Hacker News Reader

Comment by mike_d | Hacker News Reader

European laws simply do not apply in the United States. The same way that as an Australian citizen you don't have to abide by a ban on e-cigarettes in Singapore even if the law is written in a way that says it applies globally.

If Clearview AI has no nexus in the EU (offices, employees, customers, servers, etc) and refuses to do business in the EU they have no obligation to abide by EU laws, even if that law covers processing data internationally.

Ultimately they would need to ask the US to charge or extradite the Clearview executives under US law or an international treaty.

View on HN

> The same way that as an Australian citizen you don't have to abide by a ban on e-cigarettes in Singapore even if the law is written in a way that says it applies globally.

What? If you're an Australian citizen you are bound by many Australian laws under the concept of Extraterritorial Jurisdiction. This is mostly used to charge for offenses around CSA, human trafficking, etc. but also applies to drug use. While it's very unlikely you'd be charged for violating laws around e-cigarettes, that doesn't mean the law doesn't apply.

> but also applies to drug use

Australia criminalizes users of drugs while overseas? Or just bans/restricts entry from non-citizens that admit to such use?

That's only true for CSA stuff, which was a new approach. Mostly, if you leave Australia you are no longer bound by Australian law, citizen or not, especially true for things like drug use overseas.

Yup. You'd be charged with the relevant Australian law by Australian authorities. I call this out in the last sentence.

Article 50 of the GDPR actually acknowledges they have no enforcement authority unless they can mutual agreements with foreign states.

But his point is there is no relevant law in Australia, so it’s unenforceable. This is how extradition works in international law.

A common example I can give you is a lot of countries believe the death penalty is inhumane and it’s against basic human rights. So countries, even ones that have extradition treaties, will refuse to extradite to the US, no matter the evidence or conviction if there’s even a possibility of the death penalty. This has happened a number of times.

The EU is free to fine Clearview though, and surprisingly developed countries do tend to recognize judgements from other developed countries. It's a few extra steps to get the fine registered in the US court system, but it will eventually happen. If you're imagining that Clearview is somehow exempt from EU fines just because they don't have assets or employees there- no. Judgements have been ported internationally for decades now

Yes, the EU can assess a fine, but they will need to find some grounding in the US legal system for a court to accept it.

If a foreign country could simply register and collect judgements against Americans unrestricted, someone would have found a small island country by now to file daily million dollar judgements against Bill Gates and Jeff Bezos.

So it's legal for me to hack into European datacenters, as long as I live and work elsewhere? I'm pretty sure interpol would still track me down and try to extradite, and I'm pretty sure extradition would succeed unless I'm in Russia or the Caymans or something.

> I'm pretty sure interpol would still track me down and try to extradite

Correct. I mentioned that in the last sentence.

> So it's legal for me to hack into European datacenters

This is where it gets murky. Clarview AI is scraping data uploaded to US based websites, and agreeing to terms that allow for the data to be redistributed. In your example there is a direct nexus to the EU.

It's illegal to hack into European datacenters because hacking is illegal in the US.

Like if you mailed a pipe bomb to the EU and blew someone up, it's illegal under US law to murder people, it has nothing to do with EU law.

ehhhhhhh, I don't think the "extra-territoriality" of US murder law applies overseas. Might get nailed for some mail/customs/explosives violation or conspiracy (if others were involved), but not the murder itself under US law.

I'm sure the US would be quick to extradite though.

Totally not a lawyer.

> Ultimately they would need to ask the US to charge or extradite the Clearview executives under US law or an international treaty.

You'll be extradited for hacking because it is illegal in both countries. That's called "double criminality".

Countries will refuse to extradite you for something which is legal in that country. After all, according to them you have done nothing wrong.

It's not always illegal in both countries. NSO Group openly offers hacking services to foreign governments, so presumably it's legal in Israel (as long as the targets aren't Israelis, of course!) Not that the CEO is getting extradited any time soon, but I know they're at least sanctioned now.

It is perfectly legal because of sovereign immunity. If NSO Group is operating on behalf of a country, it is espionage and the remedies are diplomatic. Should NSO ever choose to take on commercial customers they could be subject to criminal law.

From America? No, the CFAA prohibits this.

Their leadership might get detained like Huawei's CFO if they travel ro Europe. The EU might ask for bail equivalent to the violation fine.

I believe this was the principle up until the US pioneered laws which regulate foreign entities dealing with other foreign entities in their own country. FATCA opened the flood gates, GDPR followed the example and now we have a few more of similar regulations.

Reply on news.ycombinator.com