Europe’s Top Digital-Privacy Watchdog Zeros in on U.S. Tech Giants | Hacker News Reader

Europe’s Top Digital-Privacy Watchdog Zeros in on U.S. Tech Giants

nytimes.com

88 pointsJerry240 comments

There is a fundamental philosophical difference in European and American approach to law that makes these problems pop up.

America is common law based which in a way revolves around contracts. Two people can agree on anything, even giving up rights. That is why contracts in the US are so long and complicated. If something isn't in the contract it isn't covered. It also means there is a lot more suing in the US.

In Europe common law dominates which typically gives everybody a minimum set of rights which can't be given away. They apply regardless of what a contract says. So a contract in Europe can often be made smaller because what isn't covered in the contract will often be covered in the law. A lot more is implicit.

American understanding of society is about removing government hinderances for your pursuit of happiness. Government is not believe to have a role in giving you anything.

European understanding of society is that governments are there to ensure your rights. That means government will be more actively going after people who try to exploit you, while in America the reaction will be more "well you voluntarily agreed to this, so nothing we can do".

That means American companies can much more easily impose all sorts of ludicrous agreements on you, and you have no other choice but to agree to them or not get the service at all. In Europe you will more often be able to say "I want this service but your demands on me breaks the law."

With respect, I understand some people want this to be true, but the description of the United States is almost entirely incorrect in practice:

> American understanding of society is about removing government hinderances for your pursuit of happiness. Government is not believe to have a role in giving you anything.

That may be the desire of a few people, but currently in the U.S. government provides trillions of dollars in services to its citizens, from roads to security to healthcare to income to universities to transportation to communication to much, much more.

> European understanding of society is that governments are there to ensure your rights

Check out the U.S.'s Declaration of Independence, where you will find perhaps the most famous words from one of the most famous political documents in history:

We hold these truths to be self-evident, that all men are created equal, that they are endowed by their Creator with certain unalienable Rights, that among these are Life, Liberty and the pursuit of Happiness.--That to secure these rights, Governments are instituted among Men

It's not just theory; in practice a very important role of governmnt in the U.S. is protecting rights. Many key rights for minorities and women are obtained through government. Property rights are protected by government. The U.S. Department of Justice even has a Civil Rights Division. [1] The whole contest for civil rights in the U.S. is centered around getting government to pass laws or rulings.

[1] http://www.justice.gov/crt

> Two people can agree on anything, even giving up rights.

That isn't accurate. For example, you cannot agree to be a slave or to give up your right to overtime, a safe work environment, etc.; even non-compete agreements often are difficult to enforce. The law trumps your contract.

More accurately, Two people can agree on anything; they can put whatever they want in the contract but it may not be enforceable.

I think you meant to say "In Europe civil law dominates".

For anyone outside of the U.S., by American, he means U.S. since the rest of America(the continent) isn't subject to this.

You assume people don't know that while simultaneously assuming they're a male, quite funny

Go on...

The problem comes down to: how do you follow local or national laws when your business crosses many (or all) national boundaries? While we all would like better privacy protection, it's very hard to define exactly what that means for all types of information especially if it is different in different countries.

This is already a problem for lots of other things, so it is not unique. I worked in a oil service company in Norway and we always had a lot of crap to deal with to make sure nothing when we sold our software to Iran, no American was in any way involved in that process. That is difficult when you all work in an office with people from lots of places, and you are used to sharing information and working together and suddenly you have to be conscious about the citizenship of some of your colleagues.

There are already a myriad of national difference you have to deal with, accounting rules, rules on corruption and bribes, which country has which patents etc. Privacy just seems like any other item on that list.

> a oil service company in Norway ... we sold our software to Iran

The company was helping Iran avoid sanctions?!

Imposing costs on their oil sector, including by banning trade with it, was a necessary part of preventing them from acquiring nuclear weapons. They only gave up the weapons program in return for relief from the sanctions.

Was Norway participating in those sanctions? I thought the oil sanctions were just by USA and EU.

A good question. Sanctions included other countries outside the US and EU, but I don't recall the specifics or what Norway's position was.

However, helping Iran build nuclear weapons is a very serious, very consequential thing to be doing whether or not your country is officially participating in sanctions.

Would it be ok for your company to help Mexican drug cartels, even if it was legal? This is far more serious. If Iran obtained nuclear weapons, Norway would suffer the consequences too.

Well, you have to obeye local law. Only because the internet makes it easy to provide services in other countries doesn't put you outside their law - the territorial principle applies.

Regarding the data protection specifics, well, maybe it makes sense to follow the standards of the most rigid country globally?

The wild west manner of US-companies and government are really annoying, the mindset is - if I get my hand on the data it's my property. That is wrong, the user trusts "you" with it's data and expects it's usage only in the beforehand given consent for the necessary purposes. It's like copyright, the company has certain usage rights but does not own it.

The principles are easy: data processing has to be purposeful, lawful, fair and user rights and will is to be respected.

> Regarding the data protection specifics, well, maybe it makes sense to follow the standards of the most rigid country globally?

Have you really considered the implications of that precedent? Blasphemy law in Saudi Arabia. Censorship law in China.

Never mind what happens when the laws in two different countries conflict, e.g. privacy vs. data retention.

"Brick and mortar" companies deal with this stuff. Why should the tech industry be exempt?

If there is profit to be had, the tech giants will figure it out. If there is no profit, then those countries with laws that are on the fringe will have to make do without, or change their laws to be more mainstream.

edit - I'm not implying that this is easy. Or, can't be made easier. Only that laws have varied by country for eons and merchants have always found a way to deal.

> "Brick and mortar" companies deal with this stuff. Why should the tech industry be exempt?

"Brick and mortar" companies decide where to lay their bricks. You put a website on the internet and it's on the whole internet. In practice you can't even restrict who can access it, as Netflix can attest.

Suppose I don't agree with the laws in X country, or they conflict with the law in the country I'm physically in. Is it really going to satisfy anybody if I put "may not access this service from X country" in the terms of service somewhere, implement some fig leaf of a system to prevent access from there that everyone and their mother can bypass in five seconds (or the bypass ends up built into web browsers), and then millions of people from that country access it anyway?

How does that help anybody vs. just letting the service operate under the laws of the country where it physically exists and letting the users decide if they want to patronize a service that operates under that jurisdiction's laws? (Unless the goal is to increase the adoption of Tor and other anti-censorship software?)

But this is already a problem, that hasn't been solved. Facebook e.g. follows essentially American moral standards when censoring. That really crashes with e.g. far more liberal views northern Europe. People post what are regular pictures and accepted social norms in say Scandinavia but which gets removed or accounts closed down or what not because of the far more pious American morality.

This is already part of a national debate going on whether we should allow America to define our moral codes and values.

If we throw in muslims world which are hundreds of millions of people, then this stuff is going to turn into a big mess. Since I don't live in the middle east, maybe it already is a mess.

There is a huge difference. On the internet, by default, you are international. Brick and mortar stores, by default, are only local.

We have a website that sells stuff. It is "not available" in Europe. We do not ship to Europe. We block email addresses with European domains and let them know we're not available. We attempt to block Europe ip addresses by geolocating and let them know we're not available in Europe. Yet people from Europe still slip in. We go through several steps to let them know we cannot handle their business, but they still get through.

Are we liable? Speaking generally, laws do not necessarily care about any mitigations we take. We could still be fined millions of dollars (more than our revenue) in certain countries despite doing our best to block them.

Sorry, but it's completely ridiculous.

The sticking point seems to still be spying. It's generally outside the control of big tech companies, and so the issue is really between governments, and companies are stuck in the middle. (Yes, I know some have colluded with spy agencies, but not always willingly.)

I assume they all collude with spy agencies. Qwest's CEO learned the hard way what happens when you don't break the law when they order you to. That's the nature of corruption. They write laws that you have to break to survive and as long as a government official likes you you get to keep breaking that law. When you don't obey orders they enforce the laws only on you to make it hard to compete or so that you lose your freedom. https://www.rt.com/usa/qwest-ceo-nsa-jail-604/

(edited to be a little more clear after a cup of coffee)

Damn. I hadn't read about that before. That's messed up. Most messed up being that the courts basically refused to hear the truth because it was classified. There's a defense for ya - "We can't submit the truth as evidence, so we'll have to go with this falsehood over here. Good luck."

I think more and more you may find it becomes popular to mandate a user's data be retained in their country of origin. Otherwise some sort of agreement would need to be made that a foreign citizen's data on a corporate data center is like an embassy... it's digitally treated like it's on that nation's soil, and subject to that nation's laws.

The latter is likely much less practical in the real world, because our spy agencies don't really care where your data is, they're going to try and collect it, and the EU has made it clear that isn't okay with them.

In an ideal world, the United States and other major nations would all sign privacy laws as strong as the EU's. But I can't see that happening in our current political climate. Parties on both sides are more than happy to strip us of our privacy. And corporations oppose it as well.

You start with being ethical. In the online business, that pretty much covers most things with the exception of VAT, the clusterfuck known as "intellectual property", and the fine line between freedom of speech and hate speech. (I'm ignoring doing business in repressive regimes, because there you've only got yourself to blame.)

The only reason why US companies are in trouble in Europe is because they use unethical practices that happen to still be legal in the US.

However, it was pretty obvious up front that those practices are unethical and illegal in most of the Western world.

So please, stop whining about the complexities of international businesses when the root cause is simply a lack of basic decency.

This is indicative of how nationalism, a concept formed as a result of the effects of the Gutenberg printing press[1], is now obsolete and counterproductive in a globalized, electrically interconnected society.

[1] The Gutenberg Galaxy, Marshall McLuhan

There's also a Data Protection Regulation that should pass the EU Parliament this year and will unify the privacy laws in the EU (for the most part). Although, as usual with EU regulations and directives, it will be about 2 years before national governments implement it locally.

EU regulations are immediately enforceable and do not need to be implemented by national laws (unlike directives).

He's sorta correct while regulations are binding they do have a (usually fairly long) grace period and also quite often some generic complete opt-out mechanism.

Is this the same privacy watchdog that mandated "this site uses cookies" banners?

Whoever thought those were a good idea, needs kicked in the head.

I wish there was a global setting to accept all cookies and stop annoying me.

Sigh.

http://prebake.eu/

There is also https://github.com/r4vi/block-the-eu-cookie-shit-list which blocks far more, even the unobtrusive ones. Think of it as AdBlock Plus with the 'acceptable ads' feature disabled.

There's not much real information here, except for the names of some key regulators involved. Anyone got a better article?

One solution would be for the United States, the land of liberty, to give its citizens privacy protections similar to what Europeans enjoy.

What does a U.S. citizen gain from not having the option for privacy? You always can forgo it if you like.

No one makes you sign up for Google or Facebook. By using those services, you accept their terms. What the EU is doing is actually taking away your options.

It's not just Google and Facebook (and it may be hard to avoid Facebook in some situations, such as networking for some jobs); it's ISPs, cellular providers, cameras in stores, tracking across the Internet - Google tracks me whether I sign up or not.

Unless I lock myself in my basement, with no communication in or out, I can't avoid the infringement on my privacy. What are rights or choices if they apply only in my basement?

> What the EU is doing is actually taking away your options.

People in the EU still can sign up for Facebook or Google and give private information to them. What options do they lose?

>What options do they lose?

What will the EU do against companies that have no legal presence in the EU?

The only way for the EU to enforce these kinds of rules is to 1) limit enforcement to companies with EU offices (which just hurts Europe), 2) prohibit individuals from using non-complying web services (Great Wall of Europe? unlikely), or 3) prohibit European businesses from doing business with non-complying services (i.e. make it illegal for Europeans to buy ads on Facebook).

Government policy-making isn't making a wishlist. It must be backed by coercion or it is meaningless.

I don't agree with what you say (Facebook and other large companies operate in the EU and I haven't heard of one avoiding EU law by hiding in the U.S.), but even accepting it I don't see what options EU users lose.

Unless the EU is willing to resort to options 2 or 3 (which very obviously would require limiting the options/rights of Europeans), it will have to accept that is has no control over services with no legal presence in the EU. In proceeding with option 1, it would be creating a strong incentive for companies to find a friendlier jurisdiction, further exacerbating Europe's labor and entrepreneurial malaise. Yes, all of the big tech companies have European offices today, but 1) they're huge corporations that can afford regulatory compliance, and 2) they might not have opened those offices in the current regulatory climate.

Access to the European labor market and datacenters, and the ability to have salesmen on the ground, might very well outweigh the costs (and foregone profits) of the EU's proposed data regulations, for some companies. But Europe, already over-burdened with regulations and taxes, as evidenced by stagnant growth and massive youth unemployment, is just digging itself into an ever-deeper hole. There is such thing as death by a thousand cuts.

as a non-native speaker I wonder whether it should rather be "zeroes in". Or is it equivalent ?

EDIT: "to zero in" being a verb. For the noun, I know there are two alternative spelling for the plural.

As another non-native speaker, I think both are correct. It's the different between "American" english and "British" english. The title being american (NYTimes), and "zeroes in" being British.

Reply on news.ycombinator.com