Hacker News Reader

Comment by ekianjo | Hacker News Reader

If some of your users are in the EU you need to be GDPR compliant.

This is what the law says, but I don’t understand how this is expected to work: without some kind of treaty from the US government, the EU has no way to make US companies comply.

The US and EU have a treaty specifically about enforcing each other's laws. (More accurately, the nations that comprise the EU are individual signatories to such treaties.)

Source? This lawyer seems to think that there’s no applicable treaty.

https://tinyletter.com/mbutterick/letters/you-re-not-the-bos...

Here's the one between the US and the largest economy in the EU:

https://www.congress.gov/treaty-document/108th-congress/27

There is no legal mechanism because such exist mostly for criminal law and civil and public debt collection. So the EU maybe cannot use most of the enforcement mechanisms, except one: You can be fined some amount of money, creating a public debt which can then be collected if there is a treaty about such collections.

There's a slew of individual things that can be done. EU companies can be prevented from doing business with a (willfully) noncompliant company. Wire transfers going through the EU and other operations can be blocked. And, of course, the service itself, its apps, its sites, its traffic, can be blocked from accessing the EU internet (or being accessed from it).

That's not even getting into international pressure levers.

I don't know that we've seen any of those kinds of actions yet, but they're clearly on the table if a company breaking the rules became a real "problem".

The thing is, if you're just completely avoiding doing any business with the EU, having any EU customers or users, and just not touching the EU with a 1000 mile pole and avoiding the GDPR in such a fashion - well, then there's no reason to go after you. The legislation has done its job.

> And, of course, the service itself, its apps, its sites, its traffic, can be blocked from accessing the EU internet (or being accessed from it).

In other words, the EU can attempt to extend its internet regulations over the rest of the world by implementing a China-style firewall. Well, we'll see if that happens.

It is more akin to the US Sanctions. You don’t have to abide. If you do trade with sanctioned countries, you should not do any kind of business with the US, or pay a hefty penalty.

Here’s a case example, BNP Paribas dealings with sanctioned countries. https://www.wsj.com/articles/bnp-agrees-to-pay-over-8-8-bill...

Have you not heard of extradition treaties?

For example, that's what the US is using on Kim Dotcom.

Reply on news.ycombinator.com