German court rules Facebook use of personal data illegal

In the section "Wasn’t the UK supposed to get an opt-out from EU human rights laws?"

The summary is, when the Treaty of Lisbon awarded the EU new human rights powers the UK and Poland negotiated an opt out which was written in the treaty. It was a part of convincing the UK government to accept the new treaty without granting a referendum on it, as they had previously promised.

The opt out is very clear, really as clear as lawyers can make such things. It says:

The charter does not extend the ability of the CJEU, or any court or tribunal of… the United Kingdom, to find that the laws, regulations or administrative provisions, practices or action of… the United Kingdom are inconsistent with the fundamental rights, freedoms and principles that it reaffirms

and

In particular, and for the avoidance of doubt, nothing in Title IV of the Charter creates justiciable rights applicable to Poland or the United Kingdom except in so far as Poland or the United Kingdom has provided for such rights in its national law

http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:C:2...

In other words, this part of the treaty does not allow the courts to overturn UK laws. Stated twice, for clarity.

A few years later the ECJ decided that the opt out was meaningless and voided it, under a new interpretation that they claimed meant they'd actually always had these powers, and therefore the treaty did not "extend" them, and so the opt out didn't "work" despite its apparently clear wording. They then began overturning UK laws.

It's unclear why the treaty had anything new in it at all if the courts had always had these powers of course, but this is how things go in the EU - no matter how plainly something seems to be written, no matter how clear the assurances seem to be at the time, the moment it becomes politically inconvenient to the project the rules are tossed out under bizarre and kafkaesque re-interpretations.

Same thing happened to Ireland with corporation tax. They were promised the EU wouldn't interfere with their tax policies. Then the EU decided low taxes were "state aid" and awarded itself the power to control Irish tax policy. Nobody had previously interpreted the state aid clauses that way.

> new VAT scheme

whereas this is from 2015. I was confused by language where you described it as a law to target Amazon. Now I see that was just an opinion.

> my solution was to stop selling into the EU

Interesting business decision. Was the cost of compliance that high, or was your revenue that trivial?

> though amusingly once the UK leaves the EU I'll be able to start again (by just ignoring the EU's VAT rules)

Well I was having a conversation with one of the UK's foremost VAT specialists on Friday, from one of the UK big 4 accountancy firms. He was very clear that the general opinion is that the UK will align with the EU for VAT. This was a response to my question about the catastrophic cashflow impact that losing the VAT rules on imports would have to UK businesses. He told me not to worry, as VAT alignment was simply a necessity.

the significant problem is now the fact that I have to register for VAT domestically if I want to to sell to people in other EU countries

before if my turnover was below ~£70,000 I paid no VAT at all due to the exemption (giving me a competitive edge vs. big companies with better economies of scale)

after the new regulations if I make any EU sales I have to either fill in VAT returns for EU member state I've sold to (not feasible, that would be hundreds of VAT returns/year in many languages), or register for domestic VAT which will handle that for me, but kills my business model

the EU Commission doesn't see this as a significant problem, likely as it is a beneficiary of VAT (the VAT being an EU mandated tax)

As someone who worked extensively on HIPAA covered data and systems, there are only three options here.

Option 1) Mandate no data protection. This is how you end up with hidden security dumpster fires like Equifax, when public companies are involved (cost of security vs profit).

Option 2) Strictly mandate how companies must behave to be compliant. Example: DoD (I believe?). Legal requirements always lag technical best practices.

Option 3) Generally mandate what compliance results in. Example: HIPAA. Results in lack of clarity and legal challenges.

Of these options, I'll take (3) every time.

If a startup isn't willing to make a best effort to comply (which is specifically worded into HIPAA and substantially reduces penalties), then I'd rather they not be able to touch my health data anyway...