Complaint filed against Irish subsidiaries of Apple, Facebook • Hacker News Board

Re: Complaint filed against Irish subsidiaries of Apple, Facebook

#41

Post by DanBC » Wed, Jun 26, 2013, 8:24 PM UTC

furyg3 wrote: post #17

revscat wrote: post #12

Earlier quoted context omitted.

I am curious to see if the business case against the NSA's power will have an effect. Right now I think things favor the bureaucracy. But if Apple, Google, Facebook, etc. make a broad push against it, we could see legislative changes which protect them. A likely scenario is something which indemnifies them against any losses incurred as a result of foreign suits related to privacy breaches, so long as they're in acco…

It will become a problem when European countries / organisations start requiring that data cannot be stored or managed at a US datacenter or by a US organisation. You already see this happening with with datacenter locations...

> It will become a problem when European countries / organisations start requiring that data cannot be stored or managed at a US datacenter

There are already restrictions on exporting personal data outside the EU. This is under the various data protection laws.

(https://en.wikipedia.org/wiki/Data_Protection_Directive)

(https://en.wikipedia.org/wiki/Data_Protection_Directive#Tran...)

I guess the exceptions will be tightened up now, especially if EU consumers press for it.

Re: Complaint filed against Irish subsidiaries of Apple, Facebook

#42

Post by Aissen » Wed, Jun 26, 2013, 9:17 PM UTC

if_by_whisky wrote: post #37

This brings up an interesting issue with multinationals... How do you react when you receive compulsory orders in one country of operation that violates laws of another?

There's a solution to that. Do not store data from a customer from one country, in another region. Actually, the biggest european hosting company, OVH, is doing just that in order to launch in North America, and protect its European, Canadian, and USA customers: http://translate.google.com/translate?sl=auto&tl=en&js=n&pre...

Re: Complaint filed against Irish subsidiaries of Apple, Facebook

#43

Post by jacalata » Wed, Jun 26, 2013, 9:51 PM UTC

pash wrote: post #33

rmc wrote: post #19

Earlier quoted context omitted.

A likely scenario is something which indemnifies them against any losses incurred as a result of foreign suits related to privacy breaches, so long as they're in accordance with US law. But that would only work in USA. What if a court in Germany fines Google Germany Ltd €1,000,000, and €100,000 per day until they stop sharing data with the US Gov? Will the US government give Google €1,000,000 to pay off the fine? Wha…

Barring unusual claims of extraterritorial jurisdiction by either the United States or the European Union (or any of its member states), Google and other American tech companies may be able to comply with both US and EU law by handling data on EU users only within the EU, through EU subsidiaries. Under that arrangement, the EU subsidiaries of US tech companies would not ordinarily be subject to US laws requiring them…

This doesn't seem easy for facebook, at least. I live in the USA and regularly read my European friends facebook pages, and they comment on mine. European facebook users can travel to the USA and access their facebook page while here. How could you implement this kind of separation?

Re: Complaint filed against Irish subsidiaries of Apple, Facebook

#44

Post by yajoe » Wed, Jun 26, 2013, 11:09 PM UTC

pash wrote: post #27

revscat wrote: post #12

Earlier quoted context omitted.

I am curious to see if the business case against the NSA's power will have an effect. Right now I think things favor the bureaucracy. But if Apple, Google, Facebook, etc. make a broad push against it, we could see legislative changes which protect them. A likely scenario is something which indemnifies them against any losses incurred as a result of foreign suits related to privacy breaches, so long as they're in acco…

There is some precedent for how things might unfold in the kerfuffles that have resulted from the U.S. government's attempts to enforce its trade sanctions against countries like Cuba, Iran, and North Korea. Under the Helms-Burton Act [0], the United States expanded its embargo on trade with Cuba to authorize sanctions against foreign firms that trade with Cuba. Mexico and the European Union responded [1] by forbiddi…

companies like Google make an effort to store foreign users' data in foreign data-centers owned and operated by foreign subsidiaries.

Can confirm that while working on the EU rollout for Office 365 a few years ago, this was certainly the case. EU customer data had to stay in Ireland, and there were even rules/debates about how much of the 'metadata' (i.e. to answer "does this user exist?") that could come back to the US.

At the time the reasoning was for EU Privacy Directive and not explicitly based on US law or precedents, but I bet a few realized the alignment and ensured the engineers stayed on this path.

Re: Complaint filed against Irish subsidiaries of Apple, Facebook

#45

Post by rmc » Thu, Jun 27, 2013, 11:23 AM UTC

doctorwho wrote: post #30

It's going to come down to what kind of business the Irish company carries out on behalf of the parent company or whether the Irish company is the parent. There are so many ways the relationship could be set up and figuring it all out could take a loooong time. First they have to work that out before they can determine whether they are responsible for following EU law and what laws they are obliged to follow. The Iri…

Well anyone who signs up to Facebook who's not in USA or Canada is technically signing an agreement with Facebook Ireland Ltd. So, the Irish company is responsible for the data of hundreds of millions of Facebook users.

(cf. section 19 of https://www.facebook.com/legal/terms )

Re: Complaint filed against Irish subsidiaries of Apple, Facebook

#46

Post by mrmekon » Sun, Jul 07, 2013, 6:18 AM UTC

claudius wrote: post #40

mrmekon wrote: post #31

Earlier quoted context omitted.

I don't know about the EU, but in the U.S. your statement is simply not true. Somebody absolutely can follow you around taking photos or videos, as long as you are in a public space and they can come up with any non-malicious excuse (i.e. it's an art project!). Stalking laws vary state-to-state, but you generally have to prove it is specifically "for the purpose of harassing and intimidating". See also: paparazzi See…

> I don't know about the EU, but in the U.S. your statement is simply not true. Ah, I forgot that we are taking US data protection laws into account when an Austrian group files a complaint against an Irish subsidiary. E.g. in Germany it is forbidden to take photos in public where people who did not agree to it are the main subject – you can still photograph buildings, scenes etc., just not individual people.

Very late response: this comment thread was a general discussion about privacy, it wasn't specifically about the article.

And a maaku on HN could easily be this maaku on github from California: https://github.com/maaku

And the 'online robots' and 'direction of the government' almost certainly refer to the recent NSA case, which is an American issue.

So, yes, the US data protection laws do seem relevant to the conversation.