Zoom still don't understand GDPR • Hacker News Board

Re: Zoom still don't understand GDPR

#261

Post by arsenico » Mon, Aug 31, 2020, 12:43 PM UTC

irjustin wrote: post #116

dheera wrote: post #97

Earlier quoted context omitted.

I imagine GDPR doesn't apply to Zoom, as a non-EU company. Much like China bans what it doesn't want, the onus is on the EU to set up a GFW of their own and ban Zoom (and other GDPR-non-compliant foreign websites) if they disagree with it. Otherwise, Zoom only needs to obey the laws of USA and wherever else they have offices. Disclaimer: IANAL Also: I'm not arguing for Zoom's sketchy practices but just saying that GD…

Any company that has an operating entity in an EU country must comply or risk being fined by regulators. If the target is big enough, EU regulators will ask for help from other countries. Zoom operates offices in a few EU countries[0] so they'll definitely have some sort of entity(ies) setup - regulation pressure can be applied. [0] https://zoom.us/contact

That is incorrect. GDPR applies to EU residents using the service, wherever that service is.

Re: Zoom still don't understand GDPR

#262

Post by irjustin » Tue, Sep 01, 2020, 3:05 AM UTC

arsenico wrote: post #261

irjustin wrote: post #116

Earlier quoted context omitted.

Any company that has an operating entity in an EU country must comply or risk being fined by regulators. If the target is big enough, EU regulators will ask for help from other countries. Zoom operates offices in a few EU countries[0] so they'll definitely have some sort of entity(ies) setup - regulation pressure can be applied. [0] https://zoom.us/contact

That is incorrect. GDPR applies to EU residents using the service, wherever that service is.

That is a jurisdictional grey area. It is technically true, but practically speaking, it's why I specifically said "EU regulators will ask for help from other countries".

GDPR is only strictly enforceable in EU countries. All the other countries, it's up to whether they want to cooperate.

Example - EU cannot force China to make Tiktok/Bytedance to follow GDPR practices in China for EU citizens. They really they can only wave a big finger and claim Bytedance is out of compliance.

Sure, EU can sue Bytedance cross border in China, but it carries no weight/teeth. At which point, EU has to escalate... trade relations? sanctions? war?!

So practically - they have to ask for help.

Re: Zoom still don't understand GDPR

#263

Post by kelnos » Thu, Sep 03, 2020, 12:05 PM UTC

bllguo wrote: post #139

kelnos wrote: post #84

Earlier quoted context omitted.

> Yeah this was so sad, but I'm happy the guys that made it got paid. I don't really sympathize with this. You build something, get a ton of people to use it, advocate for it, get their friends to use it... I think after that, you have a responsibility to those users, and selling to a company like Zoom and then peaceing out on further work does not fulfill that responsibility.

I couldn't disagree more. Most users didn't even pay, for goodness' sake.

If you decide to base your business model on unpaid users, that doesn't absolve you of responsibility for them. You're still getting something from them, whether it's user numbers that impress prospective investors, or usage data that you can sell to third parties, or whatever.

If you're building a security- and privacy-focused product, selling it to a company that has demonstrated several times that they don't care about their users' security or privacy is unethical, regardless of how you slice it. It makes the world poorer, and the internet less safe for the people who use it. This has nothing to do with payment.

Re: Zoom still don't understand GDPR

#264

Post by kelnos » Thu, Sep 03, 2020, 12:07 PM UTC

bllguo wrote: post #253

orestarod wrote: post #219

Earlier quoted context omitted.

Was there a choice to pay??

ok that's my bad - i thought they had an paid enterprise plan. So actually _nobody_ paid. That makes me believe even more strongly that the founders do not owe users anything.

It's a shame you feel that way; personally I feel that avoiding responsibility for your actions toward others is one of the big ills in our society. Suggesting that there's only responsibility if money changes hands merely makes me sadder.

Re: Zoom still don't understand GDPR

#265

Post by kelnos » Thu, Sep 03, 2020, 12:10 PM UTC

jessaustin wrote: post #151

kelnos wrote: post #83

Earlier quoted context omitted.

I doubt that has anything to do with it. Zoom almost certainly handles composing the image for gallery view server-side; you're not maintaining a separate connection for each participant.

It's possible that the server just forwards a selection of packets from each participant (hopefully dropping some from those who aren't speaking or moving) and the client stitches them into the view.

Sure, that would be the SFU doing it's job, but my point is that you aren't maintaining a connection per participant, but one connection with Zoom itself where you get all the video data. It's true that could be in the form of a single video stream of the entire gallery, or separate streams of only the participants visible to you.

Re: Zoom still don't understand GDPR

#266

Post by robomc » Thu, Sep 03, 2020, 9:02 PM UTC

panpanna wrote: post #149

robomc wrote: post #59

Earlier quoted context omitted.

love this extension. we recommend it for everyone at work as the zoom client is banned.

What do you then do about the horrible performance of zoom in chrome? For me, the sound becomes unintelligible as soon as someone shares his screen.

Haven't had this problem. And in general, we try to get people to use whereby (also the web version), which we've been very happy with.

Re: Zoom still don't understand GDPR

#267

Post by robomc » Thu, Sep 03, 2020, 9:03 PM UTC

garmaine wrote: post #256

jamaicahest wrote: post #255

Earlier quoted context omitted.

You recommend using the extension to circumvent your employer banning your use of Zoom, while at work?

He said they banned the zoom client, not the zoom service.

It's wild to me how many companies are happy for everyone to have that client installed, despite usually having otherwise completely onerous security policies in other areas.