurisdiction by server location is the stupidest thing ever if you trying to have any kind of customer protection laws. You have to go by customer location. I disagree, because that's impossible. That's why the EU's attempt is largely a joke. Literally - it seems to get mocked a lot when I tried reading up on the credibility and practicality of what they claim. > However, the claim that they have jurisdiction over EU citizens abroad is very questionable. It's the claim that they have jurisdiction over non-EU citizens and businesses in their own countries which is so laughable.
  - jkaplowitz 2y ago
    > Literally - it seems to get mocked a lot when I tried reading up on the credibility and practicality of what they claim. [...] > It's the claim that they have jurisdiction over non-EU citizens and businesses in their own countries which is so laughable. Most of this mockery is based on misunderstandings that overgeneralize what the EU is asserting and overlook what most other countries assert. Most countries have some laws that under some circumstances purport to apply to foreign non-citizens located outside the country, not just the EU. A key example is defamation law. If you are a Brazilian citizen located in Brazil and you specifically target publications online to UK or Canadian or US audiences in ways that are viewed as defamatory in those jurisdictions, you could very well get sued in those countries' courts, and there are absolutely cases where those courts would uphold their jurisdiction based on the specifically targeted publication. Similarly, when asked to decide if they have jurisdiction to enforce local consumer protection law against a foreign defendant, the courts in the Canadian province of Quebec will consider whether the foreign defendant has tried to target Quebec consumers, should know that it has ongoing substantial sales to Quebec consumers, et cetera - not only whether it has a business establishment in Quebec. Conversely, if you are a hotel in New Hampshire, USA and someone located in an EU country visits your US-based English-language USD-only hotel website and books a room for their upcoming visit, the GDPR probably does not apply, since there is no attempt to target the EU. Among other exceptions, the conclusion could be different if the hotel website allows bookings in EU currencies or languages (not counting English and maybe not US/Latin American Spanish because of their use in the US), since that shows an intention to target EU visitors. If merely being foreign allowed EU-focused businesses to avoid the GDPR, that would be an extremely huge loophole, and EU businesses would make deals with those foreign businesses to shift as much as possible of their data processing stream outside the scope of the GDPR. It would pretty much swallow the whole law. It's not a viable approach. Similarly, monitoring the behavior of visitors in the EU can also lead to the GDPR applying, since otherwise EU businesses would pay foreign businesses to track their visitors on their behalf, doing whatever legal ownership transfer shenanigans they have to in order to make that work. ("Oh no, this is not a European-owned website, it's an American website to which we've licensed our brand content and which shares 99% of its subscription and ad revenue with us as their license fee... they are allowed to track you even if we can't...") Of course, you're quite right if you view it as a mockable idea that the EU would be going into foreign countries to bust down doors and collect fines from foreign businesses. Just as clearly, they aren't pretending they can do that. But if a foreign company does get assessed with a GDPR violation fine in the EU, it certainly gets harder for them to continue to engage in business dealings with anyone in the EU without that fine becoming more possible to collect - and in some cases there are established mutual legal assistance treaties through which EU countries can get foreign countries to help with collecting a judgment outside of the EU. My guess as to why these non-EU companies prefer to block the EU instead of comply with the GDPR is simply that they don't view the risks of being found in violation as worth the benefits of the additional audience - not because they would necessarily be found in violation. Most of the local news channels would probably not be found in violation if they excluded visitors in the EU from behavior monitoring, but many of those sites don't consider it worthwhile even to take the risk.
arp242 2y ago
> If the EU didn't try to claim EU law applies globally, those sites might still be up. It doesn't; it applies to EU residents. Your non-EU business is free to do whatever it wants, but as soon as you do business with EU residents EU law applies. This is more or less how it works everywhere (with some exceptions). And deciding not to do business with EU residents (i.e. block in EU) is of course perfectly valid and reasonable choice. But not because "EU laws apply globally".
- DEADMINCE 2y ago
  > It doesn't; it applies to EU residents. Your non-EU business is free to do whatever it wants, but as soon as you do business with EU residents EU law applies. See, you say it only applies to EU residents, but that isn't the case. The real issue is where you say but as soon as you do business with EU residents EU law applies., and, well, that's just nonsense. I have a US site. I can operate my business any way I like as long as I don't break any Federal or State laws, and I can break every single EU law that doesn't have an equivalent US law. The EU can't touch me. EU law doesn't apply to me, even if I advertise the hell out of my site to try and attract as many EU citizens as possible. All the Eu can do is firewall me off, prosecute me if I come to the Eu and police or punish its citizens. > This is more or less how it works everywhere (with some exceptions). It's really not. The EUs claim of global jurisdiction is unique and a first. There may have been loosely similar things, but nothing quite like this. > But not because "EU laws apply globally". You should inform the EU they should correct their legislation then.
ajsnigrutin 2y ago
Sure, but if some Little Whinging news from North Arizona (fictional newssite) starts spamming me, because some grandma there can't remember his email address, and won't let me unsubscribe, I'll do everything I can do within my five minutes of anger to make them rethink.
- account42 2y ago
  Consider reporting it to the host, ISP and/or FTC next time - GDPR "compliance" doesn't let US businesses ignore the CAN SPAM act. https://consumer.ftc.gov/articles/how-get-less-spam-your-email#report https://consumer.ftc.gov/articles/how-get-less-spam-your-ema...
  - DEADMINCE 2y ago
    Spam and collecting/storing data are not the same problems.

> a bunch of american sites just block the whole EU due to GDPR laws. Which is incredibly reasonable. If the EU didn't try to claim EU law applies globally, those sites might still be up.

robin_reala 2y ago

The US is just as bad at extraterritorial law, see FATCA for just one example. https://en.wikipedia.org/wiki/Foreign_Account_Tax_Compliance_Act#Criticism https://en.wikipedia.org/wiki/Foreign_Account_Tax_Compliance...

DEADMINCE 2y ago
That situation is quite different. The US is using its significant power and weight to coerce those non-US banks into compliance with FACTA. Those banks don't have to comply, but they want to do business with the US and US companies, then they don't have much of a choice. It's not like they just made a law and now insisted it applies globally, which is what the EU did.
- echoangle 2y ago
  Isn’t it actually exactly the same? The website doesn’t have to comply (and many don’t), but if they want to do business in the EU, they have to. How is that different?
  - DEADMINCE 2y ago
    No, it's not remotely the same. The US is using the fact that people want to do business with them to coerce compliance, and as written the law only applies to US persons. The EU claims the GDPR applies globally, regardless of if people want to do business with the EU, or even if people ever set foot in the EU. It's amusing nonsense.
- mratsim 2y ago
  Why is it different? People don't have to comply to GDPR but if they want to serve EU folks then they don't have a choice.
  - DEADMINCE 2y ago
    The EU claims their law applies globally regardless of if people set foot in or do business in the EU. According to the EU, an EU citizen just needs to visit a site and the law applies, regardless of where the site is hosted. According to the EU, the GDPR applies to some small shop owner in China with a website that harvests all data it can that isn't advertising in the EU, courting EU citizens in any way, has no business with the EU, etc.
    - mratsim 2y ago
      According to the US, an US citizen just have to open a bank account anywhere in the world and the law applies, regardless of where the bank is hosted.
    - simonmysun 2y ago
      Once privacy is considered as a fundamental human right, everything makes sense. When an EU citizen visit a site and the site collects their data in an unbounded way, their privacy is violated and any goverment should be responsible of protecting its citizen. In my point of view, this is a difference of how much we define privacy as human right and what data are considered private.
      - DEADMINCE 2y ago
        > Once privacy is considered as a fundamental human right, everything makes sense. Does it? I agree it should be, and I want to work towards a better world also, but pretending you have jurisdiction when you clearly do not, doesn't seem helpful in any way.
        simonmysun 2y ago
        I suppose it will be treated as other international jurisprudence. However it is indeed not practical for individuals.
- belk 2y ago
  it's effectively the same, small banks just shove you out of the building and refuse to open a bank account for you if FATCA applies to you, their compliance is through just not accepting US tax payers. This is a real issue that leaves US citizens only able to open accounts at bigger banks (with shittier services but enough budget to hire a FATCA compliance department)
  - DEADMINCE 2y ago
    > it's effectively the same Nope. Not even close. Practically the GDPR law has no teeth at all because its claim of extraterritorial jurisdiction is nothing but nonsense. FATCA applies because the US has a carrot or stick to enforce it. Also, the US law as written is entirely reasonable and doesn't try to claim the law applies to US citizens anywhere in the world.
    - shkkmo 2y ago
      > US law as written is entirely reasonable and doesn't try to claim the law applies to US citizens anywhere in the world. It absolutely does. The USA has laws that govern what it's own citizens do abroad like. You aren't allowed to have sex with minors or pay bribes when abroad. The USA also recently passed a law that allows it to prosecute foreign officials who solicit bribes from USA entities. https://www.ropesgray.com/en/insights/alerts/2023/12/us-congress-passes-law-to-criminally-prosecute-corrupt-foreign-officials https://www.ropesgray.com/en/insights/alerts/2023/12/us-cong...
      - DEADMINCE 2y ago
        > It absolutely does. Absolutely, absolutely, it does not. The USA law is saying US law applies to US persons wherever they may be in the world. The EU law is saying EU laws applies to ANYONE in the world if an EU person interacts with them via the internet. You realize those two things are not the same, right?
        bmicraft 2y ago
throwawaysm 2y ago
https://en.wikipedia.org/wiki/CLOUD_Act https://en.wikipedia.org/wiki/CLOUD_Act strikes me an example

3836293648 2y ago

What? No Claiming jurisdiction by server location is the stupidest thing ever if you trying to have any kind of customer protection laws. You have to go by customer location. However, the claim that they have jurisdiction over EU citizens abroad is very questionable.

DEADMINCE 2y ago
> Claiming jurisdiction by server location is the stupidest thing ever if you trying to have any kind of customer protection laws. You have to go by customer location. I disagree, because that's impossible. That's why the EU's attempt is largely a joke. Literally - it seems to get mocked a lot when I tried reading up on the credibility and practicality of what they claim. > However, the claim that they have jurisdiction over EU citizens abroad is very questionable. It's the claim that they have jurisdiction over non-EU citizens and businesses in their own countries which is so laughable.
- jkaplowitz 2y ago
  > Literally - it seems to get mocked a lot when I tried reading up on the credibility and practicality of what they claim. [...] > It's the claim that they have jurisdiction over non-EU citizens and businesses in their own countries which is so laughable. Most of this mockery is based on misunderstandings that overgeneralize what the EU is asserting and overlook what most other countries assert. Most countries have some laws that under some circumstances purport to apply to foreign non-citizens located outside the country, not just the EU. A key example is defamation law. If you are a Brazilian citizen located in Brazil and you specifically target publications online to UK or Canadian or US audiences in ways that are viewed as defamatory in those jurisdictions, you could very well get sued in those countries' courts, and there are absolutely cases where those courts would uphold their jurisdiction based on the specifically targeted publication. Similarly, when asked to decide if they have jurisdiction to enforce local consumer protection law against a foreign defendant, the courts in the Canadian province of Quebec will consider whether the foreign defendant has tried to target Quebec consumers, should know that it has ongoing substantial sales to Quebec consumers, et cetera - not only whether it has a business establishment in Quebec. Conversely, if you are a hotel in New Hampshire, USA and someone located in an EU country visits your US-based English-language USD-only hotel website and books a room for their upcoming visit, the GDPR probably does not apply, since there is no attempt to target the EU. Among other exceptions, the conclusion could be different if the hotel website allows bookings in EU currencies or languages (not counting English and maybe not US/Latin American Spanish because of their use in the US), since that shows an intention to target EU visitors. If merely being foreign allowed EU-focused businesses to avoid the GDPR, that would be an extremely huge loophole, and EU businesses would make deals with those foreign businesses to shift as much as possible of their data processing stream outside the scope of the GDPR. It would pretty much swallow the whole law. It's not a viable approach. Similarly, monitoring the behavior of visitors in the EU can also lead to the GDPR applying, since otherwise EU businesses would pay foreign businesses to track their visitors on their behalf, doing whatever legal ownership transfer shenanigans they have to in order to make that work. ("Oh no, this is not a European-owned website, it's an American website to which we've licensed our brand content and which shares 99% of its subscription and ad revenue with us as their license fee... they are allowed to track you even if we can't...") Of course, you're quite right if you view it as a mockable idea that the EU would be going into foreign countries to bust down doors and collect fines from foreign businesses. Just as clearly, they aren't pretending they can do that. But if a foreign company does get assessed with a GDPR violation fine in the EU, it certainly gets harder for them to continue to engage in business dealings with anyone in the EU without that fine becoming more possible to collect - and in some cases there are established mutual legal assistance treaties through which EU countries can get foreign countries to help with collecting a judgment outside of the EU. My guess as to why these non-EU companies prefer to block the EU instead of comply with the GDPR is simply that they don't view the risks of being found in violation as worth the benefits of the additional audience - not because they would necessarily be found in violation. Most of the local news channels would probably not be found in violation if they excluded visitors in the EU from behavior monitoring, but many of those sites don't consider it worthwhile even to take the risk.

arp242 2y ago

> If the EU didn't try to claim EU law applies globally, those sites might still be up. It doesn't; it applies to EU residents. Your non-EU business is free to do whatever it wants, but as soon as you do business with EU residents EU law applies. This is more or less how it works everywhere (with some exceptions). And deciding not to do business with EU residents (i.e. block in EU) is of course perfectly valid and reasonable choice. But not because "EU laws apply globally".

DEADMINCE 2y ago
> It doesn't; it applies to EU residents. Your non-EU business is free to do whatever it wants, but as soon as you do business with EU residents EU law applies. See, you say it only applies to EU residents, but that isn't the case. The real issue is where you say but as soon as you do business with EU residents EU law applies., and, well, that's just nonsense. I have a US site. I can operate my business any way I like as long as I don't break any Federal or State laws, and I can break every single EU law that doesn't have an equivalent US law. The EU can't touch me. EU law doesn't apply to me, even if I advertise the hell out of my site to try and attract as many EU citizens as possible. All the Eu can do is firewall me off, prosecute me if I come to the Eu and police or punish its citizens. > This is more or less how it works everywhere (with some exceptions). It's really not. The EUs claim of global jurisdiction is unique and a first. There may have been loosely similar things, but nothing quite like this. > But not because "EU laws apply globally". You should inform the EU they should correct their legislation then.

ajsnigrutin 2y ago

Sure, but if some Little Whinging news from North Arizona (fictional newssite) starts spamming me, because some grandma there can't remember his email address, and won't let me unsubscribe, I'll do everything I can do within my five minutes of anger to make them rethink.

account42 2y ago
Consider reporting it to the host, ISP and/or FTC next time - GDPR "compliance" doesn't let US businesses ignore the CAN SPAM act. https://consumer.ftc.gov/articles/how-get-less-spam-your-email#report https://consumer.ftc.gov/articles/how-get-less-spam-your-ema...
- DEADMINCE 2y ago
  Spam and collecting/storing data are not the same problems.