Hacker News Reader

Comment by mtremsal | Hacker News Reader

I'm thinking EU residents/citizens should be able to do so under the GDPR. The main concern is that the request would cascade to their 3rd parties (as data processors) and it might be difficult to anticipate the total reach of the request.

View on HN

Unless you're willing to live without credit, legitimate interests will override. Section 6f. This is, in fact, called out as an example in the ICO guidance. That bit doesn't (imo) seem to have materially changed wrt the DPA / Data Protection Directive 95.

Breach notifications are new and interesting though. Equifax definitely would have been required by the gdpr to promptly disclose.

I don't specifically know if EU credit agencies are in the practice of widespread selling of credit data besides when a person has asked for credit. The gdpr will definitely allow opt-out of that (by default even!), but I think previous privacy laws may cover that. I'm not sure.

My personal opinion is the gdpr is probably the end of Acxiom style businesses, plus all the ancillary businesses the CRAs in the United States get up to besides plain credit reports. Eg marketing, wage tracking, outcomes estimation for colleges, etc.

I got it! We'll solve it with blockchain/crypto....

Www.civic.com

EU doesn't have Equifax.

Sure it does: https://www.equifax.co.uk/ (or at least some EU countries do)

Applies to any EU citizen data anywhere.

Applies to EU citizen data for companies that operate in the EU. You can't enforce laws against a company outside of your realm of jurisdiction.

GDPR has what is called extra-territorial applicability.

If it’s outside their jurisdiction, they can claim whatever applicability they like: the law is simply not enforceable outside that jurisdiction.

Technically yes, laws only apply within sovereign borders, but this is where trade agreements come into effect. EU is a big enough market that most countries will likely agree to uphold the rules for European citizens. It has been a big focus for online retail in Australia lately, and for good reason.

The law can be enforced against people who are, or have assets, within the jurisdiction, whether or not the alleged violation occurred there.

You can also have some very weird legal definition of a nexus, like this bank that allegedly opened a nexus in the US because they used US dollars for a transaction between two non-Us countries.

And there is also the case that the US army just land in your country and arrest anyone they could not kill.

> And there is also the case that the US army just land in your country and arrest anyone they could not kill.

Unlikely; its a lot easier to kill people than arrest them, especially if you are the US army, which is optimized for the former over the latter.

It may, but they'll play hell trying to enforce it worldwide, as if any countries would let them (some may).

Many eu countries have credit agencies though.

Reply on news.ycombinator.com