Hacker News Reader

Comment by beefhash | Hacker News Reader

There's still the issue of enforcement. If the operators and servers are all outside the EU, how would a user effectively get courts to enforce the GDPR?

View on HN

> how would a user effectively get courts to enforce the GDPR?

Most Americans would prefer not to have European court judgments against them. That said, I agree this is absurd. If I choose to do business in your country, that is one thing. But extending that to blocking my right not to do business in your jurisdiction is silly.

There is no enforcement because if GDPR claims that it has jurisdiction over entities not having physical presence in the EU, then the law isn't lawful to begin with.

And if the EU started going after companies/individuals who don't have presence in the EU because they claim "we say so", well, then the rest of the world can play that game to.

Maybe the rest of the world will put sanctions on EU bureaucrats if EU bureaucrats start trying to shake down companies that have no presence in the EU.

Does your bank need to maintain a good relationship with European governments? If not, does it need to remain connected to banks that do?

That's not how most regulations work. If you are a chemical company selling something that is legal in the US but illegal in the EU, the EU doesn't use your bank to enforce their regulations on your business in the US.

Using the banks to cut off commerce across borders is an enforcement action for what countries agree are crimes - terrorism, money laundering, fraud, etc. It takes a lot of political willpower and negotiation to use that tool. I sincerely doubt it would be used against American websites that choose to not serve the EU.

The US used this against Rossmann GmbH, which was a German company, in Germany, selling cuban cigars to a German.

And they got cut off from PayPal, and the credit card networks for quite a while.

If the US can use it for selling a product in a store that’s entirely legal to sell under EU law, then the EU can also use the same rules for GDPR.

That's a perfect illustration of my point. The US went to pretty great lengths to have specific bans on import / export from Cuba. German train companies build plenty of things that would not meet FRA standards in the US, the US does nothing about it. But Cuba is seen as a special case. So do you think GDPR and PII are more like Cuba and terrorism, or more like chemicals and transportation standards? I think the latter.

Definitely the former: the way Europeans are talking about GDPR, insufficient respect for privacy is a human rights violation. We don't sanction Cuba because it makes trains the wrong way, we sanction it because we feel it violates its citizens' human rights.

For U.S. companies that have a physical presence in the EU, the GDPR can be enforced directly.

For the other cases, EU uses intentional law. EU-U.S. Privacy Shield data sharing agreement for example.

In the case that the law can't be enforced directly against the violating company, EU can enforce it trough companies that provide the infrastructure for handling user data and have dealing with EU.

This includes trackers, online ad-selling companies, clouds providers, CDN provides, ISP's that have physical presence in EU and who handle user data when people visit the site. Like Google, FB, Amazon, cloufare, Akamai, Rackspace, Digital Ocean, ......

Also, if the company takes any money from the user from EU, they can get into trouble when banks with business in EU stop transferring payments.

Only if the company is handling all user data using companies with no EU presence and are not violating any US-EU privacy agreements, they should be safe.

If the company does not have a data protection officer (or if the DPO doesn't comply with users' requests), users can go to their national government's data protection regulator. No need to go to court.

Yes but what will that regulator do once they determine the foreign government in which the offense occurred is indeed guilty?

Arrests when an operator visits an EU country? I mean, that's how the US seems to get gambling company CEOs and internet betting site operators...

I find it pretty problematic that the US does that to gambling site operators. People who do things that are legal where they live should not have to fear that they'll get arrested when they visit a foreign country just because those things are not legal in that country.

Is anything in GDPR an arrestable offence?

Not paying, and getting a bench warrant for an overdue fine?

Arrest for EU bureaucrats for when they go outside the EU for trying to enforce unlawful laws?

It's not the EU but the member states that are enforcing the regulation. They are also free to make minor changes to the regulation (e.g. Austria won't allow NGOs to make complaints and releases state-run companies from the regulation's duties).

Extradition?

Extradition treaties usually limit extradition to things that are punishable in both countries.

But not being able to step foot on European soil due to an outstanding bench warrant is at least severely inconvenient.

Its ridiculous on its face. European laws don't apply to American companies if they don't do business in Europe.

It will become a major international incident if people try to do this.

Yes, extradition for EU officials who try to enforce illegal lawss against the citizens of sovereign nations.

By that rule we’d have to arrest all US officials, for constantly interfering in Europe.

Stuff like https://www.reddit.com/r/technology/comments/ka26b/paypal_bl... (a german company, in germany, selling cuban cigars, to a german, got as result threats from their payment processors (US companies)).

Or cases like this https://en.wikipedia.org/wiki/Society_for_Worldwide_Interban...

The US has constantly stolen money from EU citizen doing business in the EU for violating US laws.

And then there’s the Kim Dotcom case. Also similar story, US enforcing US law in New Zealand and Germany.

The US deserves some of its own medicine.

Reply on news.ycombinator.com