12 ms·

> The ICO also confirmed that companies could not avoid accountability by withdrawing their services in the UK. This is quite a slippery slope. If I host a web

by elAhmo 1y ago

> The ICO also confirmed that companies could not avoid accountability by withdrawing their services in the UK. This is quite a slippery slope. If I host a website in one country, I do not necessarily care where people access my website from. It is not like I actively provide a service to them - they just use internet (decentralised network) to access it. What if I publish a newspaper here, someone takes it where the contents are illegal, am I accountable?

afandian 1y ago
I think it's a conflict that was baked into the Internet at its conception. A non-geographic service overlaid on top of a world with a huge amount of geography and borders.
- josephg 1y ago
  Yeah. We had a chance to invent our own governance on the internet. But we abdicated, and made the internet a free for all. As a result, national governments have stepped in to provide the governance we didn’t program in. And they do it - of course - in an inconsistent, ad hoc way. There was a period a couple hundred years ago when it was all the rage internationally to write constitutions. Lots of countries got constitutions within a few decades, and almost no constitutions have been written since then. I wonder sometimes how the internet would be different if it were implemented in an era or culture in which people believed in that sort of thing.
  - zerocrates 1y ago
    I don't think it would make much difference; an internet constitution would be worth about as much as the paper it's not written on.
    - widerworldweb 1y ago
      Paper is so wasteful, prone to the vagaries of time, and also to forgery. It could be written into blockchain to avoid this, as I hear that is quite popular nowadays.
      - josephg 1y ago
        Yes, think of all the paper wasted printing the US constitution. It would have been much more environmentally friendly if they stored it in a blockchain! polite coughs
    - josephg 1y ago
      Yeah; you need an enforcement system too. And some way to amend rules and adjudicate. But we could implement all that if we actually wanted to. Eg, have broad rules to refuse to peer with anyone who doesn’t agree with the rules of the internet. That is in essence already in place just for CSAM. We just pretend the internet is a free for all in all other cases.
- immibis 1y ago
  The bordered nature of geography is just as much of a social construct as the borderless nature of the internet is. It's not a given that this war will be won by the former.
wiether 1y ago
It appears that you are mixing things here. It's not about "hosting a website", it's about providing services. If you provide services, like selling a newspaper, in the UK, you need to respect their laws, or you will suffer the legal implications of not doing so. And regarding the accountability, it refers to the fact that imgur USED TO provide services in the UK: > We have been clear that exiting the UK does not allow an organisation to avoid responsibility for any prior infringement of data protection law, and our investigation remains ongoing. Companies providing services outside the UK can infringe all the UK laws they want, the UK doesn't care. But as soon as you decide to provide services in the UK, you have to follow the law. And, as they explain in the article, if you break the law, stopping to provide services in the UK will not absolve you for your past wrongdoings.
- eduction 1y ago
  It’s you who are mixing things. Putting up a website outside the UK and “deciding to provide services in the UK” are two decidedly different things. UK legal imperialism is self centered and unrealistic and undermines speech the world over.
  - Analemma_ 1y ago
    I’m guessing that Imgur happily accepted the ad revenue from UK users while it served them images. If you genuinely were “not providing services” to UK users, you wouldn’t do that. I’m not happy with extraterritorial assertions over internet services either, but you can’t wish them away with sophistry about “we’re not providing services to them!” if you’re happy to take their money and serve them a page in exchange. That’s the definition of a business providing a service to a customer.
    - iamnothere 1y ago
      Do they run their own ad network, or do the ad networks take the money from advertisers and cut Imgur a check? Maybe instead of trying to enforce your standards on every little site on the internet, you should just focus on the people who actually have a direct point of contact with money coming from UK businesses. (Yes, the ad networks.) It’s completely absurd to say that some hobbyist would have nexus in the UK because they run a Google Adwords campaign to get some occasional pocket change from their project. Pre-Internet, it would be like going after a US magazine because someone brought home a copy from the US. Websites are not global entities by default, somehow responsible for obeying laws across nearly 200 national jurisdictions and many more state/provincial/local jurisdictions, across different languages and legal customs. Completely absurd! Who do you think you are to demand such a thing? On the other hand, I think it would be perfectly fine to say that UK domiciled ad networks cannot put their ads on sites that violate some arbitrary standard. (An anti-freedom law to be sure, but at least it’s consistent with common international conventions.) This puts the onus on the ad network, rather than the site owner, who may not know or care who is visiting or from which country.
seanhunter 1y ago
You already need to care depending on what you are serving, and this has been the case for at least 20 years to my knowledge. The most obvious example of this is websites from the UK or Europe which operate any kind of gambling. [1] This may well be legal (based on licensing) in their jurisdiction, but they still need to restrict access to prevent US people from accessing the service or they will be breaching the US's gambling laws. Likewise many US firm geofence access for EU residents out of fear of GDPR. People hosting news sites have often had to geofence to prevent UK residents from accessing their site if they are hosting any kind of reporting of UK court cases that are under embargo or matters that are subject to one of the UK's famous "Super injunctions" [2] [1] eg this guy was on the board of a listed UK company operating as far as they were concerned entirely legally who was arrested in NYC https://www.theguardian.com/business/2006/sep/14/gambling.money https://www.theguardian.com/business/2006/sep/14/gambling.mo... [2] eg In the "Ryan Giggs" super injunction case https://en.wikipedia.org/wiki/2011_British_privacy_injunctions_controversy https://en.wikipedia.org/wiki/2011_British_privacy_injunctio...
- BeFlatXIII 1y ago
  > People hosting news sites have often had to geofence to prevent UK residents from accessing their site if they are hosting any kind of reporting of UK court cases that are under embargo or matters that are subject to one of the UK's famous "Super injunctions" [2] …and if the site has no UK assets, how enforceable is the injunction?
  - pixl97 1y ago
    I mean, in the case of the US, you board a plane in country X going to country Z, it flies over country Y which is friends with the US. The US has country Y land the plane and has the plane boarded by armed men that drag you off kicking and screaming where you are put in a cage and then shipped to the US.
    - morkalork 1y ago
      Iirc this happened to a Russian man who operated an online gambling site when he went on vacation to the Caribbean. The plane he was on had an unscheduled landing in Florida for a mechanical issue and surprise, surprise, the FBI were waiting there to arrest him!
buran77 1y ago
The following paragraph might shed some light on what that means (emphasis mine): > We have been clear that exiting the UK does not allow an organisation to avoid responsibility for any prior infringement of data protection law In that context it's completely fair to say "leaving doesn't absolve you of past transgressions". Edit. If Imgur made any revenue from UK users then it becomes impossible to claim plausible deniability on any definition of "providing a service". If the UK can do something about this is a different matter. They could make CEOs/board personally or even criminally liable for the company's failure to pay a fine but probably won't.
- matt-p 1y ago
  Definition of 'Revenue in the UK' is a bit debatable though isn't it? I sell a advertising package from my US HQ based self serve advertising portal to a British company who use the service to advertise to customers in the UK. Ok - kinda UK revenue. How about 'To advertise to customers in the US' well it's getting highly debatable. What about I sell advertising packages to a US company from my US HQ but someone in the UK views and advert on my site and therefore generates me 0.001¢ - debatable.
  - deleted 1y ago
    [deleted]
  - avianlyric 1y ago
    > What about I sell advertising packages to a US company from my US HQ but someone in the UK views and advert on my site and therefore generates me 0.001¢ - debatable. Not entirely sure what is debatable about this situation. You quite unambiguously derived revenue from a UK citizen here, although not much. If you didn’t want that revenue, then don’t display ads in the UK. If that makes serving traffic to the UK uneconomical, then don’t serve traffic to the UK, problem solved. In practical terms, nobody’s give a crap about you making a couple of dollars here and there incidentally from UK citizens. It quite another matter when your business is clearly dependent on deriving revenue from UK citizens, and you take zero steps to try and comply with UK law. It’s pretty simple, if you want the revenue, the you have to follow the law of the countries your deriving that revenue from. Don’t want to follow the law, then simply don’t try and derive revenue from putting adverts in front of citizens from that country, or by collecting and selling their data.
1vuio0pswjnm7 1y ago
"The ICO also confirmed that companies could not avoid accountability by withdrawing their services in the UK. Mr Capel said: "We have been clear that exiting the UK does not allow an organisation to avoid responsibility for any prior infringement of data protection law, and our investigation remains ongoing." When read in context, it's obvious the statement quoted in the HN conmment refers to only to accountability for "prior infringement", i.e., acts committed before withdrawing services in the UK
giancarlostoro 1y ago
> am I accountable? If you travel to their jurisdiction, yes.
- hdgvhicv 1y ago
  Many countries countries witch apply their laws outside there jurisdiction and borders USA (Kim dotcom) Russia (Skripals) China (Teng Bio) Israel (Mordechai Vanunu)
  - jacquesm 1y ago
    USA BetonSports / https://en.wikipedia.org/wiki/David_Carruthers https://en.wikipedia.org/wiki/David_Carruthers
    - hdgvhicv 1y ago
      He was in America then, if you go to America then you’re going to get arrested - Skylarov found that out. The cases I listed the people were not in the country which performed the actions (dotcom in Nz but upset America, Skripal in UK but upset Russia, etc) If you break Thai law and insult their king it’s generally good enough to simply not go to Thailand. Piss off the wrong country though and they will persue you to a third country even without extradition agreements (Then there cases like Gary McKinnon where they try to extradite you and make your life hell even if they lose. He’d never been to America but they tried very hard to extradite him there) If a country wants you, it will get you. If it wants to protect you, it will, if it is powerful enough. When an American killed Harry Dunn she fled and was protected by America.
  - xdennis 1y ago
    The Mordechai Vanunu case is a bit different as he was convicted of treason (he leaked details of Israel's nuclear bombs while in Britain). It makes sense for treason to apply everywhere. If that were not the case Britain could not have executed Lord Haw-Haw given that he only sent broadcasts from Nazi Germany.
  - giancarlostoro 1y ago
mytailorisrich 1y ago
What they mean, and to take an example that it purposely extreme: If you kill someone in a country you cannot avoid accountability in law by fleeing that country. If they breached laws and regulations then withdrawing their service from the country afterwards does not change anything regarding those breaches (investigation still ongoing, though).
- IlikeKitties 1y ago
  This is neither comparable nor a good example. It's not comparable because the "crime" has been committed in the hosting country (where it's arguably not even a crime) and it's a bad example because there are many incidents of murderers fleeing to non-extradition countries.
  - mytailorisrich 1y ago
    I did say it was extreme on purpose to make the point clear, or so I thought. Looks like it isn't clear to you... Whatever you think of my example, it is exactly the same legal reasoning at play here. If you broke the law then withdrawing does not change that and accountability. > It's not comparable because the "crime" has been committed in the hosting country Obviously not, that's the whole point: They may (investigation ongoing) have breached UK law. So, to really labour the point, if you breach the law in one country then cutting links with that country afterwards does not change anything. Now, to be a bit more substantive than this tedious bike-shedding, I think the UK are just trying to send a message here even if enforcement may be difficult. The EU could do the same with the GDPR since it is the same type of law (global reach and applicability).
    - IlikeKitties 1y ago
      I genuinely think your example is bad and the legal reasoning is bad. A better comparison would be AM Radio broadcasting something obscene into the UK from let's say belgium.
      - silasdavis 1y ago
KoolKat23 1y ago
This part bothers me. Enforcement seems to be at their discretion. In this case the framing or reality around the fine is very bad, they sort of say it's intentional themselves. They're leaving and they're getting the fine. Implying if they didn't leave and implemented changes, that there is a chance they may not have been fined.
deleted 1y ago
[deleted]
FMecha 1y ago
This situation here is what I sort of implied when lfgss shut down: https://news.ycombinator.com/item?id=42444354 https://news.ycombinator.com/item?id=42444354
account42 1y ago
I agree, but if you sell products or subscriptions to people in a foreign country the situation becomes different. And if you run ads then the situation is more complicated but closer to that than to your personal website. IMO the question is not if such services should be held accountable by local laws but how they should be held accountable. I think it would make more sense to go after the UK entities profiting from the endeavor: advertizers and financial institutions involved.

by elAhmo 1y ago

afandian 1y ago

I think it's a conflict that was baked into the Internet at its conception. A non-geographic service overlaid on top of a world with a huge amount of geography and borders.

josephg 1y ago
Yeah. We had a chance to invent our own governance on the internet. But we abdicated, and made the internet a free for all. As a result, national governments have stepped in to provide the governance we didn’t program in. And they do it - of course - in an inconsistent, ad hoc way. There was a period a couple hundred years ago when it was all the rage internationally to write constitutions. Lots of countries got constitutions within a few decades, and almost no constitutions have been written since then. I wonder sometimes how the internet would be different if it were implemented in an era or culture in which people believed in that sort of thing.
- zerocrates 1y ago
  I don't think it would make much difference; an internet constitution would be worth about as much as the paper it's not written on.
  - widerworldweb 1y ago
    Paper is so wasteful, prone to the vagaries of time, and also to forgery. It could be written into blockchain to avoid this, as I hear that is quite popular nowadays.
    - josephg 1y ago
      Yes, think of all the paper wasted printing the US constitution. It would have been much more environmentally friendly if they stored it in a blockchain! polite coughs
  - josephg 1y ago
    Yeah; you need an enforcement system too. And some way to amend rules and adjudicate. But we could implement all that if we actually wanted to. Eg, have broad rules to refuse to peer with anyone who doesn’t agree with the rules of the internet. That is in essence already in place just for CSAM. We just pretend the internet is a free for all in all other cases.
immibis 1y ago
The bordered nature of geography is just as much of a social construct as the borderless nature of the internet is. It's not a given that this war will be won by the former.

wiether 1y ago

It appears that you are mixing things here. It's not about "hosting a website", it's about providing services. If you provide services, like selling a newspaper, in the UK, you need to respect their laws, or you will suffer the legal implications of not doing so. And regarding the accountability, it refers to the fact that imgur USED TO provide services in the UK: > We have been clear that exiting the UK does not allow an organisation to avoid responsibility for any prior infringement of data protection law, and our investigation remains ongoing. Companies providing services outside the UK can infringe all the UK laws they want, the UK doesn't care. But as soon as you decide to provide services in the UK, you have to follow the law. And, as they explain in the article, if you break the law, stopping to provide services in the UK will not absolve you for your past wrongdoings.

eduction 1y ago
It’s you who are mixing things. Putting up a website outside the UK and “deciding to provide services in the UK” are two decidedly different things. UK legal imperialism is self centered and unrealistic and undermines speech the world over.
- Analemma_ 1y ago
  I’m guessing that Imgur happily accepted the ad revenue from UK users while it served them images. If you genuinely were “not providing services” to UK users, you wouldn’t do that. I’m not happy with extraterritorial assertions over internet services either, but you can’t wish them away with sophistry about “we’re not providing services to them!” if you’re happy to take their money and serve them a page in exchange. That’s the definition of a business providing a service to a customer.
  - iamnothere 1y ago
    Do they run their own ad network, or do the ad networks take the money from advertisers and cut Imgur a check? Maybe instead of trying to enforce your standards on every little site on the internet, you should just focus on the people who actually have a direct point of contact with money coming from UK businesses. (Yes, the ad networks.) It’s completely absurd to say that some hobbyist would have nexus in the UK because they run a Google Adwords campaign to get some occasional pocket change from their project. Pre-Internet, it would be like going after a US magazine because someone brought home a copy from the US. Websites are not global entities by default, somehow responsible for obeying laws across nearly 200 national jurisdictions and many more state/provincial/local jurisdictions, across different languages and legal customs. Completely absurd! Who do you think you are to demand such a thing? On the other hand, I think it would be perfectly fine to say that UK domiciled ad networks cannot put their ads on sites that violate some arbitrary standard. (An anti-freedom law to be sure, but at least it’s consistent with common international conventions.) This puts the onus on the ad network, rather than the site owner, who may not know or care who is visiting or from which country.

seanhunter 1y ago

You already need to care depending on what you are serving, and this has been the case for at least 20 years to my knowledge. The most obvious example of this is websites from the UK or Europe which operate any kind of gambling. [1] This may well be legal (based on licensing) in their jurisdiction, but they still need to restrict access to prevent US people from accessing the service or they will be breaching the US's gambling laws. Likewise many US firm geofence access for EU residents out of fear of GDPR. People hosting news sites have often had to geofence to prevent UK residents from accessing their site if they are hosting any kind of reporting of UK court cases that are under embargo or matters that are subject to one of the UK's famous "Super injunctions" [2] [1] eg this guy was on the board of a listed UK company operating as far as they were concerned entirely legally who was arrested in NYC https://www.theguardian.com/business/2006/sep/14/gambling.money https://www.theguardian.com/business/2006/sep/14/gambling.mo... [2] eg In the "Ryan Giggs" super injunction case https://en.wikipedia.org/wiki/2011_British_privacy_injunctions_controversy https://en.wikipedia.org/wiki/2011_British_privacy_injunctio...

BeFlatXIII 1y ago
> People hosting news sites have often had to geofence to prevent UK residents from accessing their site if they are hosting any kind of reporting of UK court cases that are under embargo or matters that are subject to one of the UK's famous "Super injunctions" [2] …and if the site has no UK assets, how enforceable is the injunction?
- pixl97 1y ago
  I mean, in the case of the US, you board a plane in country X going to country Z, it flies over country Y which is friends with the US. The US has country Y land the plane and has the plane boarded by armed men that drag you off kicking and screaming where you are put in a cage and then shipped to the US.
  - morkalork 1y ago
    Iirc this happened to a Russian man who operated an online gambling site when he went on vacation to the Caribbean. The plane he was on had an unscheduled landing in Florida for a mechanical issue and surprise, surprise, the FBI were waiting there to arrest him!

buran77 1y ago

The following paragraph might shed some light on what that means (emphasis mine): > We have been clear that exiting the UK does not allow an organisation to avoid responsibility for any prior infringement of data protection law In that context it's completely fair to say "leaving doesn't absolve you of past transgressions". Edit. If Imgur made any revenue from UK users then it becomes impossible to claim plausible deniability on any definition of "providing a service". If the UK can do something about this is a different matter. They could make CEOs/board personally or even criminally liable for the company's failure to pay a fine but probably won't.

matt-p 1y ago
Definition of 'Revenue in the UK' is a bit debatable though isn't it? I sell a advertising package from my US HQ based self serve advertising portal to a British company who use the service to advertise to customers in the UK. Ok - kinda UK revenue. How about 'To advertise to customers in the US' well it's getting highly debatable. What about I sell advertising packages to a US company from my US HQ but someone in the UK views and advert on my site and therefore generates me 0.001¢ - debatable.
- deleted 1y ago
  [deleted]
- avianlyric 1y ago
  > What about I sell advertising packages to a US company from my US HQ but someone in the UK views and advert on my site and therefore generates me 0.001¢ - debatable. Not entirely sure what is debatable about this situation. You quite unambiguously derived revenue from a UK citizen here, although not much. If you didn’t want that revenue, then don’t display ads in the UK. If that makes serving traffic to the UK uneconomical, then don’t serve traffic to the UK, problem solved. In practical terms, nobody’s give a crap about you making a couple of dollars here and there incidentally from UK citizens. It quite another matter when your business is clearly dependent on deriving revenue from UK citizens, and you take zero steps to try and comply with UK law. It’s pretty simple, if you want the revenue, the you have to follow the law of the countries your deriving that revenue from. Don’t want to follow the law, then simply don’t try and derive revenue from putting adverts in front of citizens from that country, or by collecting and selling their data.

1vuio0pswjnm7 1y ago

"The ICO also confirmed that companies could not avoid accountability by withdrawing their services in the UK. Mr Capel said: "We have been clear that exiting the UK does not allow an organisation to avoid responsibility for any prior infringement of data protection law, and our investigation remains ongoing." When read in context, it's obvious the statement quoted in the HN conmment refers to only to accountability for "prior infringement", i.e., acts committed before withdrawing services in the UK

giancarlostoro 1y ago

> am I accountable? If you travel to their jurisdiction, yes.

hdgvhicv 1y ago
Many countries countries witch apply their laws outside there jurisdiction and borders USA (Kim dotcom) Russia (Skripals) China (Teng Bio) Israel (Mordechai Vanunu)
- jacquesm 1y ago
  USA BetonSports / https://en.wikipedia.org/wiki/David_Carruthers https://en.wikipedia.org/wiki/David_Carruthers
  - hdgvhicv 1y ago
    He was in America then, if you go to America then you’re going to get arrested - Skylarov found that out. The cases I listed the people were not in the country which performed the actions (dotcom in Nz but upset America, Skripal in UK but upset Russia, etc) If you break Thai law and insult their king it’s generally good enough to simply not go to Thailand. Piss off the wrong country though and they will persue you to a third country even without extradition agreements (Then there cases like Gary McKinnon where they try to extradite you and make your life hell even if they lose. He’d never been to America but they tried very hard to extradite him there) If a country wants you, it will get you. If it wants to protect you, it will, if it is powerful enough. When an American killed Harry Dunn she fled and was protected by America.
- xdennis 1y ago
  The Mordechai Vanunu case is a bit different as he was convicted of treason (he leaked details of Israel's nuclear bombs while in Britain). It makes sense for treason to apply everywhere. If that were not the case Britain could not have executed Lord Haw-Haw given that he only sent broadcasts from Nazi Germany.
- giancarlostoro 1y ago

mytailorisrich 1y ago

What they mean, and to take an example that it purposely extreme: If you kill someone in a country you cannot avoid accountability in law by fleeing that country. If they breached laws and regulations then withdrawing their service from the country afterwards does not change anything regarding those breaches (investigation still ongoing, though).

IlikeKitties 1y ago
This is neither comparable nor a good example. It's not comparable because the "crime" has been committed in the hosting country (where it's arguably not even a crime) and it's a bad example because there are many incidents of murderers fleeing to non-extradition countries.
- mytailorisrich 1y ago
  I did say it was extreme on purpose to make the point clear, or so I thought. Looks like it isn't clear to you... Whatever you think of my example, it is exactly the same legal reasoning at play here. If you broke the law then withdrawing does not change that and accountability. > It's not comparable because the "crime" has been committed in the hosting country Obviously not, that's the whole point: They may (investigation ongoing) have breached UK law. So, to really labour the point, if you breach the law in one country then cutting links with that country afterwards does not change anything. Now, to be a bit more substantive than this tedious bike-shedding, I think the UK are just trying to send a message here even if enforcement may be difficult. The EU could do the same with the GDPR since it is the same type of law (global reach and applicability).
  - IlikeKitties 1y ago
    I genuinely think your example is bad and the legal reasoning is bad. A better comparison would be AM Radio broadcasting something obscene into the UK from let's say belgium.
    - silasdavis 1y ago

KoolKat23 1y ago

This part bothers me. Enforcement seems to be at their discretion. In this case the framing or reality around the fine is very bad, they sort of say it's intentional themselves. They're leaving and they're getting the fine. Implying if they didn't leave and implemented changes, that there is a chance they may not have been fined.

deleted 1y ago

[deleted]

FMecha 1y ago

This situation here is what I sort of implied when lfgss shut down: https://news.ycombinator.com/item?id=42444354 https://news.ycombinator.com/item?id=42444354

account42 1y ago

I agree, but if you sell products or subscriptions to people in a foreign country the situation becomes different. And if you run ads then the situation is more complicated but closer to that than to your personal website. IMO the question is not if such services should be held accountable by local laws but how they should be held accountable. I think it would make more sense to go after the UK entities profiting from the endeavor: advertizers and financial institutions involved.