Why do VISA and MasterCard comply with U.S. sanctions that erode their business? On what basis does the U.S. government prohibit American companies like VISA, MasterCard, PayPal, et al, from doing business on the Crimean Peninsula? Crimea is connected with, and backed by, the whole of Russia, which in turn is connected with China, with both being part of BRICS. The fact that Visa and MasterCard could not be used all across Russia would naturally make Russian banks start transitioning to more friendly payment processors like Sberbank's Pro100 and China's UnionPay. This, in turn, will simply erode the influence that American companies have across the whole of Russia (and also across the globe as more people switch to UnionPay, which is nowadays accepted in a whole lot of places including America), not simply the small area actually subject to the sanctions. Aren't all of these companies like VISA and MasterCard actually incorporated in the Bahamas, etc., anyways? Why do they comply with the request for sanctions? What would happen if they don't comply? What would they have to do to not be legally required to comply? See also: http://www.bloombergview.com/articles/2014-05-06/the-biggest-loser-from-russia-sanctions-visa The Chinese experience inspires Putin's advisers: UnionPay, whose cards are accepted in 135 countries, is now bigger than Mastercard and second only to Visa in processing volume.
Visa is incorporated in Delaware. So is MasterCard. In addition, both are headquartered in the US, have huge quantities of assets in the US, do lots and lots of business in the US in a highly regulated sector, and their very existence depends on their ability to interact with the US banking system. The US has the authority to regulate all of these things, under literally any definition of sovereignty. Therefore, they must comply with sanctions.
It’s legal under Ukrainian law for foreign nationals to join their defense forces Indeed, this is so common it may be considered the default position internationally: the US, UK, France, and Australia just to name a few all allow this. Generally, it’s usually legal for a citizen to join the army of a foreign state. It is usually not legal to fight for a non-state actor this is where fighters for ISIS are in trouble. Where issues arise is if they take up arms against the country of their citizenship. That’s called treason and it usually attracts the most severe punishment available: death or life imprisonment typically. So, as long as you aren’t Russian and are not from one of the few countries that prohibits foreign military service, there are no legal issues.
Your VPN scenario is why you have to show the banner to everyone. If you somehow knew beyond any doubt that someone was not in the EU, then you would not have to show a banner, but because you can't verify that, you should always show the banner. Doing so also protects against accidentally violating a similar law in another country; the GDPR is the best-known privacy law, but it is far from the only one. It's good practice to ask for people's permission before collecting their information anyway.
There is no provision allowing monopolization "for the good of the consumer", regardless of your standards for judging that. The law simply says Every contract, combination in the form of trust or otherwise, or conspiracy, in restraint of trade or commerce among the several States, or with foreign nations, is declared to be illegal. It is not clear what actually counts as a violation is the law: it's not the fact of being the only game in town, per se, it's what you do that might bring that about, it's doing so through improper means. The Dept. of Justice, which may prosecute a case, has guidance on what the law could mean, in particular, the willful acquisition or maintenance of that power as distinguished from growth or development as a consequence of a superior product, business acumen, or historic accident As you describe it, this is a clear violation of the law. "Noble intentions" is not a valid defense to prosecution. However, prosecution is discretionary, so a favorable government could reach an agreement to not prosecute, as was the case with AT&amp;T (before WWI, not the breakup). Further however, under 15 USC 15c a state attorney general can also bring a civil suit against a monopolizer, so you'd have to get a lot of agreement to not take legal action.
You're completely misreading the goals and purpose of the Export Controls Office - Overview. They regulate the transfer of US regulated information and technology, commodities, and software in the interest of national security and economic growth. Transfer and export are not the same as the use of technology that personal devices contain. The simplest thing to do is simply call the Export Controls Office, and they will explain the difference, and tell what you need to do and what is not required of you when traveling. Some countries do prevent the use of some personal tech or Apps, i.e. Russia and Signal, the encrypted phone app; but that has nothing to do with UC.
The constitution does not actually forbid "abusing a position for financial gain", and thus it is left to the political process to address any such actions (voting for a different candidate), or the legislative process (defining certain acts as forbidden) – or, the impeachment process. The court system in the US does not have the power to decide on their own what politicians can and can't do, if there is no underlying law. It is within congressional power to define limits on the act of any politician, for example Congress could pass a law requiring the President and Vice-President to have no business interests or stocks during their term of office; they could require that of cabinet members or members of Congress. Such a law would, of course, either require presidential approval or else sufficient support in the houses of congress to override a veto. There are various limits on what government folks can do. 18 USC 202(c) is an example of a limit on the limits: Except as otherwise provided in such sections, the terms “officer” and “employee” in sections 203, 205, 207 through 209, and 218 of this title shall not include the President, the Vice President, a Member of Congress, or a Federal judge It is possible that a president could engage in a criminal act such as theft, and that is not permitted and would be grounds for impeachment. The president does not, however, have the power to e.g. unilaterally send all government hotel business to a certain hotel company, nor can he declare that 10% of all government expenditures must be deposited in his personal bank account, so the mechanisms whereby corrupt rules of certain other nations can get away with that is that those executives have vastly more power in their countries than POTUS does. With congressional support, though, such acts could come about. If it did, it would not be too surprising if SCOTUS ruled based on common law and considerations of justice that such a law / act was illegal, but it would not be a textualist argument.
Maybe this changes something, maybe not. But at first glance, yes, avoiding US-based vendors does help comply with Schrems II. They need not be EU-based. Definition of an international data transfer The GDPR unfortunately does not define what an international transfer is, and just explains when they may be lawful: Art 44: Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country […] shall take place only if, subject to the other provisions of this Regulation, the conditions laid down in this Chapter are complied with by the controller and processor, including for onward transfers of personal data from the third country […] to another third country […]. […] This has been interpreted, in particular by the official EU SCCs and by EDPB guidance, to imply two roles: the data exporter, and the data importer. Per those EDPB guidelines, a transfer occurs when three criteria are fulfilled together: The data exporter is subject to GDPR (e.g. as a controller via Art 3, or as a processor via an Art 28 data processing contract). The exporter discloses or makes available personal data to the importer. The importer is in a &quot;third country&quot; (for EU GDPR: anything outside the EU/EEA). Note that these importer/exporter aspects are independent from roles like &quot;controller&quot; or &quot;processor&quot;. It also does not depend on where in the world the exporter is situated. Applying this to your scenario How does this apply to your scenario? I am assuming Alice Inc is subject to the GDPR (criterion #1). Now, Alice Inc can process personal data, and that's not an international transfer, even if Alice Inc is in the US (or any other third country). The general GDPR rules apply, such as the requirement to implement appropriate technical and organizational measures to ensure compliance and security of processing operations. If Alice Inc engages data processors to process personal data on Alice Inc's behalf, then this would fulfil criterion #2 (disclosure to a third party). For example, hosting providers generally act as data processors. Any other kind of data sharing (e.g. to other data processors) would also fall under this category. Tricky in an US context: while employees would be agents of Alice Inc and would not be separate recipients, contractors/freelancers would also be potential data importers. If those data importers are based in the EU/EEA, then criterion #3 is not fulfilled and there's no international transfer. For example, using an EU-based hosting providers would sidestep Chapter V of the GDPR completely. If those data importers are based outside of the EU/EEA, then criterion #3 is triggered and we have an international transfer. Lawfulness of international data transfers When there is an international transfer, it must be adequately protected. In order of decreasing priority: country has an EU adequacy decision appropriate safeguards for a group of companies: Binding Corporate Rules (BCRs) Standard Contractual Clauses (SCCs) Art 49 specific situations What SCCs and BCRs do is to translate enough of the GDPR from statutory law into a contract to ensure adequate protection. But to be effective, they must actually be enforceable, and the data importer must actually be able to comply with those rules. In Schrems II, the CJEU found that the US (at that time) did not offer an adequate level of data protection, and that SCCs are probably invalid as well since importers cannot comply with both the SCCs and with US surveillance laws. Before using SCCs, it is effectively necessary to perform a transfer impact assessment (TIA) analyzing, among other things, the legal context of the importer's country. It may be possible to defuse this, for example by using supplemental security measures like end-to-end that prevent unlawful use of the data even if it falls into the wrong hands. However, such measures also tend to prevent intended use, especially in a cloud context. In the DPC Ireland decision against Meta Ireland (PDF), the DPC finds: 7.202 In summary, therefore, I am satisfied (and I so find) that: (1) US law does not provide a level of protection that is essentially equivalent to that provided by EU law; (2) Neither the 2010 SCCs nor the 2021 SCCs can compensate for the inadequate protection provided by US law; and (3) Meta Ireland does not have in place any supplemental measures which would compensate for the inadequate protection provided by US law. 7.203 Accordingly, in making the Data Transfers, I find that, subject to the analysis contained at Section 8 below, Meta Ireland is infringing Article 46(1) GDPR. Implications of using non-US vendors As already mentioned, using EU-based data processors avoids the international transfer problem due to the way how international transfers are defined. Even if an international transfer occurs, that might not be a problem. Some countries have an EU adequacy decision, for example Canada, Israel, or South Korea. While there would nominally be an international data transfer that needs to be disclosed e.g. in a privacy notice, there is no additional bureaucracy required. In other countries, transfer tools like SCCs might work. A TIA might show that that the issues discussed in the Schrems II decision and the DPC decision wouldn't apply there. But isn't that a contradiction? You correctly point out a problem with the GDPR's approach to data transfers: This would however have little effect on the access to the data, in that if US law enforcement turned up at the offices of Alice Inc. they could be required to hand over the data and their access to the data will not be changed in any way by the location of the web hosting. Yes, this is arguably a loophole. However: If the US-based Alice Inc is a data processor in behalf of another controller, that controller would likely be violating the GDPR by transferring personal data to Alice. If Alice Inc is a data controller: while this might not be a violation of the Chapter V rules on international data transfers, such a scenario could be argued to be an Art 24 or Art 32 violation instead (requirement to ensure compliance and security). When Alice Inc transfers personal data to data importers, that is less visible to data subjects, and outside of their immediate control. However, when Alice Inc collects data on data subjects, that is more visible to data subjects, in particular through an Art 13 or Art 14 privacy notice. That notice must also contain the identity of the data controller, which would disclose that Alice is US-based, which may enable to data subjects to make more informed choices. This won't help Meta While moving to non-US data processors can be a sensible compliance approach for many companies, it is less useful for multinationals like Meta. In this context, Meta is an Irish data controller who engages platform and development services from an American company. Even if Meta Ireland tries to perform all GDPR-covered processing activities outside the US, it's actual corporate structure situates some processing activities such as administration tasks in the US and other third countries. If my above analysis is correct, it would have been easier for Meta to comply with GDPR if the US-based Meta company were the data controller.
The original order was recently extended: that order relied on the International Emergency Economic Powers Act (50 U.S.C. 1701 et seq.), the National Emergencies Act (50 U.S.C. 1601 et seq.), and section 301 of title 3, U.S Code. The order does not specifically mention Huawei, but the inclusion of Huawei is a result of determinations by the Secretary of Commerce (Secretary), in consultation with the Secretary of the Treasury, the Secretary of State, the Secretary of Defense, the Attorney General, the Secretary of Homeland Security, the United States Trade Representative, the Director of National Intelligence, the Administrator of General Services, the Chairman of the Federal Communications Commission, and, as appropriate, the heads of other executive departments and agencies This is analogous to orders to not trade with Iran. If business X has absolutely no connection to the US, then an order for X to not do business with some other entity is effectively unenforceable. However, TSMC does do business in the US, for example is is listed on the NYSE, and it does business with many US companies. Jurisdiction exists when a government claims jurisdiction. Enforcement exists where a government can force its will on others, the US can’t enforce its will on China or Huawei but it can on companies operating or based in the US.