You don't need to share contacts in order to get invited, like you don't have to do it to use the platform. You have to do it to invite others (like your friend that you told about Clubhouse) after you are already on the platform, so that is not regulated by GDPR.
It is a shitty user experience and I also want Apple to control this at the OS level. Let me select which contacts if I want to do it at all.
It isn't, really, but the question whom to prosecute is complicated. Clubhouse gets the contact list data from you, the user. Usually, somewhere in the ToS, there is a little thing where you confirm to have the right to share all the data you share with Clubhouse. That means that first and foremost, you as a user are responsible.
If you are a non-commercial user using Clubhouse from your private phone, what you do with your private contacts isn't covered by GDPR, private stuff is an exception. However, as consumer, European legislation protects you from surprising and unusual terms, which this might be. Legislation might also protect all your contacts. However, this is a question that still needs to be litigated in court, and I don't remember any decisions around that problem (WhatsApp basically has the same constellation).
If you are a commercial user, because this is your work phone and your contacts are colleagues, business partners, customers, things are quite different. You are, as a data processor, responsible for how you pass on your contact list. You better make sure that you are allowed to do that (because you have a GDPR-compliant reason like legal obligation, contractual obligation with your customer, assent or legitimate interest) and that your contacts have been informed about what you are doing beforehand. Also, you then need a written contract with Clubhouse about the data being passed along, about how it will be used and protected, etc. Also, passing along the contacts to Clubhouse must be necessary for a predetermined, well-defined reason that can be considered more important than your contacts' right to privacy.
So as a private person, you might get away with using Clubhouse. As a company, employee, self-employed, state official, whatever, you are probably in hot water, because surely you didn't do all the required things. But for Clubhouse this might not be a problem, because as current case law stands (imho, iirc, ianal, ...) Clubhouse isn't the party that did something wrong there.
So even if you are at fault, I can't imagine that would help them a lot, if some data protection authority looked into this.
I recommend having a look over the Wikipedia page on the subject:
https://en.wikipedia.org/wiki/General_Data_Protection_Regula...
Source: https://en.wikipedia.org/wiki/General_Data_Protection_Regula...
That's called colonialism, and Europe is supposed to have given it up.
But, as I see it, EU is protecting its citizens. If you want to do business with EU citizens you must abide by EU regulations. It's that simple. I don't get how this came to be all of a sudden about colonialism. Any business is free to stay out of EU.
Do you think the EU laws should apply to people selling things to EU citizens while they are on vacation in other parts of the world? If someone from Germany travels to Brazil and buys something from a store, are they required to abide by EU rules?
If someone from the EU leaves the EU digitally to buy something in another country, it isn't up to the seller to enforce EU rules.
Unless you have an entity (either yourself or your business) under EU jurisdiction, you don't have to follow their rules.
While these solutions may be incomplete, or imperfect, having none is definitely worse.
> If someone from the EU leaves the EU digitally to buy something in another country, it isn't up to the seller to enforce EU rules.
> Unless you have an entity (either yourself or your business) under EU jurisdiction, you don't have to follow their rules.
Please _do_ read the link I already posted in a previous comment [0]. It clarifies many things, but I don't want to paste too much content here.
[0]: https://en.wikipedia.org/wiki/General_Data_Protection_Regula...
If I am a US citizen living and working in the US, and break the GDPR by storing data illegally from visitors to my website from the EU, the EU can certainly try to fine me or issue a summons or whatever they want to do.
However, there exists no extradition treaty for this law, and there would be no way for the EU to enforce judgement.
http://slawsonandslawson.com/article-32-the-hole-in-the-gdpr...
No, no more than if I want to do business with Saudis I'm liable for punishment if I drink a beer.
I urge you to read this, it should clarify things:
Applicability outside of the European Union:
https://en.wikipedia.org/wiki/General_Data_Protection_Regula...
http://slawsonandslawson.com/article-32-the-hole-in-the-gdpr...
https://tinyletter.com/mbutterick/letters/you-re-not-the-bos...
For example, that's what the US is using on Kim Dotcom.
That's not even getting into international pressure levers.
I don't know that we've seen any of those kinds of actions yet, but they're clearly on the table if a company breaking the rules became a real "problem".
The thing is, if you're just completely avoiding doing any business with the EU, having any EU customers or users, and just not touching the EU with a 1000 mile pole and avoiding the GDPR in such a fashion - well, then there's no reason to go after you. The legislation has done its job.
In other words, the EU can attempt to extend its internet regulations over the rest of the world by implementing a China-style firewall. Well, we'll see if that happens.
Here’s a case example, BNP Paribas dealings with sanctioned countries. https://www.wsj.com/articles/bnp-agrees-to-pay-over-8-8-bill...
https://www.privacyshield.gov/welcome
Why any US company would voluntarily agree to this is beyond me, unless one of its EU customers insisted on it.
Here’s a lawyer’s take on this: https://tinyletter.com/mbutterick/letters/you-re-not-the-bos...
Would you like to be a test case for us?
I'd be extremely interested for a company who doesn't operate in the EUs being brought to court and what other countries are willing to help the EU exercise those judgements if any.
On a side note, Germans are obsessed with Clubhouse.
People tend to forget that it is not applicable. For instance nothing I build will ever comply to it regardless of users that might be in europe
Clubhouse has no duty to obey european law
The question is: why do you think the need to be compliant?
For the same reason WhatsApp's new T&Cs don't really change anything for EU users.
However I don't think the collection of contacts is actually illegal under GDPR, considering WhatsApp does exactly this too. And it's huge in Europe, much bigger than in the US. if they haven't gone after WhatsApp for this, they will probably not do so for Clubhouse.
Just like I don't have to comply if I have EU users on a service, I am in the united stated. europe cannot enforce their laws here. It's just the same as if saudia arabia tried to enforce their laws here. They carry no wait
That is what makes the GDPR insignificant. It applies to Europe. Not the rest of the world. The cookie warnings for the vast majority of the internet are stupid an unnecessary
So call it illegal in europe but who cares?
It honestly is maddening how many people care about the GDPR that don't need to
Anyway the EU says it applies but I agree they don't really have much in the way of enforcement capability with companies that have no presence here. Though they could ask Apple/Google to remove it from the store I suppose.
And of course most companies do have a presence here. All multinationals do, and even the smaller ones. Even if it's just a sales office.
How is this GDPR compliant?