Hacker News Reader

Hacker News

Comment by vegai_ | Hacker News Reader

Full thread

vegai_

The article seems to suggest that it's declared illegal in Austria. Does this somehow apply to the whole EU then?

View on HN

Privacy law in the EU is harmonized.

> Privacy law in the EU is harmonized

In theory. Reality is quite far from that, as anyone on the ground can attest.

As someone 'on the ground' I see things moving in a much more uniform direction than where they were in the past, the differences are not large enough to make a fuss about. The thing to note is that the GDPR is a minimum set, local law is free to exceed the GDPR.

There is currently an EU member challenging the concept of European law’s primacy. Meanwhile, implementation of other courts’ rulings are delayed by years between jurisdictions.

There is zero chance, for instance, that anyone in Greece or Portugal or Ireland will be impacted, judicially, by this decision for several years. That’s better than before. But it’s far from e.g. a U.S. federal court ruling in California’s impact in New York, or a French court’s ruling in Paris in Marseille.

There is currently an EU member challenging the concept of European law’s primacy

That's a charitable phrasing. As per Protocol 2 on the functioning of the European Union, article 8 [2]:

The Court of Justice of the European Union shall have jurisdiction in actions on grounds of infringement of the principle of subsidiarity by a legislative act, brought in accordance with the rules laid down in Article 263 of the Treaty on the Functioning of the European Union by Member States

What Poland did was declare nationally (government, and then a national court) that the EC was infringing on its sovereignty (principle of subsidiarity). But as the above text says, national governments don't have jurisdiction when it comes to matters questioning the primacy of European law.

[2] https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:12...

> as the above text says, national governments don't have jurisdiction when it comes to matters questioning the primacy of European law

This is the essence of a divergence of theory and practice. The text says one thing. In reality, something else plays out.

I think the text will prevail. But that delay (and uncertainty) is precisely what I’m talking about. And it happens everywhere, with active regulatory arbitrage an all-but-admitted strategy of a significant section of the SME space.

There is in practice no uncertainty. There is a member state where politicians have decided that they would like to make some waves to divert attention from their internal troubles but the impact on the rest of the EU is extremely small.

> There is zero chance, for instance, that anyone in Greece or Portugal or Ireland will be impacted, judicially, by this decision for several years.

I don't think this is true. The impact will be felt immediately all over Europe, in fact it is already in the news here and people are already discussing dropping GA from websites:

https://www.nu.nl/tech/6178229/google-analytics-binnenkort-m...

Yes, but not automatically and immediately as far as I know.

The law was already in place, there are no changes there. It was just a question how it should have been interpreted in this case afaik.

OK then it's a question if other EU members will use this as precedence. With the current frosty climate between the EU and US social media, I reckon it will.

The ruling which led to this conclusion was made back in July 2020.

From the article:

> This is a very detailed and sound decision. The bottom line is: Companies can't use US cloud services in Europe anymore. It has now been 1.5 years since the Court of Justice confirmed this a second time, so it is more than time that the law is also enforced.

This article is addressing a specific case which follows from a previous judgement (known as Schrems II) which determined that Facebook could not transfer data from Ireland to the US under the US 'Privacy Shield' framework, as it no longer meets the GDPR's adequacy requirement due to CLOUD Act.

This finding by the Austrian court just reaffirms that the Schrems judgement also applies to Google Analytics.

As the article mentions, this is the first of 101 cases ongoing brought by Schrems, and I expect them all to end in more or less the same outcome.

https://www.europarl.europa.eu/RegData/etudes/ATAG/2020/6520...

Yeah, I also expect that after these 100+ cases we'll have a pretty clear consensus in most european countries about this.

I think if you view it from this angle it becomes clearer:

The court has not arbitrarily declared GA illegal, it just follows what the GDPR mandates - and came to the (quite obvious) conclusion that GA is not compatible with the GDPR.

Consequently it is illegal everywhere where the GDPR applies. This doesn't mean that there are immediate consequences for those who use GA on their websites in any other country, but it is very likely that other EU countries' courts will decide the same way.

EU laws come in a couple of variants. The most common is a directive which is basically "Your country needs to pass a law to achieve X, Y, Z", and this is where you get larger country to country differences in interpretation. The GDPR is instead a regulation. That means it's literally the same law (and theoretically, the same standards) that applies EU wide. So the US equivalent would be a court in Texas finding something to be illegal under a federal law. What does that mean for the same action in california? It's probably illegal there too, but it could still be tested if someone wanted to try their luck.

So that means the current status is that's precedent a court in another EU country would strongly consider but technically could come to a different decision on and in either case the losing party has the option of appealing to the EU level.

That's not quite right. This ruling is not the precedent, the Schrems II ruling is the precedent. This is just a court determining that Schrems is in fact relevant precedent in this specific case, and finding based on that.

> Austrian Data Protection Authority strikes the same chord as the European court when declaring Privacy Shield as invalid: It has decided that the use of Google Analytics violates the General Data Protection Regulation (GDPR).

It seems Google was sued in Austria and they have found it to violate the GDPR so yes, it applies to the whole EU.

Not Google, a company. Because not GA on it's self is illegal. The use of GA is illegal.

Now I'm wondering how many EU government sites are currently using GA.

If something is illegal under GDPR it is illegal in whole of EU.

GDPR is a set of minimum standards that are common between countries in EU, some have even more drastic laws.

The legislation that is relevant here is GDPR which is EU wide (each country has it's own implementation but they should be overall similar).

In the article it points out that there are similar suits across the EU by the same organization, so it's not too unlikely that there will be similar reults in some or all of the cases.

such individual court decisions are usually a precursor to what will be implemented EU-wide

The other way around: the GDPR was the precursor to this lawsuit, this is the implementation of the directive by a local court which found that, indeed, using GA violates the GDPR.

Reply on news.ycombinator.com