Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook to move UK users to California terms, avoiding EU privacy rules

reuters.com

Post reply on HN
Print view View original

441–450 of 506 posts

Re: Facebook to move UK users to California terms, avoiding EU privacy rules

#441

Post by mjgs »

jlokier wrote: post #439
mjgs wrote: post #433

Earlier quoted context omitted.

I don’t know, seems to me that most of the sites I see them in are US sites that say they have to get consent because of GDPR. When you browse from outside the UK, the sites don’t have the consent forms.

Consent is not required for "essential" cookies, because they are essential. Things like keeping track of your logged in state or shopping cart. (Even if consent were required for that, it should be asked at the point where you login or add the first item). For advertising and behavioural tracking cookies, consent is required if it's tracking your personal data to the level of individually identifiable people, but fr…

Having some way to auto deny consent seems like a good idea.

But anything automatic can have serious downsides, what happens if you start denying ‘good’ sites without realising it. Should all things that require consent be blocked?

This World Wide Web of permissions sounds like it’s going to be a bit of a nightmare.

Re: Facebook to move UK users to California terms, avoiding EU privacy rules

#442

Post by fauigerzigerk »

mratsim wrote: post #428
notimetorelax wrote: post #100

Earlier quoted context omitted.

There are clear rules regulating that, but they may depend on the country.

The rules are anything but clear. Some countries require at least 6 months + 1 day to be considered a resident, others might have you have a resident even if you aren't there if "the country is the center of your family or economic interests".

The rules for the UK are set out pretty clearly in the statutory residence test [1]. It covers all such cases in more detail than you ever wanted to know :)

What causes difficulties though is that the rules in different countries, even if clearly defined, can contradict each other on the question of tax residency. So you may well be liable to pay taxes in two (or more) countries at the same time.

You may even have to pay taxes in both countries on the same income or gains, unless there is a double taxation agreement that allows you to offset some of those taxes against each other [2]

[1] https://www.gov.uk/hmrc-internal-manuals/residence-domicile-...

[2] https://www.gov.uk/government/collections/tax-treaties

Re: Facebook to move UK users to California terms, avoiding EU privacy rules

#443

Post by ben_w »

himinlomax wrote: post #432
mrtksn wrote: post #64

Earlier quoted context omitted.

Okay, what does it mean “residency”? In the UK there’s no address registry where you declare your address. EU citizen works in the UK for 2 years then goes to Turkey for a vacation but likes the place so much, decides to stay for longer when still remote working for the same London company.Also connects through VPN because the Turks love banning websites. Where this person residence is? Are the UK, USA, EU or Turkish…

> In the UK there’s no address registry where you declare your address Can you vote in Glasgow's local elections if you live in Manchester?

It would be more accurate to say there is no single register of addresses.

The electoral register knows I’ve left the U.K.; I had to tell HMRC separately because they don’t share info; likewise the Student Loans Company even though there is a close connection between income and repayments [0]; and when I tried to tell the DVLA, they told me they lacked the capacity to know about non-UK addresses.

[0] the repayment rules means that, for low- and mid-income people, it behaves more like a graduate tax on worldwide income than a loan — it’s a percentage of pay over a threshold, and only high earners can pay it off fully — and if you do a self-assessment tax return there is a box for student loan stuff.

Re: Facebook to move UK users to California terms, avoiding EU privacy rules

#444

Post by jnxx »

M2Ys4U wrote: post #295
avianlyric wrote: post #190

Earlier quoted context omitted.

For most law sure. But for GDPR the EU explicitly extended it's protection to all EU citizen regardless of residency, and non EU citizen with residency in the EU. Now there's the practical question of how the EU enforces that protection against companies that have no presence in the EU, but those that do, the EU has made it quite clear they'll take enforcement action.

Citizenship and residency (of data subjects) doesn't come in to the GDPR at all. If the data controller/processor is in the EU, the GDPR applies. If the data subject is physically located in the EU (even if not a citizen or resident) then the GDPR applies.

The legal text:

https://eur-lex.europa.eu/legal-content/EN/TXT/?qid=15288746...

Article 3.

Re: Facebook to move UK users to California terms, avoiding EU privacy rules

#445

Post by jnxx »

cm2187 wrote: post #423
kolinko wrote: post #391

Earlier quoted context omitted.

In case of GDPR (EU) and securities laws (US), citizenship matters, not location. For example, almost anywhere in the world if you want to open a bank account they will explicitly ask you now if you’re an american citizen.

I believe GDPR applies to EU residents. I believe the complication is that it also applies if they are travelling outside of the EU, but not if they become resident outside of the EU.

Not only residents (in the sense of having a permanent home in the EU):

https://eur-lex.europa.eu/legal-content/EN/TXT/?qid=15288746...

For example, it also applies to people which are traveling and are currently located in EU territory (provided that a service is intended to be used by EU residents).

Re: Facebook to move UK users to California terms, avoiding EU privacy rules

#446

Post by mrtksn »

himinlomax wrote: post #432
mrtksn wrote: post #64

Earlier quoted context omitted.

Okay, what does it mean “residency”? In the UK there’s no address registry where you declare your address. EU citizen works in the UK for 2 years then goes to Turkey for a vacation but likes the place so much, decides to stay for longer when still remote working for the same London company.Also connects through VPN because the Turks love banning websites. Where this person residence is? Are the UK, USA, EU or Turkish…

> In the UK there’s no address registry where you declare your address Can you vote in Glasgow's local elections if you live in Manchester?

To vote, you need to register to vote, I voted at London Mayor elections in 2016. You vote wherever you register to vote, I don't remember the details but I guess it was me declaring that I live there and I would like to vote.

In UK there's this concept called proof of address and it's usually bill or a document that is sent to your address, there's no central registry of residents.

Re: Facebook to move UK users to California terms, avoiding EU privacy rules

#447

Post by jnxx »

throwaway2245 wrote: post #201
tpxl wrote: post #170

Earlier quoted context omitted.

>If you were in Texas when that data was collected from you, and you returned to the EU, I doubt that GDPR would apply to that data. Afaik GDPR covers EU citizens traveling abroad, as well as non-EU citizens in the EU. Edit: It does not cover EU citizens traveling abroad, see thread below.

Afaik GDPR does not cover EU citizens (or residents) travelling outside the EU, but of course there is no harm for companies acting like it does.

But as far as I understand, it applies to UK citizens which are traveling in the EU, because they are located in the EU:

https://eur-lex.europa.eu/legal-content/EN/TXT/?qid=15288746...

Re: Facebook to move UK users to California terms, avoiding EU privacy rules

#448

Post by jnxx »

remus wrote: post #427
mnw21cam wrote: post #420

Earlier quoted context omitted.

I never agreed. Google just stopped asking after a while. I think I could refer Google to the data protection office, but the chances that they'll actually do anything about it are slim to zero.

Typically there's a clause along the lines of "You have 30/60/90 days to explicitly agree to the new terms. If you continue to use the service after this time you are implicitly agreeing to the new terms."

I would doubt whether such a clause would stand in court.

Also, agreement (which is only one of the principles which make data processing legal, but I think it is the only one which covers what Google does, using the data for advertising which is not related to the direct service) is voluntarily, that means one cannot be forced to agree by otherwise withholding the service.

Of course the latter point is not fully enforced for now but the EU is set to enforce it over time.

Re: Facebook to move UK users to California terms, avoiding EU privacy rules

#449

Post by jnxx »

mjgs wrote: post #430
verytrivial wrote: post #414

Earlier quoted context omitted.

I think they will go away over time. [RANT] They should never have been implemented that way IMHO -- a different API or IETF-ish agreed HTML meta tag that would inform the browser of the scope, entities etc. would have allowed the browser to offer overall policy choices to the user. Most would be "I don't care, do whatever you want to me" but those who do care could have been picky. That would also have allowed the b…

I’ve been wondering about whether it should be something implemented in the browser too. Instinctively I feel that better browser tools would be beneficial, but it’s an odd problem that we are trying to solve. I am not even sure we understand the root issue. Some companies want to use the web to try to change users behaviour, and many users want those companies to change their behaviour. That’s not a solvable problem…

> Some companies want to use the web to try to change users behaviour

And just by looking at Google, they are doing that in an increasingly aggressive way.

Re: Facebook to move UK users to California terms, avoiding EU privacy rules

#450

Post by jnxx »

jlokier wrote: post #439
mjgs wrote: post #433

Earlier quoted context omitted.

I don’t know, seems to me that most of the sites I see them in are US sites that say they have to get consent because of GDPR. When you browse from outside the UK, the sites don’t have the consent forms.

Consent is not required for "essential" cookies, because they are essential. Things like keeping track of your logged in state or shopping cart. (Even if consent were required for that, it should be asked at the point where you login or add the first item). For advertising and behavioural tracking cookies, consent is required if it's tracking your personal data to the level of individually identifiable people, but fr…

> For advertising and behavioural tracking cookies, consent is required if it's tracking your personal data to the level of individually identifiable people, but frankly they shouldn't be doing that.

And one is not obliged to agree for using the service.

Of course, US FAANG companies try to create a kind of backlash, also things like when Amazon tries to force users to use credit card payments when other payment methods like bank transfer in advance work fine. But on the other hand, there is a noticeable increase in web shops in the EU which, for example, do not require any account creation at all - put something into the shopping cart, go to check-out, enter your address, enter your SEPA direct debit number, done. It is much faster and serves me as a customer better.

And no GDPR consent form needed, as all the processing is only for what is needed to do the payment and the delivery.

Post reply on HN