Hacker News Reader

Comment by Tsubasachan | Hacker News Reader

GDPR is unfortunately a paper tiger I have come to realize. The only thing that impresses Americans is a bit of good old violence. And the EU simply doesn't have the balls to drag executives off their private jets and drop them in a secret prison.

View on HN

The question is, what are you going to say when you have an office in the EU? Or you use one of the EU states to launder your money (Ireland is very popular, for example)? The big firms are affected by it and about the small ones... I doubt, "dragging executives off their private jets" is the most effective strategy when it comes to handling business related to money. Don't be too pride, it is a big market after all, you are talking about.

No any authority over sites not hosted/run in the EU. I'm a US citizen running a business in the US; the EU has no legal authority whatsoever over me. If an EU citizens buys something from my site, as far as I'm concerned they came to the US virtually to do it, and US laws apply here, not EU laws. They can shove their GDPR where the sun doesn't shine.

Unfortunately unless you are explicitly not soliciting business from EU residents, you fall under that regulation.

One possible consequence is reputational damage.

No I don't, I'm not an EU citizen and have no EU physical presence; they can claim whatever they want, they have no jurisdiction over me, I am not subject to EU laws no matter what the GDPR tries to assert. It's toothless, they have no enforcement mechanism on a US citizen in the US. I'm am not subject to the laws of every country that asserts it so; I'm subject to the laws of the US only.

While GDPR is supposed to apply to any controller processing personal data where the processing activities are related to the offering of goods or service to data subjects in the Union, I believe it is fair to say that we have no idea yet how this will exactly be enforced outside of the EU (when it is enforced) until the first attempts appear.

It's true that this extra-territorial scope is a bold move when it comes to international law. I see a trend in the latest EU regulations that would suggest they are not close to abandoning this idea.

> It's true that this extra-territorial scope is a bold move when it comes to international law

Not really. Foreign opponents (especially American opponents) of the law make a big deal out of it, but extraterritorial application of laws, especially to acts occurring outside of but having effect within the territorial boundaries of the State whose law is concerned, is in no way novel.

You are right. It is something that has been known in criminal law for a long time. However, the possibilities to enforce have always been submitted to the rules of legal assistance that most of the time provides the limits of another national law.

We might end up in a situation where US authorities could accept to apply GDPR, but with fees limited to what US law allows, for example.

Ironically, the US is one of the worst countries for extraterritorial application of laws, but I guess it's convenient to ignore for the sake of argument. See e.g. Foreign Account Tax Compliance Act (FATCA).

The UK's ICO has already taken action against a Canadian company (Aggregate IQ Data Services Ltd)

Reply on news.ycombinator.com