Hacker News Reader

Comment by irjustin | Hacker News Reader

I argue Zoom does understand GDPR and the ePrivacy Directive from a legal perspective.

The specific citation about the length of a cookie is a recommendation and not a law[0]. The key word is 'should'.

I'm not a lawyer nor claim the ability to interpret GDPR legally, but I have seen companies that actively worked to edge case GDPR to their advantage (I was part of one). We would have lawyers and other 'GDPR experts' tell us what was possible and what wasn't then simply extend into the grey area.

Here, I reject the Halon's Razor[1].

[0] https://gdpr.eu/cookies/#:~:text=All%20persistent%20cookies%....

[1] https://en.wikipedia.org/wiki/Hanlon%27s_razor

View on HN

The website gdpr.eu is not official. It's just a website made by some people. The length of the cookie, as far as I can tell, is not even a recommendation in the law. It's just a thing someone said on the Internet.

The ePrivacy Directive requires strict consent (as defined in GDPR) in order to read or write data from a user's computer, including cookies, except were strictly necessary to provision the service. There's potentially wiggle room for throttling, which is in the name of one of the cookies. I have doubts about a cookie tracking whether you've ever logged in.

I imagine GDPR doesn't apply to Zoom, as a non-EU company. Much like China bans what it doesn't want, the onus is on the EU to set up a GFW of their own and ban Zoom (and other GDPR-non-compliant foreign websites) if they disagree with it.

Otherwise, Zoom only needs to obey the laws of USA and wherever else they have offices.

Disclaimer: IANAL

Also: I'm not arguing for Zoom's sketchy practices but just saying that GDPR might be the wrong card here. The EU isn't the world police.

I'm pretty sure GDPR applies to any companies with dealings in the EU, or at least to that company's dealings which occur within the EU.

Disclaimer: IAANAL

You could say that about China as well. China's laws say that you need to censor your search results of certain things. Google and Facebook don't censor. They get banned by the GFW. Plain and simple.

The EU can do the same thing and set up their own firewall if they wish to enforce GDPR on foreign websites.

The fact that their citizens would revolt over the idea of internet censorship, is irrelevant. The point I'm trying to make is that EU saying "you can't serve X to our citizens" and China saying "you can't serve Y to our citizens" is no different and it's upto them to enforce it within their borders if they wish. The EU doesn't get to play world police any more than China's government does.

FWIW baidu.com and tencent.com are both pretty damn GDPR incompliant and the EU isn't doing anything about it. And yes there are Chinese-speaking EU nationals that use these companies' services.

You, uhh, you realise that we're stuck with restrictions on what we can do in significantly more important sectors than serving tracking cookies because of the US - like the financial industry - right? There's not a world power in existence which doesn't extend its power in order to attempt to either protect its citizens or protect its tax income.

Any company that has an operating entity in an EU country must comply or risk being fined by regulators.

If the target is big enough, EU regulators will ask for help from other countries.

Zoom operates offices in a few EU countries[0] so they'll definitely have some sort of entity(ies) setup - regulation pressure can be applied.

[0] https://zoom.us/contact

You're right, I checked and Zoom does have offices in Paris and Amsterdam.

I suppose then they have the choice of doing Google's playbook in China and just close their EU offices if they wanted, instead of complying. I mean, China wanting censorship and EU wanting GDPR aren't any different. Without arguing for or against either, China's censorship and GDPR are both local laws and foreign-based companies with no local offices don't need to comply. Foreign companies may be blocked, that's all.

Not that I'm advocating for Zoom violating privacy, but I'm not in support of EU unilaterally setting rules for the world or their right to police EU laws outside their borders. They should set up a GFW if they don't like certain things being sent into their country borders over the web, but they can't tell me what to do if I haven't set foot in their jurisdiction. (Neither can Iran, Russia, or North Korea, so why does EU get a pass to police you? If Kim Jong Un sent you a fine for $1 million would you pay it?)

> but they can't tell me what to do if I'm not in their jurisdiction.

True, but if you have offices and do business in their jurisdiction, then you get to follow their laws.

> they can't tell me what to do if I haven't set foot in their jurisdiction.

By accepting customers from the EU you are setting a foot here albeit economically and not physically. You are free to not serve european costumers if you do not want to deal with the GDPR.

I think you entirely misunderstand the purpose of the GDPR.

That is incorrect. GDPR applies to EU residents using the service, wherever that service is.

That is a jurisdictional grey area. It is technically true, but practically speaking, it's why I specifically said "EU regulators will ask for help from other countries".

GDPR is only strictly enforceable in EU countries. All the other countries, it's up to whether they want to cooperate.

Example - EU cannot force China to make Tiktok/Bytedance to follow GDPR practices in China for EU citizens. They really they can only wave a big finger and claim Bytedance is out of compliance.

Sure, EU can sue Bytedance cross border in China, but it carries no weight/teeth. At which point, EU has to escalate... trade relations? sanctions? war?!

So practically - they have to ask for help.

There's no need to ban Zoom itself. Just stop all money from the EU going to Zoom's accounts.

> The EU isn't the world police.

That’s not how the world works. Non US citizens have been arrested in the US for breaking US law when they aren’t in the US. Hell the US has tried to extradite people to the US who have never been to America.

Reply on news.ycombinator.com