Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

2018 reform of EU data protection rules

ec.europa.eu

Post reply on HN
Print view View original

61–70 of 150 posts

Re: 2018 reform of EU data protection rules

#61

Post by freeone3000 »

tscs37 wrote: post #48
meinstream wrote: post #43

Earlier quoted context omitted.

+1 for fair user treatment, but the way the laws are written, companies that serve users globally from within the EU will have a hard time competing with their international competitors under the new regulation. I just wonder if European law makers have thought this through.

I think in the current situation, having strong privacy for all users will be a feature you can bring to the market, especially for US users it can be a big plus since the US doesn't have any comparable privacy law.

How do you communicate this? Most people don't care.

Re: 2018 reform of EU data protection rules

#63

Post by rorykoehler »

tobltobs wrote: post #22
Dayshine wrote: post #14

Enforcement factsheet: https://ec.europa.eu/commission/sites/beta-political/files/d... Pretty clearly primarily enforced by national regulatory agencies, who are the only ones who can apply fines . It mentions citizens taking companies to court, but https://ec.europa.eu/commission/sites/beta-political/files/d... says that's for monetary damages, not for fines. This is unchanged from previous laws. Can people stop fre…

In Germany offenses against the GDPR can cause a "Abmahnung" which do not result in a fine but a charge. There a legions of filthy lawyers waiting for the 25.5.

Sounds like the piracy law. I was getting letters for downloading movies and shows I had never even heard of let alone seen. Chancers were casting a wide net hoping people would panic and pay.

Re: 2018 reform of EU data protection rules

#64

Post by dnomad »

donohoe wrote: post #36
Cthulhu_ wrote: post #15

Earlier quoted context omitted.

You're not wrong, but, what internet company doesn't operate within the EU? If you operate in the EU, and handle EU citizen's data, you have to conform to the GDPR. I don't think there's many internet companies that would not serve the EU because of it. Although, Google did pull out of China due to the censorship demands and the like.

Hmm. You just agreed with me and then disagreed me :) Again, I say this as someone who is implementing GDPR for a US-based company, and is also a EU citizen (Irish) and has sat more meetings with various legal groups than I care to remember (again, stress I'm not a lawyer). It is all about a companies appetite for risk and how tied the are __PHYSICALLY__ to the EU (offices/employees/parent-companies/subsidiaries). Th…

The GDPR goes beyond physical presence. It's strange that your legal team would not know this. See my previous comment [1]. My own understanding based on conversations with lawyers (who spoke to regulators in France) is that the law is designed to target any business that targets EU citizens. The territorial scope is formally global but obviously this is very much narrowed to businesses who (1) are pursuing EU customers and (2) are carrying out surveillance of EU customers. Surveillance does not include legitimate business needs btw, but it does include a lot of things that web sites do today without even realizing that it is surveillance (the classic example here is targeted advertising where ads are selected based on personal data).

BTW it's important to understand the real enforcement vector here. It's not like you'll have "EU cops" knocking on doors in America. Nor will anybody waiting for you to get off the plane in Germany. (I've actually seen this nonsense on HN in recent days.) The very real power they do have is over banks and payment processors. It's quite possible that if you're doing business with EU customers and you have bank accounts in EU or work with EU banks or EU payment processors then they'll be able to exert significant leverage against your business. But if you have no direct contact with the EU financial system and your website is hosted in the US in English (or even if it's in French but it's clear you're pursuing US customers) there's little they could do to you even if they wanted to.

[1] https://news.ycombinator.com/item?id=16956123

Re: 2018 reform of EU data protection rules

#65

Post by frockington »

jimktrains2 wrote: post #28
meinstream wrote: post #12

This guide does not clarify one important question: Does a company in the EU have to apply gdpr guidelines for none European users. If so, this would be a significant disadvantage for all European companies since their none European competitors obviously only have to comply for European users. One scenario in which this would be very relevant: A website needs to show a very long consent form to users that want to use…

> This guide does not clarify one important question: Does a company in the EU have to apply gdpr guidelines for none European users. Yes, the GDRP applies to anyone "in the Union". Someone on vacation from the US would be covered _while they are in the EU_. If your company is based in the EU, then you must comply for all users, regardless of their current country or citizenship.

So the obvious solution is to base all companies in the US or Asia? I am hesitant to believe the EU is that short sighted

Re: 2018 reform of EU data protection rules

#66

Post by frockington »

donohoe wrote: post #46

First, I am not a lawyer. I don't even play one on TV. The big question I keep hearing is; I'm in the US (or other non-EU country), does GDPR apply to my company or organization? The shortest possible answer is: Maybe :) The answer is: YES if your company has a physical or legal presence (like an office, employee, parent-company, subsidiary, etc.) in an EU country. The GDPR applies to you and you need to to start rea…

This is the same EU that turned a blind eye to VW and other companies blatantly lying to regulators. In terms of EU regulation NO is normally a safe bet as long as you are big enough. You think Germany is going to fine an automaker or Lux is going to fine a bank?

Re: 2018 reform of EU data protection rules

#67

Post by Sylos »

meinstream wrote: post #12

This guide does not clarify one important question: Does a company in the EU have to apply gdpr guidelines for none European users. If so, this would be a significant disadvantage for all European companies since their none European competitors obviously only have to comply for European users. One scenario in which this would be very relevant: A website needs to show a very long consent form to users that want to use…

This is probably going to happen, yeah. It will however likely also establish European companies as particularly secure and trustworthy.

For a long time already, it's been common practice to avoid Chinese services, because of the surveillance that the Chinese government does. And there's a growing number of people who avoid US-based services, too. The recent CLOUD Act certainly doesn't weakening their position either.

Re: 2018 reform of EU data protection rules

#68

Post by someguy2018 »

viraptor wrote: post #45
donohoe wrote: post #38

Earlier quoted context omitted.

Maybe if you don't have ads on your site, otherwise its going to be a problem.

Why do you think so? After you document/publish what information you pass to which network, what problems do you expect related to the ads?

Because I apparently need affirmative check-the-box consent before I can actually use those ad networks.

I'm not doing anything shady: all the information I collect and why I collect it has always been in my privacy policy. But making people have to opt-in to see ads on the site is a big problem.

Re: 2018 reform of EU data protection rules

#69

Post by teamhappy »

mattmanser wrote: post #56
donohoe wrote: post #46

First, I am not a lawyer. I don't even play one on TV. The big question I keep hearing is; I'm in the US (or other non-EU country), does GDPR apply to my company or organization? The shortest possible answer is: Maybe :) The answer is: YES if your company has a physical or legal presence (like an office, employee, parent-company, subsidiary, etc.) in an EU country. The GDPR applies to you and you need to to start rea…

They explicitly contradict you. https://ec.europa.eu/info/law/law-topic/data-protection/refo... The law applies to... 2. a company established outside the EU offering goods/services (paid or for free) or monitoring the behaviour of individuals in the EU. Do you have any evidence? You're doing business with EU citizens. You allow them to connect to your site. Wouldn't this operate similarly to how extradition by the U…

I'm not sure what you're implying here but allowing somebody to connect to your site obviously doesn't qualify as providing goods/services. The actual legal text makes that pretty clear.

"Whereas the mere accessibility of the controller's, processor's or an intermediary's website in the Union, of an email address or of other contact details, [...], is insufficient to ascertain such intention, [...]" (https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...)

Re: 2018 reform of EU data protection rules

#70

Post by bluGill »

donohoe wrote: post #46

First, I am not a lawyer. I don't even play one on TV. The big question I keep hearing is; I'm in the US (or other non-EU country), does GDPR apply to my company or organization? The shortest possible answer is: Maybe :) The answer is: YES if your company has a physical or legal presence (like an office, employee, parent-company, subsidiary, etc.) in an EU country. The GDPR applies to you and you need to to start rea…

Remember physical presence in the EU can come from something as small as your airplane to Africa having to make an emergency landing in a EU country for some reason. That is you have to not travel at all in the direction of the EU.
Post reply on HN