Live data from Hacker News

Stross: Klout violates UK privacy laws.

antipope.org

11–20 of 62 posts

Re: Stross: Klout violates UK privacy laws.

#11

I strongly wonder how many US firms understand EU data laws... Isn't there a campaign against a small company called Facebook and their disregard for our laws?

And yet we complain loudly when a service isn't available outside the US.

Yes, but the UK laws aren't hard to implement - they are quite reasonable. Firms should obide by them - it's good practice anyway.

Re: Stross: Klout violates UK privacy laws.

#12
post #7

But is Klout incorporated or hosted in the UK or EU? If not, how exactly do they violate UK law? I mean, pornography is illegal in many countries, but that doesn't mean a US pornographic website is illegal, even if it's available to citizens of that country.

And what about those online poker companies that are not based in the USA? Why should they comply with USA law? If Klout are collecting and storing data on UK individuals, they are subject to UK data protecction law. The ease of enforcing that if they don't have a UK operation is another matter, but they are still interacting with UK users in a way which triggers UK rights under UK laws, with which UK courts could re…

And what about those online poker companies that are not based in the USA? Why should they comply with USA law?

I don't know. When were they forced to?

Re: Stross: Klout violates UK privacy laws.

#13

Earlier quoted context omitted.

But (I'm pretty sure) it would be illegal for someone from a no-pornography country to view a US porn site. So my understanding is what klout does is 'fine' for US users, but gathering data on UK/EU users is subject to EU data protection laws. And of course, IANAL

But (I'm pretty sure) it would be illegal for someone from a no-pornography country to view that site. Using that analogy, then it would be Stross the one committing the offense, not Klout? So my understanding is what klout does is 'fine' for US users, but gathering data on UK/EU users is subject to EU data protection laws. That would be the same as it being illegal for a US site to distribute pornography to a person…

Both good points, well played :)

All I can say is as a UK resident I feel like UK data protection laws should protect me from a company like this no matter where they are based.

Re: Stross: Klout violates UK privacy laws.

#14

Earlier quoted context omitted.

But (I'm pretty sure) it would be illegal for someone from a no-pornography country to view a US porn site. So my understanding is what klout does is 'fine' for US users, but gathering data on UK/EU users is subject to EU data protection laws. And of course, IANAL

But (I'm pretty sure) it would be illegal for someone from a no-pornography country to view that site. Using that analogy, then it would be Stross the one committing the offense, not Klout? So my understanding is what klout does is 'fine' for US users, but gathering data on UK/EU users is subject to EU data protection laws. That would be the same as it being illegal for a US site to distribute pornography to a person…

The fact is, unless Klout is hosted or incorporated in the UK or EU, the latter have no jurisdiction over the company, and such their laws don't apply.

Try telling that to the US government, which hounds internet gambling sites wherever they're based.

The issue of territorial jurisdiction and law on the internet is a really complex one, and much more so when you deal with a fundamental mis-match between legal systems (the EU constitutional-level right to privacy vs. the US lack of same).

Re: Stross: Klout violates UK privacy laws.

#15
post #9

I strongly wonder how many US firms understand EU data laws... Isn't there a campaign against a small company called Facebook and their disregard for our laws?

Yes http://europe-v-facebook.org/ . It's possible because Facebook has a EU company, and hence is bound by EU law.

I'm not sure you even need an EU company, just to be doing business in the EU.

An opposite example is Rovio in Finland are being sued under US patent law by some bunch of patent trolls or other (and it's the Finnish Rovio office rather than any US subsidy named in the suit).

Re: Stross: Klout violates UK privacy laws.

#16
post #7

Earlier quoted context omitted.

And what about those online poker companies that are not based in the USA? Why should they comply with USA law? If Klout are collecting and storing data on UK individuals, they are subject to UK data protecction law. The ease of enforcing that if they don't have a UK operation is another matter, but they are still interacting with UK users in a way which triggers UK rights under UK laws, with which UK courts could re…

And what about those online poker companies that are not based in the USA? Why should they comply with USA law? I don't know. When were they forced to?

About when the US started arresting executives passing through US airports.

Re: Stross: Klout violates UK privacy laws.

#17

But is Klout incorporated or hosted in the UK or EU? If not, how exactly do they violate UK law? I mean, pornography is illegal in many countries, but that doesn't mean a US pornographic website is illegal, even if it's available to citizens of that country.

You've hit the nail on the head. A company is only subject to UK law if it operates from the UK. Facebook's European office is in Dublin, which is why it is subject to Irish/EU privacy legislation.When Twitter establishes its European office, it will similarly become subject to the same laws.

As far as I know, Klout has no UK/EU presence so it's not subject to these laws.

Re: Stross: Klout violates UK privacy laws.

#18
I haven't looked too hard at too many privacy policies, but this seems fairly boilerplate to me. I'd suppose if you compare this to [say] Twitter's privacy policy, it would end up reading pretty much the same.

They also say (in "Profile Settings"):

> Klout only analyzes public data or data that we are given explicit access to. We never share your private information with any third party or brand and you can control the information that we make available on your Klout profile page.

The full sentence from Klout's privacy policy (which cstross 'edited' out to make his point) reads:

> Service Providers. We engage certain trusted third parties to perform functions and provide services to us, including, without limitation, hosting and maintenance, customer relationship, database storage and management, and direct marketing campaigns.

I believe this lets them off the hook for storing/using your PII with service providers like AWS, Rackspace, Salesforce and Mailchimp/CampaignMonitor.

Disclaimer: not affiliated with Klout in any way except as a user.

EDIT: Yeap, from Twitter's privacy policy:

> Twitter may use both session cookies and persistent cookies to better understand how you interact with our Services, to monitor aggregate usage by our users and web traffic routing on our Services, and to improve our Services.

> We engage certain trusted third parties to perform functions and provide services to us. We may share your personal information with these third parties, but only to the extent necessary to perform these functions and provide such services, and only pursuant to obligations mirroring the protections of this privacy policy.

Re: Stross: Klout violates UK privacy laws.

#20
post #14

Earlier quoted context omitted.

But (I'm pretty sure) it would be illegal for someone from a no-pornography country to view that site. Using that analogy, then it would be Stross the one committing the offense, not Klout? So my understanding is what klout does is 'fine' for US users, but gathering data on UK/EU users is subject to EU data protection laws. That would be the same as it being illegal for a US site to distribute pornography to a person…

The fact is, unless Klout is hosted or incorporated in the UK or EU, the latter have no jurisdiction over the company, and such their laws don't apply. Try telling that to the US government, which hounds internet gambling sites wherever they're based. The issue of territorial jurisdiction and law on the internet is a really complex one, and much more so when you deal with a fundamental mis-match between legal systems…

Try telling that to the US government, which hounds internet gambling sites wherever they're based.

So, in effect, you're arguing that it's perfectly legitimate for the US government to do this?

Post reply on HN