Hacker News Reader

Comment by sroussey | Hacker News Reader

Many jurisdictions, including EU, China, and others, require data on their citizens to be hosted locally.

But that only applies to companies that the EU has any kind of control over.

If you're in a hypothetical country that the EU has no relevant treaties with, the EU has no power over you. They might claim that EU laws are extraterritorial and affect everybody who dares to appear on the internet without blocking EU citizens, but that claim can't be enforced in such a country.

At what scale do I need to worry about this? If I make an app and don’t want to comply but I live in the US, do I open myself up to extradition if I have users in the EU?

You don’t worry. The best the EU can do is try (and likely fail) to block access to your application

For an app, get you kicked off the App Store.

They will block you through DNS. For 99% of the users base, it’s generally enough.

The EU doesn't even have a continent-wide DNS-blocking system.

Most countries have their own, but they're mostly for copyright infringement, not GDPR violations.

Even that isn't universal, Poland's system only affects unregistered gambling websites for example, and I've seen quite a few ISPs that don't even bother enforcing it, even though they're legally supposed to do so.

There's nothing (except talking to your government) that the EU could realistically do at this time to block a website, and I genuinely don't know how receptive the US would be to these arguments.

The largest "hook" the EU has is that most companies that provide services to you, whether that'd be payment processors, hosting services or ad networks, (still) want to maintain good relations with them and don't want to burn bridges, and I don't believe it's beneath the European commission to put pressure on those to make your life difficult.

In the EU? These are all civil matters, so the worst they can do is fine you and then try to get a US court to enforce it.

If you app is in the App store or Google Play store, you'll have to care about the EU the moment you open your app to EU users. Not complying will either get you removed from the EU store or get your whole account banned, US included, depending on how bad the store owner feels about you.

If you take direct payments, you'll probably have a talk to your card acquirer on how they feel about EU clients and how you deal with them. They might decide to not do any business with you depending on that.

In these above examples, I think having wider scale actually helps negotiating better terms instead of getting kicked out at the first occasion.

Sure the EU can; the EU can block any payments leaving the EU going toward a legally non-compliant entity (company, country, etc) if they wish.

Technically cryptocurrency could get around this.

As if any of the targeted users know how to use it.

Then it would be up to those countries to block traffic to said social media companies. This is what china already does.

Not just block traffic, but also any payments.

And that’s the way it *should* be.

When Steven Harper unilaterally attempted to empower private data to be offshored, it would have been an absolute nightmare.

North American security is bad enough as it is. Imagine handing all your health, credit card, government information over to a Nigerian prince just for free.

what would happen if a US company, with US servers, ignored those requirements?

It would blocked in the EU.

Also the company could be asked to forbid EU customer to access the product. Wouldn’t be a big threat but it would prevent the company to do any futur business in Europe.

Tech savvy customer could still access the product but that is not a market as big as every EU potential customer.

I propose "Net Curtain" as the name for EU's version of the Great Firewall.

Copper Curtain

Either Silicon or Optical Fiber Curtain.

A reference to "The Iron Curtain"?

Indeed. Like the Iron Curtain, but more porous and networky.

You truly believe the US wouldn't do the same?

BTW what's your take on US requiring US-based companies to provide data on foreign citizens if subpoenaed?

The US does it through a private business (Cloudflare), so it's constitutional.

I'm desperately trying to figure out this response, and I can't.

Meanwhile: https://news.ycombinator.com/item?id=41280221

The debate is what EU would do if foreign companies don't obey EU's laws.

The debate is not whether the US will do something draconian the EU is doing today.

What draconian laws does EU apply to foreign companies? Try to come up with examples of companies that don't have offices and legal and commercial presence in the EU.

BTW remind me what's your take on the US banning Huawei in the US?

Since when do they bother with subpoenas ? Or are you referring to the secret courts rubberstamping wiretapping after the fact ?

I used subpoena as an umbrella term, there are multiple ways to get that data.

E.g. here's Facebook's report: https://transparency.meta.com/reports/government-data-reques...

In July-January 2023 they received FISA requests targeting over 150 thousand foreign nationals

Or it could cause the actual citizens of the EU to put a stop to the stupidity.

Which one ?

Ah yes. Because who can forget the genius of USA's "American companies must provide any and all information on foreign citizens even if they never stepped foot on foreign soil if the US government so wishes it".

I will believe this when I hear about websites being blocked over missing cookie banners.

You need to lodge a complaint. It’s time consuming so almost nobody do it.

And generally, it came with a slap of the wrist, and the company put up the banner.

For a site to be blocked, it need repeatable, multiple and not correctibles infractions.

Has it ever happened, even once? Can you cite something? I'm genuinely curious. Also genuinely skeptical.

There has never been a case where it was escalated so far.

This. Each country have an administrative entity (in France, that’s CNIL, Commission National sur l’Informatique et les Libertés - National Commission on computer and liberties, roughly) in charge of this kind oh things. You can lodge a complaint to them and they will investigate and eventually, if needed (don’t think it was ever needed, they can bring the problem to a judge.

I have a very difficult time imaging that companies in China (or even the US) will even read a message in French, much less respond to it.

The EU does not require data to be hosted locally, though.

As far as I know, they do. That’s part of their consumer data protection act (didn’t remember the exact name).

Do you have any source for that ? it would n’a quite helpful, honestly.

The EU GDPR has requirements for processing (including storage) of personal data (much larger scope than US PII, but still nowhere near all data) in jurisdictions with legal adequacy for data protection.

It’s not quite data sovereignty like India’s regulations around payment transaction data but it does theoretically limit where you can store EU personal data.

You can find the current GDPR adequacy list at the EU’s EDPB site. https://commission.europa.eu/law/law-topic/data-protection/i...

The law you're thinking about is GDPR. It does allow to host data outside of the EU if the rights of the data subjects are not weakened.

Source: GDPR articles 44, 45, and 46.

I'm not sure about Chinese law, or any other law, but GDPR for sure does not require that. The fact that the US is not an option doesn't mean you cannot store data in any other country, just that the safe harbour and then the privacy shield were considered inadequate. For example, storing personal data in the UK is just fine.

Reply on news.ycombinator.com