6 ms·

It's questionable to me whether a court order of a non-eu court applies. "The law" is EU law, not American law. If any non-eu country can circumvent GDPR by ju

It's questionable to me whether a court order of a non-eu court applies. "The law" is EU law, not American law. If any non-eu country can circumvent GDPR by just making a law that it doesn't apply, the entire point of the regulation vanishes.

kbelder 1y ago
Doesn't that work both ways? Why should the EU be able to override American laws regarding an American company?
- FeepingCreature 1y ago
  Because it's European users whose data is being recorded on the order of a court that doesn't even have jurisdiction over them?
- midasz 1y ago
  It doesn't really matter from what country the company is. If you do business in the EU then EU laws apply to the business you do in the EU. Just like EU companies adhere to US law for the business they do in the US.
- Scarblac 1y ago
  They can't override laws of course, but it could mean that if two jurisdictions have conflicting laws, you can't be active in both of them.
- _Algernon_ 1y ago
  Because EU has jurisdiction when the american company operates in the EU.
  - thephyber 1y ago
    It’s WAY more complicated than that. Where is the HQ of the company? Where does the company operate? What country is the individual user in? What country do the servers and data reside in? Ditto for service vendors who also deal with user data. Even within the EU, this is a mess and companies would rather use a simple heuristic like put all servers and store all data for EU users in the most restrictive country (I’ve heard Germany).
    - _Algernon_ 1y ago
      Maybe when talking about the GDPR specifics, but not when it comes to whether the EU has jurisdiction over companies in the EU.
    - throw_a_grenade 1y ago
      > Where is the HQ of the company? If outside EU, then they need to accept EU jurisdiction and notify who is representative plenipotentiary (== can make decisions and take liability on behalf of the company). > Where does the company operate? Geography mostly doesn't matter as long as they interact with EU people. Because people are more important. > What country is the individual user in? Any EU (or EEA) country. > What country do the servers and data reside in? Again, doesn't matter, because people > servers. It's almost like if bureaucrats who are writing regulations are experienced in writing regulations in such a way they can't be circumvented. EDIT TO ADD: From OpenAI privacy policy: > 1. Data controller > If you live in the European Economic Area (EEA) or Switzerland, OpenAI Ireland Limited, with its registered office at 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland, is the controller and is responsible for the processing of your Personal Data as described in this Privacy Policy. > If you live in the UK, OpenAI OpCo, LLC, with its registered office at 1960 Bryant Street, San Francisco, California 94110, United States, is the controller and is responsible for the processing of your Personal Data as described in this Privacy Policy.
      - Y_Y 1y ago
        As you astutely note, the company probably has it's "HQ" (for some legal definition of HQ) a mere 30 minutes across Dublin (Luas, walk in rain, bus, more rain) from the Data Protection Commission. It's very likely that whatever big tech data-hoarder you choose has a presence very close to their opposite number in both of these cases. If it was easier or more cost-effective for these companies not to have a foot in the EU they wouldn't bother, but they do.
      - chris12321 1y ago
        > It's almost like if bureaucrats who are writing regulations are experienced in writing regulations in such a way they can't be circumvented. Americans often seem to have the view that lawmakers are bumbling buffoons who just make up laws on the spot with no thought given to loop holes or consequences. That might be how they do it over there, but it's not really how it works here.
- mattlondon 1y ago
  Likewise, why should America be able to override European laws regarding European users in Europe? It's all about jurisdiction. Do business in Country X? Then you need to follow Country X's laws. Same as if you go on vacation to County Y. If you do something that is illegal in Country Y while you are there, even if it's legal in your home country, you still broke the law in Country Y and will have to face the consequences.
- lmm 1y ago
  Because we're talking about the personal data of EU citizens. If it's to be permitted to be sent to America at all, that must come with a guarantee that EU-standard protections will continue to apply regardless of American law.
  - bonoboTP 1y ago
    > If it's to be permitted to be sent to America at all Do you mean that I, an EU citizen am being granted some special privilege from EU leadership to send my data to the US?
    - throw_a_grenade 1y ago
      No, the company you're sending it to is required to care for it. Up to and including refusing to accept that data if need be.
    - wkat4242 1y ago
      It's the other way around. The EU has granted US companies a temporary permission to handle EU customers' data. https://en.m.wikipedia.org/wiki/EU%E2%80%93US_Data_Privacy_Framework https://en.m.wikipedia.org/wiki/EU%E2%80%93US_Data_Privacy_F... I say temporary because it keeps being shot down in court for lax privacy protections and the EU keeps refloating it under a different name for economic reasons. Before this name it was called safe harbor and after that it was privacy shield.
    - andrecarini 1y ago
      It works the other way around; the American company is granted a special privilege to retrieve EU citizen data.
      - bonoboTP 1y ago
        I'm not sure they are "retrieving" data. People register on the website and upload stuff they want to be processed and used. I mean, sometimes the government steps in when you willingly try to hand over something on your own will, such as very strict rules around organ donation, I can't simply decide to give my organs to some random person for arbitrary reasons even if I really want to. But I'm not sure if data should be the same category where the government steps in and says "no you can't upload your personal data to an American website"
- Garlef 1y ago
  You don't understand how that works: EU companies are required to act in compliance with the GDPR. This includes all sensitive data that is transfered to business partners. They must make sure that all partners handle the (sensitive part of the) transfered data in a GDPR compliant way. So: No law is overriden. But in order to do business with EU companies, US companies "must" offer to treat the data accordingly. As a result, this means EU companies can not transfer sensitive data to US companies. (Since the president of the US has in principle the right to order any US company to turn over their data.) But in practice, usually no one cares. Unless someone does and then you might be in trouble.
- blitzar 1y ago
  Taps the sign ... US companies operating in the EU are subject to EU laws.
Frieren 1y ago
> GDPR: “Any judgment of a court or tribunal and any decision of an administrative authority of a third country requiring a controller or processor to transfer or disclose personal data may only be recognized or enforceable if based on an international agreement…” That is why international agreements and cooperation is so important. Agreement with the United States on mutual legal assistance: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=legissum:jl0052 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=legissum... Regulatory entities are quite competent and make sure that most common situations are covered. When some new situation arises an update to the treaty will be created to solve it.
- _Algernon_ 1y ago
  Seems like the EU should be less agreeable with these kinds of treaties going forward. Though precedent is already set by the US that international agreements don't matter so arguably the EU should just ignore this.
- friendzis 1y ago
  > Regulatory entities are quite competent and make sure that most common situations are covered. There's "legitimate interest", which makes the whole GDPR null and void. Every website nowdays has the "legitimate interest" toggled on for "track user across services", "measure ad performance" and "build user profile". And it's 100% legal, even though the official reason for GDPR to exist in the first place is to make these practices illegal.
  - troupo 1y ago
    "legitimate interest" isn't a carte blanche. Most of those "legitimate interest" claims are themselves illegal
    - octo888 1y ago
      Legitimate interest includes - Direct Marketing - Preventing Fraud - Ensuring information security It's weasel words all the way down. Having to take into account "reasonable" expectations of data subjects etc. Allowed where the subject is "in the service of the controller" Very broad terms open to a lot of lengthy debate

kbelder 1y ago

Doesn't that work both ways? Why should the EU be able to override American laws regarding an American company?

FeepingCreature 1y ago
Because it's European users whose data is being recorded on the order of a court that doesn't even have jurisdiction over them?
midasz 1y ago
It doesn't really matter from what country the company is. If you do business in the EU then EU laws apply to the business you do in the EU. Just like EU companies adhere to US law for the business they do in the US.
Scarblac 1y ago
They can't override laws of course, but it could mean that if two jurisdictions have conflicting laws, you can't be active in both of them.
_Algernon_ 1y ago
Because EU has jurisdiction when the american company operates in the EU.
- thephyber 1y ago
  It’s WAY more complicated than that. Where is the HQ of the company? Where does the company operate? What country is the individual user in? What country do the servers and data reside in? Ditto for service vendors who also deal with user data. Even within the EU, this is a mess and companies would rather use a simple heuristic like put all servers and store all data for EU users in the most restrictive country (I’ve heard Germany).
  - _Algernon_ 1y ago
    Maybe when talking about the GDPR specifics, but not when it comes to whether the EU has jurisdiction over companies in the EU.
  - throw_a_grenade 1y ago
    > Where is the HQ of the company? If outside EU, then they need to accept EU jurisdiction and notify who is representative plenipotentiary (== can make decisions and take liability on behalf of the company). > Where does the company operate? Geography mostly doesn't matter as long as they interact with EU people. Because people are more important. > What country is the individual user in? Any EU (or EEA) country. > What country do the servers and data reside in? Again, doesn't matter, because people > servers. It's almost like if bureaucrats who are writing regulations are experienced in writing regulations in such a way they can't be circumvented. EDIT TO ADD: From OpenAI privacy policy: > 1. Data controller > If you live in the European Economic Area (EEA) or Switzerland, OpenAI Ireland Limited, with its registered office at 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland, is the controller and is responsible for the processing of your Personal Data as described in this Privacy Policy. > If you live in the UK, OpenAI OpCo, LLC, with its registered office at 1960 Bryant Street, San Francisco, California 94110, United States, is the controller and is responsible for the processing of your Personal Data as described in this Privacy Policy.
    - Y_Y 1y ago
      As you astutely note, the company probably has it's "HQ" (for some legal definition of HQ) a mere 30 minutes across Dublin (Luas, walk in rain, bus, more rain) from the Data Protection Commission. It's very likely that whatever big tech data-hoarder you choose has a presence very close to their opposite number in both of these cases. If it was easier or more cost-effective for these companies not to have a foot in the EU they wouldn't bother, but they do.
    - chris12321 1y ago
      > It's almost like if bureaucrats who are writing regulations are experienced in writing regulations in such a way they can't be circumvented. Americans often seem to have the view that lawmakers are bumbling buffoons who just make up laws on the spot with no thought given to loop holes or consequences. That might be how they do it over there, but it's not really how it works here.
mattlondon 1y ago
Likewise, why should America be able to override European laws regarding European users in Europe? It's all about jurisdiction. Do business in Country X? Then you need to follow Country X's laws. Same as if you go on vacation to County Y. If you do something that is illegal in Country Y while you are there, even if it's legal in your home country, you still broke the law in Country Y and will have to face the consequences.
lmm 1y ago
Because we're talking about the personal data of EU citizens. If it's to be permitted to be sent to America at all, that must come with a guarantee that EU-standard protections will continue to apply regardless of American law.
- bonoboTP 1y ago
  > If it's to be permitted to be sent to America at all Do you mean that I, an EU citizen am being granted some special privilege from EU leadership to send my data to the US?
  - throw_a_grenade 1y ago
    No, the company you're sending it to is required to care for it. Up to and including refusing to accept that data if need be.
  - wkat4242 1y ago
    It's the other way around. The EU has granted US companies a temporary permission to handle EU customers' data. https://en.m.wikipedia.org/wiki/EU%E2%80%93US_Data_Privacy_Framework https://en.m.wikipedia.org/wiki/EU%E2%80%93US_Data_Privacy_F... I say temporary because it keeps being shot down in court for lax privacy protections and the EU keeps refloating it under a different name for economic reasons. Before this name it was called safe harbor and after that it was privacy shield.
  - andrecarini 1y ago
    It works the other way around; the American company is granted a special privilege to retrieve EU citizen data.
    - bonoboTP 1y ago
      I'm not sure they are "retrieving" data. People register on the website and upload stuff they want to be processed and used. I mean, sometimes the government steps in when you willingly try to hand over something on your own will, such as very strict rules around organ donation, I can't simply decide to give my organs to some random person for arbitrary reasons even if I really want to. But I'm not sure if data should be the same category where the government steps in and says "no you can't upload your personal data to an American website"
Garlef 1y ago
You don't understand how that works: EU companies are required to act in compliance with the GDPR. This includes all sensitive data that is transfered to business partners. They must make sure that all partners handle the (sensitive part of the) transfered data in a GDPR compliant way. So: No law is overriden. But in order to do business with EU companies, US companies "must" offer to treat the data accordingly. As a result, this means EU companies can not transfer sensitive data to US companies. (Since the president of the US has in principle the right to order any US company to turn over their data.) But in practice, usually no one cares. Unless someone does and then you might be in trouble.
blitzar 1y ago
Taps the sign ... US companies operating in the EU are subject to EU laws.

Frieren 1y ago

> GDPR: “Any judgment of a court or tribunal and any decision of an administrative authority of a third country requiring a controller or processor to transfer or disclose personal data may only be recognized or enforceable if based on an international agreement…” That is why international agreements and cooperation is so important. Agreement with the United States on mutual legal assistance: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=legissum:jl0052 https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=legissum... Regulatory entities are quite competent and make sure that most common situations are covered. When some new situation arises an update to the treaty will be created to solve it.

_Algernon_ 1y ago
Seems like the EU should be less agreeable with these kinds of treaties going forward. Though precedent is already set by the US that international agreements don't matter so arguably the EU should just ignore this.
friendzis 1y ago
> Regulatory entities are quite competent and make sure that most common situations are covered. There's "legitimate interest", which makes the whole GDPR null and void. Every website nowdays has the "legitimate interest" toggled on for "track user across services", "measure ad performance" and "build user profile". And it's 100% legal, even though the official reason for GDPR to exist in the first place is to make these practices illegal.
- troupo 1y ago
  "legitimate interest" isn't a carte blanche. Most of those "legitimate interest" claims are themselves illegal
  - octo888 1y ago
    Legitimate interest includes - Direct Marketing - Preventing Fraud - Ensuring information security It's weasel words all the way down. Having to take into account "reasonable" expectations of data subjects etc. Allowed where the subject is "in the service of the controller" Very broad terms open to a lot of lengthy debate