Hacker News Reader

Comment by exabrial | Hacker News Reader

If i travel to the eu as an American does that mean it’s illegal to track me while present in their territory? Would I be able to sue them and which country would be most favorable for the largest payout if so?

I’m happy to write their support team an email letting them know my intentions to travel (lol).

View on HN

I am not a lawyer.

"If i travel to the eu as an American does that mean it’s illegal to track me while present in their territory?"

Yes.

"Would I be able to sue them"

You can sue any time but only makes sense if meta does something illegal.

"and which country would be most favorable for the largest payout if so?"

If Meta breaks the EU law you would likely have to sue in the country were you were present. Could also be that you have to sue Meta in an EU country were they have an office. (Ireland? Luxembourg? Dunno).

"I’m happy to write their support team an email letting them know my intentions to travel (lol)."

This is a great idea, unfortunately there are no punitive damages in most EU countries. Your payment would be tiny.

That is disappointing. What is the motivation for them to actually obey the law?

Well, they EU can sue too and if the government sues you it is a different game and can get expensive.

Fines for breaking EU Competition Law Overall limit: The fine is limited to 10% of the overall annual turnover of the company.

Annual turnover of Meta?

Not sure if that's a serious question and you actually consider lawsuits by private individuals the only functioning method of law enforcement, but: enforcement by governments or regulators is a thing, and on top of that anyone can still sue Meta, they're just not going to get rich doing so.

The GDPR fines can actually be quite large, although they won't be paid out to you personally.

«The more serious infringements go against the very principles of the right to privacy and the right to be forgotten that are at the heart of the GDPR. These types of infringements could result in a fine of up to €20 million, or 4% of the firm’s worldwide annual revenue from the preceding financial year, whichever amount is higher.»

Source: https://gdpr.eu/fines/

The enforcement is that the state regulators can fine them quite substantially. In the EU and UK a lot of things around regulating business behaviour with consumers happens with consumers complaining to regulators rather than consumers suing companies through class action suits.

In the UK at least more often than not if I have a problem with a company, esp for some kind of utility, there is an ombudsman that is the first port of call over the courts.

The fines that the EU states can issue are very substantial % of revenue amounts.

In the case of the UK, which I'm most familiar with, it's probably a combination of the ico and ofcom which have the relevant powers to fine someone like Meta.

> Could also be that you have to sue Meta in an EU country were they have an office. (Ireland? Luxembourg? Dunno).

One could probably sue them in the country the behavior was documented.

The equivalent case would be if A assaulted B in Norway and flee to Chicago. B could report the crime and sue in the UK, get a legal ruling, and the Norway legal branch would then deal with the US branch to bring something out of the situation (compensation, equivalent punishment in the US, extradition etc.)

And when you sue you must justify a damage. You dont sue on principle when no damage was inflicted upon you. For instance if someone runs a camera in the street and always delete the footage, sure it s not legal per se, he tracked you, but since he actually always deleted the footage, you cant well ask for any compensation for any damage: how will the judge repair your tort ?

I guess you probably could, but any fines or such would not be paid out to you personally. Enforcement is primarily the responsibility of national data protection authorities (DPAs) in each EU member state.

It's easier to report them to your state's data protection authority. If more people do so and the authority does its job, they will sue on your behalf, like the Norwegian Data Protection Authority did.

Individuals cannot sue for GDPR violations. They van only raise their concerns to data protection agencies and these can sue, bur they can also decide to ignore.

No, RGPD only applies to EU citizens even if they are abroad or if they are using services not based in the EU.

Not entirely correct, it applies to EU and EEA _residents_.

In practice it's easier to register a new account in Europe and just use that account.

> If i travel to the eu as an American does that mean it’s illegal to track me while present in their territory?

In short, no.

The GDPR is about protecting EU citizens, and only if you reside in the EU (even as a US citizen), the GDPR will be relevant for you.

Reply on news.ycombinator.com