4 ms·

> Claiming jurisdiction by server location is the stupidest thing ever if you trying to have any kind of customer protection laws. You have to go by customer lo

> Claiming jurisdiction by server location is the stupidest thing ever if you trying to have any kind of customer protection laws. You have to go by customer location. I disagree, because that's impossible. That's why the EU's attempt is largely a joke. Literally - it seems to get mocked a lot when I tried reading up on the credibility and practicality of what they claim. > However, the claim that they have jurisdiction over EU citizens abroad is very questionable. It's the claim that they have jurisdiction over non-EU citizens and businesses in their own countries which is so laughable.

jkaplowitz 2y ago
> Literally - it seems to get mocked a lot when I tried reading up on the credibility and practicality of what they claim. [...] > It's the claim that they have jurisdiction over non-EU citizens and businesses in their own countries which is so laughable. Most of this mockery is based on misunderstandings that overgeneralize what the EU is asserting and overlook what most other countries assert. Most countries have some laws that under some circumstances purport to apply to foreign non-citizens located outside the country, not just the EU. A key example is defamation law. If you are a Brazilian citizen located in Brazil and you specifically target publications online to UK or Canadian or US audiences in ways that are viewed as defamatory in those jurisdictions, you could very well get sued in those countries' courts, and there are absolutely cases where those courts would uphold their jurisdiction based on the specifically targeted publication. Similarly, when asked to decide if they have jurisdiction to enforce local consumer protection law against a foreign defendant, the courts in the Canadian province of Quebec will consider whether the foreign defendant has tried to target Quebec consumers, should know that it has ongoing substantial sales to Quebec consumers, et cetera - not only whether it has a business establishment in Quebec. Conversely, if you are a hotel in New Hampshire, USA and someone located in an EU country visits your US-based English-language USD-only hotel website and books a room for their upcoming visit, the GDPR probably does not apply, since there is no attempt to target the EU. Among other exceptions, the conclusion could be different if the hotel website allows bookings in EU currencies or languages (not counting English and maybe not US/Latin American Spanish because of their use in the US), since that shows an intention to target EU visitors. If merely being foreign allowed EU-focused businesses to avoid the GDPR, that would be an extremely huge loophole, and EU businesses would make deals with those foreign businesses to shift as much as possible of their data processing stream outside the scope of the GDPR. It would pretty much swallow the whole law. It's not a viable approach. Similarly, monitoring the behavior of visitors in the EU can also lead to the GDPR applying, since otherwise EU businesses would pay foreign businesses to track their visitors on their behalf, doing whatever legal ownership transfer shenanigans they have to in order to make that work. ("Oh no, this is not a European-owned website, it's an American website to which we've licensed our brand content and which shares 99% of its subscription and ad revenue with us as their license fee... they are allowed to track you even if we can't...") Of course, you're quite right if you view it as a mockable idea that the EU would be going into foreign countries to bust down doors and collect fines from foreign businesses. Just as clearly, they aren't pretending they can do that. But if a foreign company does get assessed with a GDPR violation fine in the EU, it certainly gets harder for them to continue to engage in business dealings with anyone in the EU without that fine becoming more possible to collect - and in some cases there are established mutual legal assistance treaties through which EU countries can get foreign countries to help with collecting a judgment outside of the EU. My guess as to why these non-EU companies prefer to block the EU instead of comply with the GDPR is simply that they don't view the risks of being found in violation as worth the benefits of the additional audience - not because they would necessarily be found in violation. Most of the local news channels would probably not be found in violation if they excluded visitors in the EU from behavior monitoring, but many of those sites don't consider it worthwhile even to take the risk.
- DEADMINCE 2y ago
  > Most of this mockery is based on misunderstandings that overgeneralize what the EU is asserting and overlook what most other countries assert. I think that mostly assumption. Much of the mockery was in legal journals for example - an audience that would be more familiar with the ext of the legislation than most. > Most countries have some laws that under some circumstances purport to apply to foreign non-citizens located outside the country, not just the EU. Maybe a few other countries have something in the same general category, but none as far reaching as GDPR law tries to be. And certainly it's a minority of countries that have such laws, not most. > A key example is defamation law. If you are a Brazilian citizen located in Brazil and you specifically target publications online to UK or Canadian or US audiences in ways that are viewed as defamatory in those jurisdictions, you could very well get sued in those countries' courts, and there are absolutely cases where those courts would uphold their jurisdiction based on the specifically targeted publication. I'm not exactly clear what you are saying here, but in any event, at least in any interpretation I can think of, the analogy doesn't map. If a UK entity sues a Brazilian in a Brazilian court, that's all pretty normal. That's just the UK entity doing something they are able to do in compatible courts, that's not UK law applying to Brazilians. > Similarly, when asked to decide if they have jurisdiction to enforce local consumer protection law against a foreign defendant, the courts in the Canadian province of Quebec will consider whether the foreign defendant has tried to target Quebec consumers, should know that it has ongoing substantial sales to Quebec consumers, et cetera - not only whether it has a business establishment in Quebec. And how is this relevant? That foreign defendant would be present in Quebec to be tried, so it's quite a bit different from the EU claiming Joe Schmoe halfway around the world who has no interest in the EU or Europe and has never been there, is subject to EU law because an EU citizen visited their data collecting site. > Conversely, if you are a hotel in New Hampshire, USA and someone located in an EU country visits your US-based English-language USD-only hotel website and books a room for their upcoming visit, the GDPR probably does not apply, since there is no attempt to target the EU. The attempt to target the EU would be simply be having online advertising that would show up in the EU. > Among other exceptions, the conclusion could be different if the hotel website allows bookings in EU currencies or languages (not counting English and maybe not US/Latin American Spanish because of their use in the US), since that shows an intention to target EU visitors. I don't think this is the actual text of the law. The EU claims GDPR applies to a small data collecting site, say, in Vietnam, that wants to store and retain and sell all the data it can about anyone that visits its site. That's what is ridiculous, that's what is incomparable to anything else you have listed. But in any event, let's say that is the law. Let's say this site in my Vietnamese example goes out of it's way to target the EU, having French and Spanish as default languages, having language flags for every EU country, and paying for advertisements (but only on US sites with US companies, lets say, just to reinforce the point that no business has been done in the EU) - well, in that case, it's still bonkers that the EU thinks they have any jurisdiction over the operator of that site. The ONLY thing they can do is firewall it off, like China does. That's it. Claiming to have global jurisdiction as they do just makes them look foolish. > If merely being foreign allowed EU-focused businesses to avoid the GDPR, that would be an extremely huge loophole, This is already reality, though. Any business in the world can court EU consumers, and only the EU can prevent that by further policing its citizens. They are powerless to stop foreign businesses any other way since they only have jurisdiction in their own borders...yet they claim the opposite. > Of course, you're quite right if you view it as a mockable idea that the EU would be going into foreign countries to bust down doors and collect fines from foreign businesses. Just as clearly, they aren't pretending they can do that. It's mockable that they claim they have any jurisdiction outside their borders in the contexts they do, period. > But if a foreign company does get assessed with a GDPR violation fine in the EU, it certainly gets harder for them to continue to engage in business dealings with anyone in the EU without that fine more becoming possible to collect - and in some cases there are established mutual legal assistance treaties through which EU countries can get foreign countries to help with collecting a judgment outside of the EU. There is absolutely no instance of a foreign court upholding a GDPR fine and I don't expect there ever will be, nor is there any treaty that would allow for that as far as I know. If you know otherwise and could name such a treaty I would appreciate it. The only thing the EU can do is get a judgement against that person or company and arrest people if they enter the EU, firewall off hosts, or police and punish its own citizens.

jkaplowitz 2y ago

> Literally - it seems to get mocked a lot when I tried reading up on the credibility and practicality of what they claim. [...] > It's the claim that they have jurisdiction over non-EU citizens and businesses in their own countries which is so laughable. Most of this mockery is based on misunderstandings that overgeneralize what the EU is asserting and overlook what most other countries assert. Most countries have some laws that under some circumstances purport to apply to foreign non-citizens located outside the country, not just the EU. A key example is defamation law. If you are a Brazilian citizen located in Brazil and you specifically target publications online to UK or Canadian or US audiences in ways that are viewed as defamatory in those jurisdictions, you could very well get sued in those countries' courts, and there are absolutely cases where those courts would uphold their jurisdiction based on the specifically targeted publication. Similarly, when asked to decide if they have jurisdiction to enforce local consumer protection law against a foreign defendant, the courts in the Canadian province of Quebec will consider whether the foreign defendant has tried to target Quebec consumers, should know that it has ongoing substantial sales to Quebec consumers, et cetera - not only whether it has a business establishment in Quebec. Conversely, if you are a hotel in New Hampshire, USA and someone located in an EU country visits your US-based English-language USD-only hotel website and books a room for their upcoming visit, the GDPR probably does not apply, since there is no attempt to target the EU. Among other exceptions, the conclusion could be different if the hotel website allows bookings in EU currencies or languages (not counting English and maybe not US/Latin American Spanish because of their use in the US), since that shows an intention to target EU visitors. If merely being foreign allowed EU-focused businesses to avoid the GDPR, that would be an extremely huge loophole, and EU businesses would make deals with those foreign businesses to shift as much as possible of their data processing stream outside the scope of the GDPR. It would pretty much swallow the whole law. It's not a viable approach. Similarly, monitoring the behavior of visitors in the EU can also lead to the GDPR applying, since otherwise EU businesses would pay foreign businesses to track their visitors on their behalf, doing whatever legal ownership transfer shenanigans they have to in order to make that work. ("Oh no, this is not a European-owned website, it's an American website to which we've licensed our brand content and which shares 99% of its subscription and ad revenue with us as their license fee... they are allowed to track you even if we can't...") Of course, you're quite right if you view it as a mockable idea that the EU would be going into foreign countries to bust down doors and collect fines from foreign businesses. Just as clearly, they aren't pretending they can do that. But if a foreign company does get assessed with a GDPR violation fine in the EU, it certainly gets harder for them to continue to engage in business dealings with anyone in the EU without that fine becoming more possible to collect - and in some cases there are established mutual legal assistance treaties through which EU countries can get foreign countries to help with collecting a judgment outside of the EU. My guess as to why these non-EU companies prefer to block the EU instead of comply with the GDPR is simply that they don't view the risks of being found in violation as worth the benefits of the additional audience - not because they would necessarily be found in violation. Most of the local news channels would probably not be found in violation if they excluded visitors in the EU from behavior monitoring, but many of those sites don't consider it worthwhile even to take the risk.

DEADMINCE 2y ago
> Most of this mockery is based on misunderstandings that overgeneralize what the EU is asserting and overlook what most other countries assert. I think that mostly assumption. Much of the mockery was in legal journals for example - an audience that would be more familiar with the ext of the legislation than most. > Most countries have some laws that under some circumstances purport to apply to foreign non-citizens located outside the country, not just the EU. Maybe a few other countries have something in the same general category, but none as far reaching as GDPR law tries to be. And certainly it's a minority of countries that have such laws, not most. > A key example is defamation law. If you are a Brazilian citizen located in Brazil and you specifically target publications online to UK or Canadian or US audiences in ways that are viewed as defamatory in those jurisdictions, you could very well get sued in those countries' courts, and there are absolutely cases where those courts would uphold their jurisdiction based on the specifically targeted publication. I'm not exactly clear what you are saying here, but in any event, at least in any interpretation I can think of, the analogy doesn't map. If a UK entity sues a Brazilian in a Brazilian court, that's all pretty normal. That's just the UK entity doing something they are able to do in compatible courts, that's not UK law applying to Brazilians. > Similarly, when asked to decide if they have jurisdiction to enforce local consumer protection law against a foreign defendant, the courts in the Canadian province of Quebec will consider whether the foreign defendant has tried to target Quebec consumers, should know that it has ongoing substantial sales to Quebec consumers, et cetera - not only whether it has a business establishment in Quebec. And how is this relevant? That foreign defendant would be present in Quebec to be tried, so it's quite a bit different from the EU claiming Joe Schmoe halfway around the world who has no interest in the EU or Europe and has never been there, is subject to EU law because an EU citizen visited their data collecting site. > Conversely, if you are a hotel in New Hampshire, USA and someone located in an EU country visits your US-based English-language USD-only hotel website and books a room for their upcoming visit, the GDPR probably does not apply, since there is no attempt to target the EU. The attempt to target the EU would be simply be having online advertising that would show up in the EU. > Among other exceptions, the conclusion could be different if the hotel website allows bookings in EU currencies or languages (not counting English and maybe not US/Latin American Spanish because of their use in the US), since that shows an intention to target EU visitors. I don't think this is the actual text of the law. The EU claims GDPR applies to a small data collecting site, say, in Vietnam, that wants to store and retain and sell all the data it can about anyone that visits its site. That's what is ridiculous, that's what is incomparable to anything else you have listed. But in any event, let's say that is the law. Let's say this site in my Vietnamese example goes out of it's way to target the EU, having French and Spanish as default languages, having language flags for every EU country, and paying for advertisements (but only on US sites with US companies, lets say, just to reinforce the point that no business has been done in the EU) - well, in that case, it's still bonkers that the EU thinks they have any jurisdiction over the operator of that site. The ONLY thing they can do is firewall it off, like China does. That's it. Claiming to have global jurisdiction as they do just makes them look foolish. > If merely being foreign allowed EU-focused businesses to avoid the GDPR, that would be an extremely huge loophole, This is already reality, though. Any business in the world can court EU consumers, and only the EU can prevent that by further policing its citizens. They are powerless to stop foreign businesses any other way since they only have jurisdiction in their own borders...yet they claim the opposite. > Of course, you're quite right if you view it as a mockable idea that the EU would be going into foreign countries to bust down doors and collect fines from foreign businesses. Just as clearly, they aren't pretending they can do that. It's mockable that they claim they have any jurisdiction outside their borders in the contexts they do, period. > But if a foreign company does get assessed with a GDPR violation fine in the EU, it certainly gets harder for them to continue to engage in business dealings with anyone in the EU without that fine more becoming possible to collect - and in some cases there are established mutual legal assistance treaties through which EU countries can get foreign countries to help with collecting a judgment outside of the EU. There is absolutely no instance of a foreign court upholding a GDPR fine and I don't expect there ever will be, nor is there any treaty that would allow for that as far as I know. If you know otherwise and could name such a treaty I would appreciate it. The only thing the EU can do is get a judgement against that person or company and arrest people if they enter the EU, firewall off hosts, or police and punish its own citizens.