4 ms·

It's much harder to fine companies that break the law if they make up a substantial part of your economy. On the other hand, big US companies don't have as much

It's much harder to fine companies that break the law if they make up a substantial part of your economy. On the other hand, big US companies don't have as much lobby power in the EU, so the EU is "free" to fine them.

silent_cal 2y ago
It's my impression that big US companies can do pretty much whatever they want in a number of European countries. Just look at Ireland for example.
flanked-evergl 2y ago
> It's much harder to fine companies that break the law if they make up a substantial part of your economy. Any evidence of this in the EU? EU courts and regulators seem to give no hecks about economy or reason. Data protection is great and all, but GDPR is a dumpster fire.
- lmeyerov 2y ago
  What policies within GPDR are dumpster fires? Likewise, afaict it only applies to doing business with EU citizens... So if you don't want to comply, or not be subject to the fees, don't? I would expect the US to eventually adopt its own more intentional variant of online privacy laws, and software infra to get better at supporting the GPDR flavor, at which point I would expect most US tech companies at least would find it less odd & costly..
  - flanked-evergl 2y ago
    > What policies within GPDR are dumpster fires? Every company I have worked for (including banks, FSP and retailers) have different interpretations of GDPR and do vastly different things. National agencies were also responsible for specifying which certifications cloud providers should have to be GDPR compliant, but they did not do that for years, and I think they still have not done it. The end result was that you would spend months with internal deliberations with incompetent lawyers internally trying to determine if you can, for example, use GCP — while government agencies in the same country are using GCP — and ultimately, there is no way to know without the agencies doing their job which they did not do. Then there is the cookies popup mess. > Likewise, afaict it only applies to doing business with EU citizens... So if you don't want to comply, or not be subject to the fees, don't? I have not worked for one company that is subject to GDPR that actually knew for sure if they are compliant with GDPR. So, easier said than done. In practice, it's a racket to enrich lawyers.
    - lmeyerov 2y ago
      I'm pretty unclear from your post how GPDR is different from any other compliance standard Overall, many of the 'problems' here seem natural, signs of it working, and even good? Ex - variety: I would expect a bank vs a retailer vs a startup to have significantly different implementations of GDPR. Even within the same industry & weight class, I would expect different companies to have different risk appetites -- that's ultimately a commercial decision -- and thus different takes on what they consider appropriate risk-adjusted compliance Ex - certainty: While I am a (strong!) advocate of making checkbox compliance provide an optional automatable conformance testing API, I also recognize that making such an interface a hard requirement would lead to excessive rigidity. The real world has ~400 million companies with all sorts of edge cases who benefit from ambiguity & interpretation in policies. The compromise here and elsewhere has been the same: As you get bigger, bring in security experts and auditors. If you've done anything like SOC2, HIPAA, etc, it seems normal, and in my experience, successfully reveals issues that get fixed / starts the paper trail for corporate malfeasance? Ex - GCP: I would think a bank better understand how its cloud data processor is working enough to answer basics like where customer data is flowing, whether another country or company sees it, etc? And if not, that's a pretty core problem both with the bank and the cloud data processor? I'm not sure what the problem with the cookie thing is. Companies can choose not to track, improve their EULAs, etc. Maybe it's that it's too easy for companies to just do a popup and trick/force users into being tracked... and you want something stronger than gpdr?
      - flanked-evergl 2y ago
        > I'm pretty unclear from your post how GPDR is different from any other compliance standard I never said it was different, I said it is a dumpster fire. Most regulation being dumpster fires does not somehow absolve the GDPR from being a dumpster fire. > I would expect a bank vs a retailer vs a startup to have significantly different implementations of GDPR. Maybe we are using different definitions of the word interpretation, but if nobody knows how to comply with your regulation because they don't understand what it means, it is bad regulation. Regulation that is entirely open to interpretation is a massive "do not invest" red flag to businesses, which incidentally, is one of the reasons why innovation in the EU is so bad. > I also recognize that making such an interface a hard requirement would lead to excessive rigidity. If compliance is uncertain it makes business more expensive and wasteful. If nobody knows whether they are complying with regulation and the only way to find out is litigation, it is bad regulation. > Ex - GCP: I would think a bank better understand how its cloud data processor is working enough to answer basics like where customer data is flowing There is much more to GDPR than to what country data is flowing. Again, I don't know how to express this more clearly: National agencies neglected their responsiblity in setting out certification processes. As useless as they were at their job, at the very least they could see this is needed, they just did not do their job because they had no incentive to do it. > I'm not sure what the problem with the cookie thing is. It could have been implemented by browsers as a header in HTTP requests. Having a popup on every site is not a clever strategy.
- staunton 2y ago
  For example, look at the fines German car manufacturers "faced" in the EU when their emission-cheating scheme was exposed...
  - flanked-evergl 2y ago
    Volkswagen was fined at least 1.875 billion Euros in the EU [1][2]. [1] https://www.reuters.com/business/autos-transportation/eu-fines-bmw-volkswagen-group-restricting-competition-emission-cleaning-2021-07-08/ https://www.reuters.com/business/autos-transportation/eu-fin... [2] https://www.reuters.com/article/business/volkswagen-fined-one-billlion-euros-by-german-prosecutors-over-emissions-cheatin-idUSKBN1J92AI/ https://www.reuters.com/article/business/volkswagen-fined-on...

silent_cal 2y ago

It's my impression that big US companies can do pretty much whatever they want in a number of European countries. Just look at Ireland for example.

flanked-evergl 2y ago

> It's much harder to fine companies that break the law if they make up a substantial part of your economy. Any evidence of this in the EU? EU courts and regulators seem to give no hecks about economy or reason. Data protection is great and all, but GDPR is a dumpster fire.

lmeyerov 2y ago
What policies within GPDR are dumpster fires? Likewise, afaict it only applies to doing business with EU citizens... So if you don't want to comply, or not be subject to the fees, don't? I would expect the US to eventually adopt its own more intentional variant of online privacy laws, and software infra to get better at supporting the GPDR flavor, at which point I would expect most US tech companies at least would find it less odd & costly..
- flanked-evergl 2y ago
  > What policies within GPDR are dumpster fires? Every company I have worked for (including banks, FSP and retailers) have different interpretations of GDPR and do vastly different things. National agencies were also responsible for specifying which certifications cloud providers should have to be GDPR compliant, but they did not do that for years, and I think they still have not done it. The end result was that you would spend months with internal deliberations with incompetent lawyers internally trying to determine if you can, for example, use GCP — while government agencies in the same country are using GCP — and ultimately, there is no way to know without the agencies doing their job which they did not do. Then there is the cookies popup mess. > Likewise, afaict it only applies to doing business with EU citizens... So if you don't want to comply, or not be subject to the fees, don't? I have not worked for one company that is subject to GDPR that actually knew for sure if they are compliant with GDPR. So, easier said than done. In practice, it's a racket to enrich lawyers.
  - lmeyerov 2y ago
    I'm pretty unclear from your post how GPDR is different from any other compliance standard Overall, many of the 'problems' here seem natural, signs of it working, and even good? Ex - variety: I would expect a bank vs a retailer vs a startup to have significantly different implementations of GDPR. Even within the same industry & weight class, I would expect different companies to have different risk appetites -- that's ultimately a commercial decision -- and thus different takes on what they consider appropriate risk-adjusted compliance Ex - certainty: While I am a (strong!) advocate of making checkbox compliance provide an optional automatable conformance testing API, I also recognize that making such an interface a hard requirement would lead to excessive rigidity. The real world has ~400 million companies with all sorts of edge cases who benefit from ambiguity & interpretation in policies. The compromise here and elsewhere has been the same: As you get bigger, bring in security experts and auditors. If you've done anything like SOC2, HIPAA, etc, it seems normal, and in my experience, successfully reveals issues that get fixed / starts the paper trail for corporate malfeasance? Ex - GCP: I would think a bank better understand how its cloud data processor is working enough to answer basics like where customer data is flowing, whether another country or company sees it, etc? And if not, that's a pretty core problem both with the bank and the cloud data processor? I'm not sure what the problem with the cookie thing is. Companies can choose not to track, improve their EULAs, etc. Maybe it's that it's too easy for companies to just do a popup and trick/force users into being tracked... and you want something stronger than gpdr?
    - flanked-evergl 2y ago
      > I'm pretty unclear from your post how GPDR is different from any other compliance standard I never said it was different, I said it is a dumpster fire. Most regulation being dumpster fires does not somehow absolve the GDPR from being a dumpster fire. > I would expect a bank vs a retailer vs a startup to have significantly different implementations of GDPR. Maybe we are using different definitions of the word interpretation, but if nobody knows how to comply with your regulation because they don't understand what it means, it is bad regulation. Regulation that is entirely open to interpretation is a massive "do not invest" red flag to businesses, which incidentally, is one of the reasons why innovation in the EU is so bad. > I also recognize that making such an interface a hard requirement would lead to excessive rigidity. If compliance is uncertain it makes business more expensive and wasteful. If nobody knows whether they are complying with regulation and the only way to find out is litigation, it is bad regulation. > Ex - GCP: I would think a bank better understand how its cloud data processor is working enough to answer basics like where customer data is flowing There is much more to GDPR than to what country data is flowing. Again, I don't know how to express this more clearly: National agencies neglected their responsiblity in setting out certification processes. As useless as they were at their job, at the very least they could see this is needed, they just did not do their job because they had no incentive to do it. > I'm not sure what the problem with the cookie thing is. It could have been implemented by browsers as a header in HTTP requests. Having a popup on every site is not a clever strategy.
staunton 2y ago
For example, look at the fines German car manufacturers "faced" in the EU when their emission-cheating scheme was exposed...
- flanked-evergl 2y ago
  Volkswagen was fined at least 1.875 billion Euros in the EU [1][2]. [1] https://www.reuters.com/business/autos-transportation/eu-fines-bmw-volkswagen-group-restricting-competition-emission-cleaning-2021-07-08/ https://www.reuters.com/business/autos-transportation/eu-fin... [2] https://www.reuters.com/article/business/volkswagen-fined-one-billlion-euros-by-german-prosecutors-over-emissions-cheatin-idUSKBN1J92AI/ https://www.reuters.com/article/business/volkswagen-fined-on...