Hacker News Reader

Comment by coldcode | Hacker News Reader

The problem comes down to: how do you follow local or national laws when your business crosses many (or all) national boundaries? While we all would like better privacy protection, it's very hard to define exactly what that means for all types of information especially if it is different in different countries.

View on HN

This is already a problem for lots of other things, so it is not unique. I worked in a oil service company in Norway and we always had a lot of crap to deal with to make sure nothing when we sold our software to Iran, no American was in any way involved in that process. That is difficult when you all work in an office with people from lots of places, and you are used to sharing information and working together and suddenly you have to be conscious about the citizenship of some of your colleagues.

There are already a myriad of national difference you have to deal with, accounting rules, rules on corruption and bribes, which country has which patents etc. Privacy just seems like any other item on that list.

> a oil service company in Norway ... we sold our software to Iran

The company was helping Iran avoid sanctions?!

Imposing costs on their oil sector, including by banning trade with it, was a necessary part of preventing them from acquiring nuclear weapons. They only gave up the weapons program in return for relief from the sanctions.

Was Norway participating in those sanctions? I thought the oil sanctions were just by USA and EU.

A good question. Sanctions included other countries outside the US and EU, but I don't recall the specifics or what Norway's position was.

However, helping Iran build nuclear weapons is a very serious, very consequential thing to be doing whether or not your country is officially participating in sanctions.

Would it be ok for your company to help Mexican drug cartels, even if it was legal? This is far more serious. If Iran obtained nuclear weapons, Norway would suffer the consequences too.

Well, you have to obeye local law. Only because the internet makes it easy to provide services in other countries doesn't put you outside their law - the territorial principle applies.

Regarding the data protection specifics, well, maybe it makes sense to follow the standards of the most rigid country globally?

The wild west manner of US-companies and government are really annoying, the mindset is - if I get my hand on the data it's my property. That is wrong, the user trusts "you" with it's data and expects it's usage only in the beforehand given consent for the necessary purposes. It's like copyright, the company has certain usage rights but does not own it.

The principles are easy: data processing has to be purposeful, lawful, fair and user rights and will is to be respected.

> Regarding the data protection specifics, well, maybe it makes sense to follow the standards of the most rigid country globally?

Have you really considered the implications of that precedent? Blasphemy law in Saudi Arabia. Censorship law in China.

Never mind what happens when the laws in two different countries conflict, e.g. privacy vs. data retention.

"Brick and mortar" companies deal with this stuff. Why should the tech industry be exempt?

If there is profit to be had, the tech giants will figure it out. If there is no profit, then those countries with laws that are on the fringe will have to make do without, or change their laws to be more mainstream.

edit - I'm not implying that this is easy. Or, can't be made easier. Only that laws have varied by country for eons and merchants have always found a way to deal.

But this is already a problem, that hasn't been solved. Facebook e.g. follows essentially American moral standards when censoring. That really crashes with e.g. far more liberal views northern Europe. People post what are regular pictures and accepted social norms in say Scandinavia but which gets removed or accounts closed down or what not because of the far more pious American morality.

This is already part of a national debate going on whether we should allow America to define our moral codes and values.

If we throw in muslims world which are hundreds of millions of people, then this stuff is going to turn into a big mess. Since I don't live in the middle east, maybe it already is a mess.

> "Brick and mortar" companies deal with this stuff. Why should the tech industry be exempt?

"Brick and mortar" companies decide where to lay their bricks. You put a website on the internet and it's on the whole internet. In practice you can't even restrict who can access it, as Netflix can attest.

Suppose I don't agree with the laws in X country, or they conflict with the law in the country I'm physically in. Is it really going to satisfy anybody if I put "may not access this service from X country" in the terms of service somewhere, implement some fig leaf of a system to prevent access from there that everyone and their mother can bypass in five seconds (or the bypass ends up built into web browsers), and then millions of people from that country access it anyway?

How does that help anybody vs. just letting the service operate under the laws of the country where it physically exists and letting the users decide if they want to patronize a service that operates under that jurisdiction's laws? (Unless the goal is to increase the adoption of Tor and other anti-censorship software?)

There is a huge difference. On the internet, by default, you are international. Brick and mortar stores, by default, are only local.

We have a website that sells stuff. It is "not available" in Europe. We do not ship to Europe. We block email addresses with European domains and let them know we're not available. We attempt to block Europe ip addresses by geolocating and let them know we're not available in Europe. Yet people from Europe still slip in. We go through several steps to let them know we cannot handle their business, but they still get through.

Are we liable? Speaking generally, laws do not necessarily care about any mitigations we take. We could still be fined millions of dollars (more than our revenue) in certain countries despite doing our best to block them.

Sorry, but it's completely ridiculous.

The sticking point seems to still be spying. It's generally outside the control of big tech companies, and so the issue is really between governments, and companies are stuck in the middle. (Yes, I know some have colluded with spy agencies, but not always willingly.)

I assume they all collude with spy agencies. Qwest's CEO learned the hard way what happens when you don't break the law when they order you to. That's the nature of corruption. They write laws that you have to break to survive and as long as a government official likes you you get to keep breaking that law. When you don't obey orders they enforce the laws only on you to make it hard to compete or so that you lose your freedom. https://www.rt.com/usa/qwest-ceo-nsa-jail-604/

(edited to be a little more clear after a cup of coffee)

Damn. I hadn't read about that before. That's messed up. Most messed up being that the courts basically refused to hear the truth because it was classified. There's a defense for ya - "We can't submit the truth as evidence, so we'll have to go with this falsehood over here. Good luck."

I think more and more you may find it becomes popular to mandate a user's data be retained in their country of origin. Otherwise some sort of agreement would need to be made that a foreign citizen's data on a corporate data center is like an embassy... it's digitally treated like it's on that nation's soil, and subject to that nation's laws.

The latter is likely much less practical in the real world, because our spy agencies don't really care where your data is, they're going to try and collect it, and the EU has made it clear that isn't okay with them.

In an ideal world, the United States and other major nations would all sign privacy laws as strong as the EU's. But I can't see that happening in our current political climate. Parties on both sides are more than happy to strip us of our privacy. And corporations oppose it as well.

You start with being ethical. In the online business, that pretty much covers most things with the exception of VAT, the clusterfuck known as "intellectual property", and the fine line between freedom of speech and hate speech. (I'm ignoring doing business in repressive regimes, because there you've only got yourself to blame.)

The only reason why US companies are in trouble in Europe is because they use unethical practices that happen to still be legal in the US.

However, it was pretty obvious up front that those practices are unethical and illegal in most of the Western world.

So please, stop whining about the complexities of international businesses when the root cause is simply a lack of basic decency.

This is indicative of how nationalism, a concept formed as a result of the effects of the Gutenberg printing press[1], is now obsolete and counterproductive in a globalized, electrically interconnected society.

[1] The Gutenberg Galaxy, Marshall McLuhan

There's also a Data Protection Regulation that should pass the EU Parliament this year and will unify the privacy laws in the EU (for the most part). Although, as usual with EU regulations and directives, it will be about 2 years before national governments implement it locally.

EU regulations are immediately enforceable and do not need to be implemented by national laws (unlike directives).

He's sorta correct while regulations are binding they do have a (usually fairly long) grace period and also quite often some generic complete opt-out mechanism.

Reply on news.ycombinator.com