Deleting all posts in a forum by a certain user will not delete all posts in a forum by other users that quoted the user who desires to have their data deleted.
Devil meet details
In particular the NYTimes reports on Joe Baddy doing something bad. That article arguably belongs to the NYTimes. Google indexes that article with permission from NYTimes. Right to be forgotten requires Google remove the link to NYTimes even though neither Google's index nor the article at NYTimes belong to user.
And why should a Canadian running a site on American servers have to fear EU law? Why isn't it the EU citizen's responsibility to know, understand and abide by the rules and regulations of the countries they're visiting online?
If you offer your services in the EU, you have to respect EU law.
Or do you plan to make all of your web services "respect" the laws of 200+ countries in the world, and for that matter all the sub-jurisdictions of those countries (such as states or provinces or cities) that have their own laws? The EU is not special in that regard, they're just one more jurisdiction that the service isn't hosted in.
As to jurisdiction, you can always sit in your home country and ignore any rulings against you from other countries so long as you are sure that your own country will not extradite you for such a thing (I am confident that Canada would not extradite a Canadian residence for such a thing). Just don't ever try to cross the border into a European country.
It set the precedent for arresting foreign national for breaching US laws while on foreign territory considerably before Sklyarov's arrest in 2001; some notable prior examples include Humberto Alvarez Machain (1985) and Manuel Noriega (1989), though they weren't the earliest, either.
Insofar as Sklyarov's case was notable, it was more because the charged offenses were completely legal where they occurred, not because they were allegedly committed by a foreign national outside of the US.
I am genuinely curious because in that case GDPR seems to impact many companies disregarding whether they actually do any business here.
If you offer a French or Spanish translation: maybe
If you run ads in Germany: certainly
If you advertise accepting Euro: most likely
If you embedded ads from an ad network which sends localised ads to Europeans: most likely
When having a site reporting news on local events in an African municipality most likely not.
There is no clear line, as writing that down is impossible and always requires judgement. Also the question is whether EU can enforce it. If you have no European subsidiary and live abroad there is little they can do.
I don’t outright disagree, I don’t think it’s settled or even established yet.
Mail is probably going to be a big precedent. Everything from play by mail chess to ordering from Sears will have to be considered.
If I, as the prince of Princeton, was to pass a law that each time one of my subjects visits your website, you must pay me $1, you'd think that's mad. And you'd be right - since you're not bound by Princeton laws.
The EU is claiming that sites in other countries are bound by EU laws - and that's just as wrong as if Princeton passed the laws.
The GDPR is exactly the same. EU says that you have to comply with the GDPR if you process EU-citizen data. So company have the same choice: Comply with the EU GDPR or don't do business with the EU. I don't think it happen yet, and I think that the framework for this is not even ready yet, but nothing would prevent EU from banning your service in the EU if you don't want to comply with the EU GDPR.
I honestly don't understand why there is such an outcry about it. It always worked like this: you want to do business with a country, you apply the law of the country. Internet is not a magical international space with no regulation.
You can argue that this kind of laws, that is a form of protectionism in a way, is bad. But it has been this way for a very long time and GDPR is absolutely not the first time such a law was put in place.
Just another example, if you are a US citizen creating a bank account in the EU, the bank (even if it is a EU bank), will have to declare it to US authorities (apparently due to your tax system that also apply if you are resident abroad).
[1] https://en.wikipedia.org/wiki/United_States_sanctions_agains...
For isntance: Germany has laws around limiting usage of Nazi symbolism. If you create a web page glorifying Nazis and their symbols this is illegal under German law. If you run such a site targeting Americans no German state attorney or Court will take the case (exceptions exist for stupidity or ego or power play reasons) however if you host a page in the U.S. aiming at German Nazis that way (for example by commenting on German politics and German language) they will try to go after you. (Which might not lead far, as the site is probably protected by US freedom of speech, thus US authorities won't assist, but you might want to avoid travelling to Germany and countries which might cooperate with Germany)
P.S. I don't want to imply that you have any such plans for such a site, but it's a specific example working fully virtual
This idea is not new and certainly is not seen as unequivocally wrong in law.
If you produce libel against someone from another country, that person may sue you in their home country. That you performed the libel in another country is not generally seen as problematic to the libel laws of most countries. The US may refuse to recognize the judgment and you are fine as long as you do not travel to said country or a country with extradition agreements.
Re: GDPR, if a US or Canada based company does business in Europe, or has data for European users, they have to comply to European laws. Just like European online services have to comply with e.g. DMCA takedown requests if they want to do business in the US, or online services have to comply with Chinese censorship laws if they want to do business in China.
If I was them I would just send the person their login profile and delete that from the site. Everything else is excepted, including backups which are kept for security.
A good community example to look at is Wikipedia. I will star to worry if and when I see them start deleting profiles and articles. Until then I see this kind of articles like a bit of scared interpretation of how nations might implement and apply GDPR.
Person B describes person A without mentioning a name, eg by describing person A in a way which is recognizable. (eg the pilot that shot down the death star.)
The first is at least searchable...
- https://gdpr-info.eu/art-89-gdpr/
- https://gdpr-info.eu/art-85-gdpr/
It's probably the same reason why Hacker News does nothing to comply with the GDPR.
Hacker News can comply with GDPR today and choose not to comply the next day. They forfeit nothing in the process of selectively abandoning GDPR, in regards to being governed by US law and not EU law.
If my company is located in the US and only governed by US jurisdiction (eg I do not operate in the EU in any manner), there's no such concept as admitting the EU has jurisdiction over my company and granting the EU new global powers (such that I can provide the EU jurisdictional reach into the US so that it overrules or competes with US law). That isn't my decision to make if I operate inside the US jurisdiction. The US solely decides jurisdiction within its zone of political control. That is, the US has the final say legally in all regards in that case. I could choose to voluntarily comply with GDPR, however the EU has zero power to force me to. I can flip flop back and forth a thousand times, or not, it makes no difference.
If you ever find yourself wondering about these concepts, change the scenario to China. Under what scenario does the EU or US have power to dictate laws within China? None. It provides a perfect clarification every time. Nobody could possibly be confused about who is in charge of law within China.
https://news.sky.com/story/huawei-cfo-meng-wanzhou-facing-ex...
> The global chief financial officer of Chinese phone firm Huawei is facing extradition to the US after being arrested in Canada.
> Meng Wanzhou, who is the daughter of company founder Ren Zhengfei, has been detained in Vancouver in relation to suspected violations by Huawei of US sanctions placed on Iran.
So not only do people have to avoid the U.S. to avoid being subject to U.S. laws, they have to avoid U.S. friendly countries too.
However, isn't the idea of forfeiting the personal jurisdiction defense? I am not a lawyer, but from what I understand, once you start debating the merits of the case, you waive the ability to claim that the court doesn't have jurisdiction.
It seems like there's a bit of a chance of that here - once you admit the EU or Chinese legal system is the appropriate place to redress things, you've given up lack of jurisdiction as a defense.
If someone follows that request and if the EU has jurisdiction are orthogonal issues; plenty of services offered deletion before the GDPR.
The question of jurisdiction will come up if you ignore requests or otherwise violate the GDPR and a national agency that is responsible for handling violations contacts you.
In which case you can still choose to ignore them, if you're not on EU soil, then it's up to the extradition or similar laws on what happens; the agency will likely file a court case (or you file), then the court will handle out the details with your national legal system; in most cases this means nationalizing any punishment. Ie, the court case will be handled and if you don't show up after being invited, will be ruled upon in your absence. Then the fine will be forwarded to your country where the courts in your country with your countries jursdiction will then collect it, probably take a fee and then forward the remainder back to the EU. An alternative outcome would be that the entire court case is moved into your country.
Either way, complying to GDPR-related requests doesn't mean admitting jurisdiction of the EU; disagreeing the responsible government agencies involved is a good way to test if those have jurisdiction.
(FWIW yes I do have a law degree)
AggregateIQ could have ignored the GDPR-request, ignored any rulings and keep chugging along as long as they stuck to Canada (assuming Canada was not going to side with the EU).
In short, if you're not in the EU, do not care about EU and never will, you can largely ignore the GDPR. Same as if some banana republic dictator declares you persona non grata - if you never intend to visit and otherwise have no business in that country, who cares?
The difference is that the EU is not a banana republic (opinions may vary), and so many choose to respect and accept this their judgement in cases like this to stay on good terms.
That's not entirely true. You can go to a Canadian court to enforce an EU judgement against assets in Canada. So for example, if you cause a car accident in Germany, the plaintiff can sue you in Germany to get a judgement and then sue you in Canada to enforce that judgement. How Canadian (or US or otherwise) courts will treat a GDPR judgement remains to be seen, but it's not a guarantee that it won't be enforced.