Hacker News Reader

Hacker News

Comment by swamp-agr | Hacker News Reader

Parent Full thread

swamp-agr

Disagree.

- I explicitly check to avoid any "disabling".

- The only intent was to permanently delete the account.

- You can believe me or not and I did it really careful.

View on HN

Move to a European country and Sue there for GDPR violation.

Yes that sounds entirely reasonable and practical.

Couldnt you transfer your account temporary?

I am in the middle of exactly that process!

What are the actual remedies available to you in your jurisdiction? Which one(s) are you pursuing?

You don't need to live in the EU/EEA to invoke GDPR rights. Case in point: the UK authority upheld a US resident's GDPR claim against Cambridge Analytica (and yes, Facebook was involved). https://ico.org.uk/about-the-ico/news-and-events/news-and-bl...

Pre- or post-Brexit?

Why would that matter?

Here are the changes: https://assets.publishing.service.gov.uk/government/uploads/...

Afaik it's entirely administrative, e.g.:

> ~~an adequacy decision by the Commission~~ relevant adequacy regulations under section 17A of the 2018 Act

('the Commission' being the European Commission, and no longer relevant.)

> Why would that matter?

Because since Brexit, the UK is no longer protected by the GDPR.

That is perhaps pedantically true in a way you almost certainly don't mean, that there is no longer 'the GDPR', there is now the EU's GDPR and the UK's GDPR (both using that name) ... but basically false.

As I said above, it was kept with the necessary amendments. That documents title: GDPR - Keeling Schedule. Introductory paragraph:

> This schedule has been prepared by the Department for Digital, Culture, Media and Sport. It is intended for illustrative purposes only to assist the reader in understanding the changes to be made to the retained General Data Protection Regulation by the Data Protection, Privacy and Electronic Communications (Amendments etc)(EU Exit) Regulations 2019 (as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc)(EU Exit) Regulations 2020 (subject to Parliamentary approval) when these come into force.

What do you mean “upheld”? The story in your link describes the company refusing to comply and then ends. It’s true that you don’t have to be currently living in the EU to invoke your GDPR rights if you’re an EU citizen traveling abroad, or if you’re a foreign citizen traveling or residing in the EU. GDPR applies to companies that market to people in the EU or do business in the EU. BUT - GDPR is an EU law, it does not apply to US citizens living in the US, which is why the company in your story was legally entitled to refuse to comply.

You're quite wrong. GDPR can apply to citizens in the US, and the link I posted shows the ICO enforcing it in their favour. SCL Elections Ltd was taken to court and then fined £15,000 for not complying with that US resident's request.https://ico.org.uk/about-the-ico/news-and-events/news-and-bl... I expect that US resident could also have brought a civil lawsuit, at least in UK courts, for damages.

The EU and UK GDPRs can also apply to companies in the US, or elsewhere. That's because location of the business (including subsidiaries) OR location of the individuals, are hooks under the GDPR's territoriality tests in Article 3. You usually need one or the other though; the way GDPR Article 3 works, it's pretty hard to imagine it applying to a US-only business in respect of US resident-individuals.

Yes it can apply to US citizens in certain cases, I thought I agreed with you on that, did I not? It’s still a fact that GDPR does not always (or even normally) apply to US residents doing business with US companies. UK courts have no authority over US companies operating only in the US with US residents who aren’t traveling abroad. Cambridge Analytica is a British company, that is why GDPR applies to them. So yes, I was wrong to conclude prematurely based on your link that this example is one where the company was legally entitled to refuse to comply. But the take-home message doesn’t change - GDPR doesn’t automatically apply to non-EU residents or non-EU companies, unless or until one or both parties has some EU involvement.

The part I most disagreed with is "GDPR is an EU law, it does not apply to US citizens living in the US". Yes it does, I provided an example. Your follow up is a lot closer to the mark.

GDPR is an EU law. It doesn’t automatically apply to people in the US. That’s the only reason I replied - your original framing left an implied suggestion that it might commonly or by default apply to US citizens, without discussing under what conditions. Arguing that you don’t have to be an EU resident leaves the misleading impression that the EU doesn’t have to be involved. I think it’s important to note that the EU part is required somewhere in the company-customer relationship for GDPR to have any say in the matter, and it’s important specifically because this is a common misconception and the misconception is being abused in some cases to coerce compliance where it’s not legally required. I know this as a US business owner that gets emails from US companies on behalf of US citizens that are demanding certain actions and rights under GDPR, without a legal basis to do so.

I'm pretty sure you can't "sue" under the GDPR. The best you can do is report them to your country's privacy regulator but so far all of them are absolutely incompetent or unwilling to enforce the regulation.

Hello from Amsterdam!

I'm confused. Are you expecting me to spend hundreds of thousands of Euros to get together a team of lawyers and spend years litigating with Facebook?

It's not even clear if I have standing. And what damages would I get? $3.50?

Reply on news.ycombinator.com