The legislation has clearly been dreamt up by folks saying “ah ha! if we threaten the Facebook UK executive mangement team with jailtime unless they do better at filtering self-harm/CSAM/terrorism/etc then they will obviously get their house in order!”. Whereas in practice they crush their own UK-based startups instead. So frustrating.
Isn’t that exactly what the GDPR did? I know I pulled my apps for fear of fines and jailtime that might lead to the first country Im not allowed into.
Whereas the OSB is: “if you run a service which lets users distribute ‘harmful’ content, then you’ll get pulled up in court. Plus it’s up to you to figure out what ‘harmful’ is; you’ll know it when you see it.”. Which sounds like the opening premise of a Black Mirror episode.
You're coming at it from a position of knowledge and confidence. The guide produced by the Information Commissioner's Office for organisations has 48 sections/pages [1] and features a toolkit with 7 different self assessment quizes [2], plus an extra one to help small businesses [3]. Even the "What is personal data?" section of the site alone contains dozens of pages [4]. And obviously the regulation itself is pretty verbose [5].
Given the legal ramifications, it's a bit dismissive to say it just boils down to three phrases. Whether or not GDPR is reasonable (and I agree that it is), it's perfectly understandable that sole traders and small businesses are concerned about the resources required to understand and implement it - especially when even many large organisations currently flout it (through ignorance or negligence).
[1] https://ico.org.uk/for-organisations/guide-to-data-protectio...
[2] https://ico.org.uk/for-organisations/sme-web-hub/checklists/...
[3] https://ico.org.uk/for-organisations/sme-web-hub/checklists/...
[4] https://ico.org.uk/for-organisations/guide-to-data-protectio...
My whole point here is that the Online Safety Bill cannot be practically implemented by anyone other than massive businesses, and even then it implicitly requires massive privacy violations. Which puts in a completely different class of problem to implementing GDPR.
If you do this an executive and not try to circumvent or game this (like with taxes), there should be no jail time for you.
[1] not that I do like giving that power to content-auditing-companies.
With GDPR on the other hand you can't use any US company with your customer PI data in the US and US companies hosting in the EU is a gray zone [1].
It is a challenge to find equivalent companies in the EU, e.g. good luck finding a equivalent competitor to Unbounce or Webflow. It works for MailChimp (e.g. Sendinblue) and ZenDesk, but not for some other dependencies you might have.
[1] https://en.wikipedia.org/wiki/CLOUD_Act rejections by companies need to be tested in court
For the proposed content moderation it is pretty much impossible.
It's kinda like making a law that says you cannot make inappropriate jokes in front of the police. Who the hell gets to decide what is inappropriate? It's intentionally left vague to make everyone guilty and allow for selective enforcement.
I found some areas particullary hard. Legitimate interest is a minefild and mostly can't be used, except e.g. delivery addresses. Finding GDPR compliant companies - with the US out of question - was also hard. Tracking and deleting data on request when storing in dozens of systems was hard - even returning all the data stored in dozens of external SaaS companies was hard (logging what you send them helps here, but doesn't address their tracking generation). They often don't give you everything you store with them back - deletion is often much easier. Tracking data in backups that needed to be cleaned on restore due to deletion requests was difficult to implement - easy in one, complicated in dozens of systems. Especially hard with AWS.
These are the most challenging I had on hand when implementing GDPR.
Deleting people's private data upon request, namely when they click a button -- in my case (unlike yours) there's not many places to delete the data from.
The most challenging thing is instead writing a DPA, and wondering what to write about inspections and auditing, in a remote only company with servers in the cloud (any thoughts about that?)
I would assume special companies will arise that do the auditing for you - and that work with AWS and GCP for you.
I think so too -- I had a look at Google's DPA and it seemed to me that when one agrees to Google's DPA, one agrees to trust some Google approved companies to do the auditing for everyone (for all Google cloud customers). Maybe there's not any other way to make it work (it'd be crazy with random people in their datacenters "auditing" things)
On the face of it they seem to have support for the required stuff: https://mailchimp.com/gdpr/
https://edpb.europa.eu/news/national-news/2021/bavarian-dpa-...
The core: ... transfers of personal data to the U.S.- were not lawful.
So the problem is that an US company cannot be GDPR compliant, because that conflicts with US law. Which sucks for mailchimp but makes sense.
> Mailchimp may in principle be subject to data access by US intelligence services on the basis of the US legal provision FISA702 (50 U.S.C. § 1881)
It might not be just a matter of where the data is stored, but also who can get access to it. From my reading, any US based conpany would be affected.
This feels like a super huge impact that would have made more waves, but the ruling also seems recent. And perhaps there will be more twists and turns yet ?
As described in the Wikipedia article, the contract has been thrown out by the European Court of Justice for exactly the reasons stated by the parent comment.
> [Standard contractual clauses] do not necessarily protect data in countries where the law is fundamentally incompatible with the Charter of Fundamental Rights of the EU and the GDPR, like the US.
Actually since the 2018 Cloud Act, no US company can be ever be GDPR compliant.
Here is a possible sequence of events:
1. the US has secret courts (FISA, 1978)
2. and these courts can insist on access to EU hosted data (CLOUD Act, 2018)
3. its illegal for a US corp to indicate whether such access has been demanded
4. so a FALSE 'no' must be the answer to an EU data subject asking about access to his/her data
5. which is a breach of the GDPR.
Everyone knows this. They just ignore it. The EU ties itself in knots (Schrems II) trying to justify all of this.
I thought that I understood GDPR at least reasonably well: be specific about what data you collect, don't collect unneeded data, allow deletion of data, and a couple other minor caveats. But if I sell software in multiple countries, and part of my account process is collecting an email address or other PII, is that not GDPR compliant unless I set up offices in the EU?
That can't possibly be what the law actually says; nobody except the biggest US companies would be able to do any business online with EU customers if that was the case. What am I missing?
If you're an US company you would at least need to setup a independent EU subsidiary that you do not directly operationally control (perhaps owning shares works).
Sublime Text 4 just came out. That's based in Australia, where courts have similar data access, including the ability to require companies to circumvent encryption. Part of the purchasing process requires providing an email and other billing information.
Is it legal to sell Sublime Text 4 to a European? If Sublime Text was based in the US, would it be legal to sell it to a European citizen? What you're implying is that the EU can't legally have access to the majority of US-based Internet services, and that just seems so extreme that I feel like I wouldn't be hearing about it on Hackernews if that was the case.
But I don't know, I can't really confidently say you're wrong. Maybe it's just been under-covered, or I'm just not paying attention to the right news sources. At the very least, this can't apply to business-necessary information, right? Otherwise, it seems like you're saying that EU data in general can't be legally exported from the EU to most of the world, which seems like it would be a massive problem for the majority of the software industry.
There are a lot of software services based in countries with intrusive government data access: Fastmail (Australia), DuckDuckGo (US), Github (US), Itch.io (US). You're claiming EU residents don't legally have access to them? Again, I don't have any basis to argue that you're wrong, it's just... why wouldn't that be covered on basically every single tech blog if that was the case?
If the EU customer is a company and not a private citizen and if it does involve storing personal information of the EU customer customers.
"What you're implying is that the EU can't legally have access to the majority of US-based Internet services"
No. You as an EU company can't transfer customer data to or redirect customers to US companies in a legal way.
"Otherwise, it seems like you're saying that EU data in general can't be legally exported from the EU to most of the world"
It depends on who does the "exporting" and what the "exporting" includes. But in general yes, it can't if the citizen whos data is exported can't be guaranteed to have the same rights as with the data in the EU. That is the core of it, Facebook can't offer a website in the US that is open to the EU and take information on the website "exporting" the data by POST HTTP requests to it's servers in the US (which they don't because Ireland, but in general yes).
There is much more to it, like "Can I store customer data in Google for Business spreadsheets?"
You're probably fine with Gmail because people know that this is an US company and sending an email to an US company is something a EU citizen might want to do. It's not as clear with Fastmail. It's not clear at all if you use custom domains with both. If you use a custom domain, where the customer can't see that it's outside the EU, do you export email addresses outside of the EU e.g. to Australia? But data protection agencies in the EU will take some more time to arrive at all these finer nuances. For now they are focused on Facebook and Google, and in 2021 went one level deeper with acknowledging that it's illegal to use Mailchimp in the EU (currently, I assume Mailchimp will create an EU legal entity and host EU data in the EU in the future when pressure rises).
For large enterprise that have subsidiaries in the EU it's already illegal to transfer EU employee data to the US for processing.
"You're claiming EU residents don't legally have access to them?"
As an EU citizen you can do whatever you want with your data, so "EU residents don't legally have access to them?" is misleading, because it would not be illegal for the citizen but - if - for the company. The company has a problem if it can't prevent three letter agencies from accessing the data. If you have no assets in the EU and do not plan on visiting the EU there is not much to fear though probably. I think it might be legal - not sure I've read something about it - to process data e.g. as a hotel for EU tourists, if you delete the data afterwards. Yes the GDPR is broad.
"But if I sell software in multiple countries, and part of my account process is collecting an email address or other PII, is that not GDPR compliant unless I set up offices in the EU?"
If you sell drugs to the US you're in trouble, even if it is legal to sell drugs in the country you live in.
You as a US company probably can sell to EU citizens but IANAL. The bigger problem for the EU if you sell to EU citizens from the US is VAT. If you send physical goods then your customer needs to pay VAT at customs - as many people in the EU found out after Brexit, if you send digital goods then the customer usually doesn't pay VAT. This is what agonizes the EU more than the GDPR and is the base for France to charge digital taxes to US companies.
"I wouldn't be hearing about it on Hackernews if that was the case."
Well I've lost 100+ karma for pointing out in the last years that it is illegal for EU companies to use Mailchimp. Today is the first discussion where people agree - still I lost 10 karma.
VAT might be annoying in the sense that it forces me to ask for an address if I'm selling software to someone who lives in the EU, but that's basically fine. I can do that as a US company, and I can pay higher taxes, that's not a problem.
But if I'm building a software company, I don't have the resources to set up a foreign company to handle everyone in the EU who wants to buy a copy of my software. In practice, that requirement would mean that most single-person software teams outside of a few allowed countries can't sell to the EU.
Eventually you just get a lawyer to answer questions like these, but it does kind of sound like if I'm understanding you correctly, I should just be excluding any EU residents from buying anything I make regardless of the privacy policy, unless I have a zero-knowledge product. Which... being zero-knowledge is tricky because VAT exists, and I don't think I can not collect EU resident billing addresses and still pay taxes in an auditable form.
Maybe that's fine though, maybe that just means in practice you have to contract billing to a company that has an EU office, and then the problem is gone.
I should have phrased this differently, I know that GDPR doesn't constrain what EU residents do. But in practice it doesn't really matter to me if it's legal for them, it matters to me if it's legal for me. I don't know, apparently I need to do more research on this.
Interesting though, I appreciate you taking the time to elaborate.
This looks like a pretry fresh ruling judging from the date of the article, good to know.
This is completely not true. First, most US companies are GDPR-compliant because they don't gather, store and process personal data of EU citizens. Now, those that do - mainly Internet companies - they need to abide by the terms of the GDPR (or not to serve EU customers, which for some is the easiest way - like New York Daily News). If you decide to store personal data of EU citizens, you need to do it using servers located in the EU, which, depending on the nature of your business, might or might not be easy, but companies had several years to prepare for that. There is no any conflict with US law anywhere.
Personally I was in a similar position and instead of choosing Mailchimp I choose Mailerlite, which is Europe-based and, being less popular than Mailchimp, (much) less expensive for the customers I have (with mailing lists in the range of 5k-50k contacts). It has its quirks but it works and I have no much reasons to complain.
As someone who implemented it in several companies, I don't like it because it hits smaller companies much harder than bigger ones, and because it tries to be technology agnostic it is quite fuzzy, compate to something like SOX or PCIDSS (which I also implemented as CTO). In Germany at least data protection agencies declared they will go after companies that use e.g. Mailchimp.
Maybe you were handling personal data correctly. Very many were not (witness numerous data breaches and private data exploited that was held for no reason). Therefore regulation was needed.
> We need more competition
Competition is good. A race to the bottom is not.
It also could’ve been implemented in such a way where there were no required new positions and the gov spent tax dollars to write a greatly detailed dummies guide to GDPR, how to implement it, etc so that smaller companies without the resources would have just as much of an advantage.