Hacker News Reader

Comment by JumpCrisscross | Hacker News Reader

> Clubhouse requires contact list in order to get invites, which are required to sign up right now

How is this GDPR compliant?

I think this is a wording issue if you haven't used Clubhouse.

You don't need to share contacts in order to get invited, like you don't have to do it to use the platform. You have to do it to invite others (like your friend that you told about Clubhouse) after you are already on the platform, so that is not regulated by GDPR.

It is a shitty user experience and I also want Apple to control this at the OS level. Let me select which contacts if I want to do it at all.

> How is this GDPR compliant?

It isn't, really, but the question whom to prosecute is complicated. Clubhouse gets the contact list data from you, the user. Usually, somewhere in the ToS, there is a little thing where you confirm to have the right to share all the data you share with Clubhouse. That means that first and foremost, you as a user are responsible.

If you are a non-commercial user using Clubhouse from your private phone, what you do with your private contacts isn't covered by GDPR, private stuff is an exception. However, as consumer, European legislation protects you from surprising and unusual terms, which this might be. Legislation might also protect all your contacts. However, this is a question that still needs to be litigated in court, and I don't remember any decisions around that problem (WhatsApp basically has the same constellation).

If you are a commercial user, because this is your work phone and your contacts are colleagues, business partners, customers, things are quite different. You are, as a data processor, responsible for how you pass on your contact list. You better make sure that you are allowed to do that (because you have a GDPR-compliant reason like legal obligation, contractual obligation with your customer, assent or legitimate interest) and that your contacts have been informed about what you are doing beforehand. Also, you then need a written contract with Clubhouse about the data being passed along, about how it will be used and protected, etc. Also, passing along the contacts to Clubhouse must be necessary for a predetermined, well-defined reason that can be considered more important than your contacts' right to privacy.

So as a private person, you might get away with using Clubhouse. As a company, employee, self-employed, state official, whatever, you are probably in hot water, because surely you didn't do all the required things. But for Clubhouse this might not be a problem, because as current case law stands (imho, iirc, ianal, ...) Clubhouse isn't the party that did something wrong there.

On Android if you use Work Profile your work contacts are in a separate partition and can only be accessed by approved company apps. This works really well for gdpr compliance with dual-use (company & mobile) devices.

I see the point, but if I upload my contract list the non compliance is mine (I didn't ask permission to each one of my contacts) or of Clubhouse (they asked me to do it)?

both, yours for sharing, clubhouse's for storing.

It should be blaringly obvious to Clubhouse that they don't have the right to even store most of this data, let alone use it for anything.

So even if you are at fault, I can't imagine that would help them a lot, if some data protection authority looked into this.

It isn't, but in addition to the (valid) arguments the other commenters make about Clubhouse not having any assets in Europe (thus making enforcement of any kind of penalty nearly impossible), the majority of the data protection agencies are also completely incompetent at enforcing the GDPR even against companies that they can collect from.

Why would you want to be GDPR compliant?

To avoid substantial financial risk.

Has the EU sued and won against any company who is not located in the EU?

That's not a good test, because the law is still relatively new, and it takes a while for litigation to make its way through the system. We also don't necessarily know who has settled out of court.

Would you like to be a test case for us?

I would love to be a test case on it, I am not in a position.

I'd be extremely interested for a company who doesn't operate in the EUs being brought to court and what other countries are willing to help the EU exercise those judgements if any.

Because in European Union it is regulation, and you (as a company) are fined if you are not compliant.

I recommend having a look over the Wikipedia page on the subject:

https://en.wikipedia.org/wiki/General_Data_Protection_Regula...

If you’re not subject to the EU (I.e. don’t have any offices, servers, etc. in the EU) I don’t see how the GDPR is relevant: non-EU citizens generally aren’t subject to the laws of the EU.

If some of your users are in the EU you need to be GDPR compliant.

This is what the law says, but I don’t understand how this is expected to work: without some kind of treaty from the US government, the EU has no way to make US companies comply.

The US and EU have a treaty specifically about enforcing each other's laws. (More accurately, the nations that comprise the EU are individual signatories to such treaties.)

Source? This lawyer seems to think that there’s no applicable treaty.

https://tinyletter.com/mbutterick/letters/you-re-not-the-bos...

Here's the one between the US and the largest economy in the EU:

https://www.congress.gov/treaty-document/108th-congress/27

There is no legal mechanism because such exist mostly for criminal law and civil and public debt collection. So the EU maybe cannot use most of the enforcement mechanisms, except one: You can be fined some amount of money, creating a public debt which can then be collected if there is a treaty about such collections.

There's a slew of individual things that can be done. EU companies can be prevented from doing business with a (willfully) noncompliant company. Wire transfers going through the EU and other operations can be blocked. And, of course, the service itself, its apps, its sites, its traffic, can be blocked from accessing the EU internet (or being accessed from it).

That's not even getting into international pressure levers.

I don't know that we've seen any of those kinds of actions yet, but they're clearly on the table if a company breaking the rules became a real "problem".

The thing is, if you're just completely avoiding doing any business with the EU, having any EU customers or users, and just not touching the EU with a 1000 mile pole and avoiding the GDPR in such a fashion - well, then there's no reason to go after you. The legislation has done its job.

> And, of course, the service itself, its apps, its sites, its traffic, can be blocked from accessing the EU internet (or being accessed from it).

In other words, the EU can attempt to extend its internet regulations over the rest of the world by implementing a China-style firewall. Well, we'll see if that happens.

It is more akin to the US Sanctions. You don’t have to abide. If you do trade with sanctioned countries, you should not do any kind of business with the US, or pay a hefty penalty.

Here’s a case example, BNP Paribas dealings with sanctioned countries. https://www.wsj.com/articles/bnp-agrees-to-pay-over-8-8-bill...

Have you not heard of extradition treaties?

For example, that's what the US is using on Kim Dotcom.

If you're operating a business that interacts with customers in the EU, GDPR applies.

The EU says it applies but, AFAICT there’s no legal mechanism by which it applies.

Here’s a lawyer’s take on this: https://tinyletter.com/mbutterick/letters/you-re-not-the-bos...

I thought US companies had to agree to Privacy Shield if they wanted to be considered GDPR-regulated.

https://www.privacyshield.gov/welcome

Why any US company would voluntarily agree to this is beyond me, unless one of its EU customers insisted on it.

Then you cannot have ue customers. Or make wire transfer through the ue.

You can also forget vacation trips in EU.

If thoroughly enforced, which is currently not the case.

"The GDPR also applies to data controllers and processors outside of the European Economic Area (EEA) if they are engaged in the "offering of goods or services" (regardless of whether a payment is required) to data subjects within the EEA, or are monitoring the behaviour of data subjects within the EEA (Article 3(2)). The regulation applies regardless of where the processing takes place. This has been interpreted as intentionally giving GDPR extraterritorial jurisdiction for non-EU establishments if they are doing business with people located in the EU."

Source: https://en.wikipedia.org/wiki/General_Data_Protection_Regula...

Countries or groups of countries don't get to impose their law on other countries.

That's called colonialism, and Europe is supposed to have given it up.

I am not a lawyer, and I don't claim I understand the legal mechanisms involved. I don't even claim GDPR is perfect.

But, as I see it, EU is protecting its citizens. If you want to do business with EU citizens you must abide by EU regulations. It's that simple. I don't get how this came to be all of a sudden about colonialism. Any business is free to stay out of EU.

And any EU citizen is free to not do business with a company outside the EU.

Do you think the EU laws should apply to people selling things to EU citizens while they are on vacation in other parts of the world? If someone from Germany travels to Brazil and buys something from a store, are they required to abide by EU rules?

If someone from the EU leaves the EU digitally to buy something in another country, it isn't up to the seller to enforce EU rules.

Unless you have an entity (either yourself or your business) under EU jurisdiction, you don't have to follow their rules.

There's an asymmetry of information and power in the relationship between a business and a citizen. Governments, generally, attempt to mitigate this asymmetry. Hence, we have consumer protection laws, GDPR and the likes.

While these solutions may be incomplete, or imperfect, having none is definitely worse.

> If someone from the EU leaves the EU digitally to buy something in another country, it isn't up to the seller to enforce EU rules.

> Unless you have an entity (either yourself or your business) under EU jurisdiction, you don't have to follow their rules.

Please _do_ read the link I already posted in a previous comment [0]. It clarifies many things, but I don't want to paste too much content here.

[0]: https://en.wikipedia.org/wiki/General_Data_Protection_Regula...

I am not sure what you are trying to argue here. I am not making any moral claim about whether a GDPR-type regulation is good or bad. I am simply saying that the EU saying the law applies outside their borders doesn’t make it so.

If I am a US citizen living and working in the US, and break the GDPR by storing data illegally from visitors to my website from the EU, the EU can certainly try to fine me or issue a summons or whatever they want to do.

However, there exists no extradition treaty for this law, and there would be no way for the EU to enforce judgement.

Yeah, this is the really frustrating thing about conversations about the GDPR: whatever you think about how companies should act, legislation doesn’t really matter unless there’s some way the government can take retributive action against those who ignore it. When someone asks about what this mechanism is, you inevitably get a whole host of people assuming you dislike the legislation.

This article basically confirms my suspicion that this provision is basically unenforceable:

http://slawsonandslawson.com/article-32-the-hole-in-the-gdpr...

> If you want to do business with EU citizens you must abide by EU regulations.

No, no more than if I want to do business with Saudis I'm liable for punishment if I drink a beer.

But that's not really a good analogy (not that analogies are proof). A better analogy would be you selling beers in Saudi Arabia.

I urge you to read this, it should clarify things:

Applicability outside of the European Union:

https://en.wikipedia.org/wiki/General_Data_Protection_Regula...

They claim it applies. That doesn't make it so:

http://slawsonandslawson.com/article-32-the-hole-in-the-gdpr...

I wonder when the USA will follow suit?

https://www.jdsupra.com/legalnews/clubhouse-app-faces-court-...

On a side note, Germans are obsessed with Clubhouse.

They are in california. They can give the finger to the gpdr. It's irrelevant to most people in the world

People tend to forget that it is not applicable. For instance nothing I build will ever comply to it regardless of users that might be in europe

Clubhouse has no duty to obey european law

The question is: why do you think the need to be compliant?

This is not how it works. If you make it available to EU users, you have to comply with GDPR (at least when it comes to those user's data).

For the same reason WhatsApp's new T&Cs don't really change anything for EU users.

However I don't think the collection of contacts is actually illegal under GDPR, considering WhatsApp does exactly this too. And it's huge in Europe, much bigger than in the US. if they haven't gone after WhatsApp for this, they will probably not do so for Clubhouse.

If they don't do business there they don't have to comply. Making it available doesn't count

Just like I don't have to comply if I have EU users on a service, I am in the united stated. europe cannot enforce their laws here. It's just the same as if saudia arabia tried to enforce their laws here. They carry no wait

That is what makes the GDPR insignificant. It applies to Europe. Not the rest of the world. The cookie warnings for the vast majority of the internet are stupid an unnecessary

So call it illegal in europe but who cares?

It honestly is maddening how many people care about the GDPR that don't need to

There's many EU things that take effect with vendors outside the EU. Like software sales: Try to buy a license for a software package from the EU (or with an EU payment card) and you will always be hit with VAT at the rate of your country :( Even if the company is US based only. With the exception of really small ones I guess. In the above case it's annoying for us :) But in the case of GDPR it's good IMO.

Anyway the EU says it applies but I agree they don't really have much in the way of enforcement capability with companies that have no presence here. Though they could ask Apple/Google to remove it from the store I suppose.

And of course most companies do have a presence here. All multinationals do, and even the smaller ones. Even if it's just a sales office.

Most American companies don't though. They can safely ignore european laws

And also choose not operate in the nations whose laws they are flouting in most cases; EDIT: a few weeks ago EU posters here were describing how ERCOT was preventing access to the company's public facing website, citing not wanting to comply with GDPR

Reply on news.ycombinator.com