Hacker News Reader

Comment by matsemann | Hacker News Reader

> The CNIL rejected the companies’ arguments that it had no right to impose the sanctions because their respective European headquarters are in Ireland and Luxembourg

So they are fine with taking French money, but want to be above their laws?

View on HN

This is actually a really important part of the issue.

One of the things that stops GDPR from being a total clusterfuck is the so-called "one-stop shop mechanism." Each country has its own regulator, so GDPR is enforced by 27 different government agencies. BUT, anyone only ever has to deal with one. For EU residents, the regulator of the country where they reside. For businesses, the regulator of the country of their primary establishment. Regulators are supposed to cooperate in such a way that a company has a single, local point of contact.

(Related: If US companies push for federal privacy regulation, it's because they would rather have 1 law to follow rather than 50 different ones.)

Almost all US companies establish their EU subsidiaries in Ireland for tax reasons. As a result, the Irish regulator is basically in charge of GDPR enforcement against US companies. This is... not ideal. Ireland a conflict of interest, because of the tax stuff.

(I'm not an expert on this. My understanding is that the Irish regulator seems to be operating in good faith, but is under-funded, and is going up against the legal defense teams of Google, Facebook, Amazon, etc., simultaneously, all on its lonesome.)

Several of the larger and more privacy-focused countries, like Germany and France, have been openly critical of Ireland's slow enforcement of US tech giants. In the past, CNIL (France) has said that Google's establishment in Ireland is a legal fiction rather than a legitimate business establishment. But if this gets appealed to an EU court, this is going to be a huge point of contention.

(Possibly the only point of contention, because I don't see any way that Google's actions are in compliance with GDPR/ePrivacy Directive.)

> The GDPR does however provide for a potentially significant derogation to the 'one-stop-shop' approach. Specifically, any DPA (irrespective of whether or not they are the lead DPA) is given competency to deal with any complaint lodged against it, or deal with any breaches of the GDPR, if the case relates only to an establishment in its Member State (even if that establishment is not the 'main establishment' of the controller or processor) or substantially affects data subjects in that Member State7. In such cases, the local DPA is required to inform the lead DPA without delay and the lead DPA will have three weeks to decide whether or not the case should be dealt with via the co-operation procedure (discussed below)8.

Taken from: https://www.dataguidance.com/opinion/eu-one-stop-shop-under-...

It could be that Ireland did not react within the one-stop-shop allowed time frame, freeing France to start the procedure.

The reason France could act on his own is that ePrivacy is not subject to the one-stop shop mechanisme. Each country can choose to act independantly. They are not saying that Ireland is not relevant for GDPR-related issues.

This is the whole point of having your headquarters in those countries: make money in country X but be taxed according to country Y laws. Why would they not want to be under country Y laws for things other than taxes?

Yes they do it for tax purposes and the tax laws do apply of course.

Reply on news.ycombinator.com