Hacker News Reader

For some reason it's a big national security concern when Chinese companies collect data on US citizens, but when Europeans apply the same caution with American companies, people across the Atlantic see it purely from a business perspective. Why is that?

This isn't TikTok and what people do on their private phones. This is a foreign company that has the capability to siphon off a lot of data about business decisions, businesses connections, contracts etc.

> Why is that?

because china is a totalitarian country and the us isn't

Not being a totalitarian country gives you the right to spy on people?

Not being totalitarian implies no to spy on your people. Spying on your people implies being totalitarian.

Pretty sure US agencies have more rights to spy on not-their people, e.g., Microsoft EU customer data than Microsoft US customer data.

Let's be real, no Western country is banning Chinese products or services because China is spying on their own citizens or abusing Uyghurs. That's at best the "feel good" story sold in the media to get the people's support and distract from other issues. They're banning them for 2 reasons. One is that China will abuse them to spy and get a competitive advantage over those other countries. The second is that it's hard to compete in price so local alternatives are pushed out.

In the same vein the EU isn't blocking a US company from collecting data because the US is spying on its own citizens and abusing people of color. They're doing it for almost the same 2 reasons. Everyone knows (with evidence) that the US will abuse them to spy and get a competitive advantage. The second is that it's hard to compete in performance/features so local alternatives are pushed out.

The only reason to see a difference here is nationalistic bias. And that's fair enough, most people aren't educated enough (not talking just academic degrees) to be capable of critical thinking when their own principles or morals are under attack. They will just go to the first easy, "feel good" explanation when they do something to others, and the opposite when others do something to them.

My favorite illustration on the topic: https://pics.me.me/their-barbarous-wastes-our-blessed-homela...

You make it sound as if the GDPR is specifically targeted at US companies, which is not the case. It applies to domestic companies too.

Tell that to Assange. Or Snowden.

Sir, you must have grown up in front of a TV with strictly US American programming.

From many European capitals perspective, the USA is one wrong election away from fascism.

Imagine things would move towards every electronic document in American companies going through the servers of a European country, say in France. Do you really believe, there wouldn't be an outcry in Washington? Do you really believe, Congress would just watch? Do you really believe, US security agencies would just sit idly by? I don't.

This has nothing to do with totalitarian countries. Regardless of the political system, this is about a loss of control. About industrial espionage. Ask anyone who's work concerns US national security how much they trust foreign democries, like for instance France.

From the point of view of the EU it is, since it violates basic (EU) rights of (at least) non-US citizens since 2001 :

https://news.ycombinator.com/item?id=33751805#33757090

For the same reasons you're not allowed to sign particular contacts, such as enslaving yourself. Without restriction companies will do every illegal thing they can get away with via their collective power of size versus your weak individualism.

In some cases it's rather trivial, in other cases its dependent on the survival of the nation state to enforce the rules on the corporation.

Hmm that is a good point. It is forbidden to sign contracts of enslavement in every country I know of, even if the potential contractee is making it free from duress.

Therefore forbidding some types of contracts for everyone does have established precedent.

However, there does not appear to be a limit to this.

For example, can governments ban their residents from signing contracts to distribute or host porn, gambling, etc.?

> can governments ban their residents from signing contracts to distribute or host porn, gambling, etc.?

The question is always what do local laws say. Even in the US you have laws or court decisions that allow child marriage, non-revocable consent, upskirt photos, or regulate that men are allowed to show nipples but women aren't.

Other countries have equally outrageous (or reasonable, depending on your views) laws making something effectively (il)legal. So yes, governments can and do prohibit porn or gambling, or just the hosting and distribution. Laws and regulation can have a lot of purposes. They can protect you from abuse you may not even understand, or they can even protect the abusers.

They could, but at the risk of losing public mandate, leading to a change of government and/or losing in the next elections.

In somewhat functional representative democracies, that is.

> I understand the hope is that companies will comply rather than forego the entire European market, but if they don't, the last consequence is ultimately on the consumer, not the company.

This is one hope sure but at least in Germany the simple thing about it is that people don't want to lose control over their data if they don't have to (we even have a word for it: "Datensparsamkeit" = data econonomy/thriftiness). If that means that some German company won't be able to use O365, so be it.

Only few here will care what happens to Microsoft because of this. It's not about Microsoft. It's about people who use it (and/or force you to use it).

I don't see a downside here. There are other solutions within the Microsoft product portfolio and outside.

The fact that a government agency looks it up and gives you a result saves you actually money because you don't have to hire somebody to check that for you and save you from lawsuits. It's a service you already paid for with your taxes. I don't see the problem here either.

> I understand the hope is that companies will comply rather than forego the entire European market, but if they don't, the last consequence is ultimately on the consumer, not the company.

Essentially you are asking „why should a government expect anyone to follow the law“

It's more "why should a government expect any foreign company to follow the law".

Personally I run a small business, GDPR came out, our solution is to just violate it and not care. They have no legal jurisdiction over us so their laws do not matter.

If we had to comply with every jurisdictions special laws on the entire planet we'd surely waste most of our time doing it.

Because when you're doing business in the EU you must follow EU law.

Nobody is telling MS what to do in the US.

<< If we had to comply with every jurisdictions special laws on the entire planet we'd surely waste most of our time doing it.

Without making a judgment here if you do business somewhere the expectation typically is that you will comply with local laws. This is partially the reason why only big companies can handle truly international business.

<< GDPR came out, our solution is to just violate it and not care.

Anecdotally, when GDPR came out, in the old country the, almost, first thing that happened is whole bunch of companies started bothering small businesses saying they are not complying and offering to bring them into compliance by adding cookie warning popup we love so much.

Microsoft has equipment and employees in Europe and specifically, in Germany. Plenty of room to expect them to follow the law.

It seems you are not doing business within the EU. Microsoft does business within the Eu and how important that business is you could see when Munich tread the water to migrate to Linux and open office

Are you serious or is this a strawman posted as a joke?

Just applying this to medicine, car safety, building codes and fire, food safety, industrial regulations saying 'you can't dump toxic waste around', etc etc makes me really surprised someone would actually hold such a bizarre opinion.

> I'm not European, and maybe this is why I struggle to understand this

Put it another way.

Most sensible Americans would rather have European employment law and healthcare provisions.

Well, the same goes for privacy legislation....

> why do people want regulators to...

The first misconception is that governments do what people want. They do what serves their national and personal interests. What people want plays a rather small role in it. Far to often they do the exact opposite.

> I understand the hope is that companies will comply

Not at all, they can comply or fuck off. The US gov just runs things differently from the EU. They want full access to everything in secrecy and will hand over or sell data to corporations if it serves US interests.

It means for EU enterprise all information on suppliers, customers, orders, road maps, finances etc etc can be forwarded to your US competitors.

You also forget how easy it is to make software. If [say] Microsoft no longer wants to do it there will be others.

The whole point of the EU is to instruct how business is done here. It was specially designed to stand up to uncle Sam and his army of evil automatons.

I agree in principle, but not if it is applied to Microsoft 365 or GCP.

If it’s my small business animal shelter, or my grocery store, or even just my little SaaS… leave me alone, please, from requirements like the Quebec translation law, or similar.

Microsoft 365 is different. Odds are that there are dozens of businesses you interact with, who store their data in 365 without your knowledge. Microsoft 365 is a “in the shadows” method you probably don’t know of that is sending your data to the US.

If I could lay down a principle, it would be that the privacy rule should be determined on the privacy level of the company I the consumer interact with. If I interact with a EU business, I do not expect my data to enter the US by any method. If I interact with a US business, that is implied consent.

Leave you alone to determine your own health code? To buy meat without proper paperwork? To hire children to work? Where is the border?

Speaking from the US perspective, Europe still imports from Xinjiang region of China, where over 2 million Muslims do forced labor. The US banned imports already. Not only that, according to SCMP, they more than doubled in just August.

Straighten out the obvious before adding another yoke on small businesses.

We also import goods from the US where prisoners do forced labour.

At any rate; one bad thing does not cancel out another. We can fight both slave labor and strive for protecting citizen data.

True - but equating the US prison system to what is happening to them is an absurdity. It’s like if Nazi Germany said their camps weren’t that bad, after all, the US has prisons.

The Nazi camp counterpart for US would be Guantanamo: https://en.m.wikipedia.org/wiki/Guantanamo_Bay_detention_cam...

They just moved it to occupied foreign soil to technically not have a concentration camp in US soil. But then Germany had concentration camps in occupied soil as well, like Auschwitz in occupied Poland.

That does not answer my question at all

I think what parent is trying to say that at certain point over-regulation is not helpful and actually detrimental not just to the business, but the ecosystem as a whole. For a smaller business, onerous regulation could mean closing the doors. For a big business, the burden is also there, but it can more easily withstand it due to its size ( and it typically has some resources to throw at a given issue ).

I agree that there are some 'minimal functioning society' laws like the ones you listed, but I am not certain Canada law example in previous posts or GDPR falls in the same category.

As usual, the question is that of where the line is. And that should be determined by societies at large.

What parent forgot to mention is that (from what I managed to find out) law 96 doesn't apply to businesses with less than 25 employees. Down from less than 50 in the previous law (though I'm not certain what other changes might have been made).

Because individuals rarely have the choice here in the US. Our schools here require the use of Google accounts in a manner which is almost certainly illegal, but isn't enforced anyways. My kids privacy is mandatorily violated because of a decision of the school district. So I have to hope regulators here will wise up and start to force schools to abandon harmful products.

So what you think of as freedom of choice often isn't for students, employees, and consumers. It's why we need drastically more business regulation to guarantee individual rights.

The EU has a population of nearly 450M. That's a sizeable market. You might imagine that Microsoft would like a piece of that and would be prepared to ensure that their products meet the standards required to earn it. They already go to some lengths to adapt their products to various locales and languages in order to compete in certain markets. Adapting Office365 to comply with EU law and gain access to that market would seem to be just the cost of doing business.

People expect their government to protect them.If I buy a product based on false advertising,i will be pissed of at the government for allowing that false advertising, instead of blaming my self for not doing due diligence. Similarly with food, i expect the government to disallow things that are seriously harmful to my health (think proven carcinogens).My personal data, if not handled correctly can cause as much damage as me consuming a specific food that has been contaminated with a banned substance.

You make a general point about government regulation, and the answer is that choices made by individual consumers can affect other people too. Should people be given the choice of using leaded gas?

Then we can discuss if the GDPR protects important rights or not , but that's a different discussion.

I want to have the podunk builder build my house however I want. What is with all those pesky building codes!

Because they (the government) think it is the minimum required for a dignified, safe society. And they are placed in a position of power and must make those judgment calls, because that is their job.

Why would people want that? Because they understand, in general, that government is important and don't want an unhinged libertarian abandonment of mutual assistance in society. And in specific, because many of them value privacy enough to put up with this type of restriction. But of course there will always be people who find this or that law too intrusive, and in the EU that means they are free to organize, protest, be activists, vote, run for office, etc.

> Because they (the government) think it is the minimum required for a dignified, safe society. And they are placed in a position of power and must make those judgment calls, because that is their job.

Ha, this is a naïve view of it. In the US, this is only kinda-sorta true. Building permits can often be a lucrative source of income for the city and sleazy inspectors who often come out without the faintest idea of what they are looking at.

It often turns into holding previously-recognized rights captive and selling them back for cash. People get angry real quick.

(My father owns a small business in fireplaces. The inspectors often are idiots, and the city charges hundreds of dollars, sometimes more. Total grift we have to suck up. So much so they sometimes ask us what to look for. I doubt the inspectors have stopped any residential fires, ever, in some of these cities.)

Has your father taken this to his city councillor? If nobody reports the problem the city will think things are fine and nothing will change.

Regardless I’m quite happy with my safe home. I know that it’s not going to kill me. In some regulations have we gone too far? Yes. Have we gone too far protecting our data? We barely have anything in place, so I applaud the EU on forging ahead.

I know several people who help write building codes in the US in various fields, and none of them are incompetent or write code other than to deal with known concerns based on past building performance and materials testing, etc. That there might be a problem with enforcement is more a byproduct of municipal professionalism in general than a problem with building codes. I have never seen hundreds of dollars in my (high cost of living) area for a fireplace inspection, but I guess it might exist as an outlier somewhere. Permits cost more, but that is because we have very low property taxes in California, and they recoup through the permits because they need funding from somewhere.

But the building code reference was just to provide an introductory analogy. The sentence you quoted was part of my direct answer to OP's question, which was why the GDPR, and why would people want it.

The reasoning is that your personal data doesn't belong to you. It belongs to your government. A user's personal data is a vector for attack for a foreign agent. You can argue up to which degree this is correct or not, but the EU instance on this matter is of paranoia.

What utter drivel.

The EU stance is this: "a person's data belongs to the person, and you can't obtain, collect, sell, or transfer this data in any way, shape, or form without an explicit consent from the person".

The US on the other hand: all your data belongs to the US government regardless of where you are on the globe: https://en.wikipedia.org/wiki/CLOUD_Act?wprov=sfti1 And this is on top of all the large scale data collection already performed by companies.