Must an American company comply with Australian surveillance law? So there is a law called Telecommunications and Other Legislation Amendment (Assistance and Access) Act 2018 that was recently made law in Australia. From what I have heard about it, it allows the government to demand that you break security if requested. So what if your company provides end to end encryption (e.g. Whatsapp), is based in America, and just ignores the Australian court order? What can Australia do to you if you keep your money outside of Australia?
Yes, if ... ... they are a ‘designated communications provider’ conducting ‘ eligible activities’ under s317C. Your example, Whatsapp is one under item 4. If they refuse to comply they can be subject to financial penalties. If they refuse to pay the fines they can have their assets that are subject to Australian jurisdiction seized - this includes money in accounts held by third parties like MasterCard, Visa and PayPall. The could also seek to have orders and judgement debts given by Australian courts executed by US courts. They would be successful unless the judgement violated US law - the first and fourth amendments spring to mind.
Why would the EU expect that any of its laws would apply to my business? It doesn't. Unless you choose to do business in the EU (which is possible, thanks to the wonders of the World Wide Web). Then, and only then, do you have to comply with EU law, including the GDPR. From a comment by @BenCollins: I'm talking about non-EU online retail that does allow Europeans (particularly those not actually in the EU at the time of the transaction) to place orders. Basically, GDPR Article 3 says that the GDPR applies to the processing of personal data of data subjects who are in the Union The phrase &quot;in the union&quot; is clearly open to interpretation, but according to the website Security Now, Dr. Michèle Finck says this: Most people seem to agree that the relevant criterion is whether you're based in the EU at the moment data is collected - citizen or not (my emphasis). While Michèle Finck is a well-respected legal scholar, she is not an authoritative legal source, so we need to wait for to case-law to nail this. For what it is worth, (not much I am afraid) I think it would be against common sense to define the territorial scope so broad that brick and mortar stores in the USA risks to be prosecuted in Europe if they sold goods or services to European tourists. However, what most US based businesses that chooses to be open to business for orders that are placed by natural persons who are in the [European] Union need to know that there is this: According to European law, the GDRP does apply to them when they conduct such business. From a comment by @BenCollins: I question the notions that (a) there is a basis by which the law would apply The legal basis is European law, in particular GDPR Article 3. and (b) that it has any enforcement mechanisms outside the EU. As for enforcement, I think a good answer has already been provided by Dale M. but for completeness: The USA has treaties with EU that mean that after a legal case has been decided in a court of law in the EU, it can request that the USA enforce the judgement (typically by collecting the fine the USA-based business incurred when conducting business in Europe). To make this answer more general, here are a breakdown of the the regulation of territorial scope of the GDPR for businesses that are not located in the EU: The scope is clearly spelled out in Article 3, and if you're not &quot;a controller or a processor in the Union&quot;, you are only subject to the GDPR if your processing activities are related to: a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or b) the monitoring of their behaviour as far as their behaviour takes place within the Union. US based companies that engage in business practices that are illegal in Europe know about this, and has already taking steps to protect themselves from the being prosecuted in Europe under the GDPR by using firewalls to block access to their services from the EU. The bottom line is that if you: have no presence in Europe, and don't offer goods or services to people who are in the Union, and you don't collect personal data about European natural persons, then the GDPR does not apply to you. If at least one of the above applies then you need to follow the GDPR if you do not want to be prosecuted in the EU.
Your VPN scenario is why you have to show the banner to everyone. If you somehow knew beyond any doubt that someone was not in the EU, then you would not have to show a banner, but because you can't verify that, you should always show the banner. Doing so also protects against accidentally violating a similar law in another country; the GDPR is the best-known privacy law, but it is far from the only one. It's good practice to ask for people's permission before collecting their information anyway.
A statutory instrument that exceeds the limits of the enabling Act is void. For example, an Act that enables the executive to make regulations about companies would not support a regulation that purported to affect companies and partnerships. There are two controls in place: regulations must be tabled in Parliament and any MP can call for the regulation to be debated and voted down. anyone affected by the regulation can go to court to oppose it - there are lots of things they can argue including that the regulation overreaches its enabling Act.
There is no constitutional requirement that Congress provide copyright protection in the US. Congress could, if it so chooses, repeal Title 17 of the US Code, and afford no copyright protection whatsoever. Given that the US has protected copyright from its earliest days, that copyright protection in English law dates to the 1600s, that almost every nation currently has a Law protecting copyright, and that such protection is a requirement of membership in the World Trade organization (WTO) I find it highly unlikely that such a change in the law will be made in the foreseeable future. But Congress does have the power to abolish copyright in the US.
No, it's not legal. The General Data Protection Regulations (GDPR) apply given that you are in the UK (regardless of where the Data Processor is based). The UK GDPR is slightly modified due to Brexit, but the same principles apply. The only plausible legal basis for this actions would be that you consent to it, and you're entitled to withdraw that consent at any time. Some may claim that Article 6.1(b) applies, i.e. that it's necessary to send marketing email in order to fulfil the contract, but GDPR is clear that bundling such consent into a contract for service simply to permit the data processor additional actions isn't allowed, as I'll demonstrate. UK GDPR requires that consent to use your personal information (in this case, your email address) for the stated purpose be freely given. Consent to use your information for direct marketing is not freely given if it's inseparable from the consent to use it for some other service, as per para 43: Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance. And Article 7.4 backs this up with When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract. The intent of Article 6.1(b) is that only the processing required for the service you have bought is allowed (e.g. if you supply your address for delivery of stuff you've bought, the data processor can use that address to send you the stuff, but is not allowed to add a contract term that allows them to send you unwanted stuff). Examples of emails that Article 6.1(b) would allow (in my assessment) include things such as notification of upcoming downtime, or a reminder that subscriptions are due, but not unsolicited advertisements for other products. There's a grey area that's open to interpretation, where adverts are piggybacked onto actual service messages.
It's not legal The terms that you agree when you enter a contract can only be changed if: the contract provides for variation of its terms and then, only in accordance with that procedure. This may allow unilateral changes - these are common in ongoing relationships like telephone and ISP contracts but it appears from the Kickstarter page that this was not the case here. the parties agree to vary the contract either by deed or by another contract. If by deed then the law of making deeds must be followed, if by contract then the laws of contract must be followed. You mention &quot;around $70AUD&quot; which leads me to guess that you are in Australia. If you were there when you entered the contract then the Australian Consumer Law will apply to the transaction and, more generally, to William Painter since they explicitly &quot;do business in&quot; Australia because they ship there. It is illegal to make misleading and deceptive claims under the ACL and the fines can be huge. Perhaps a note pointing this out to them and letting them know that if they waive their fees in you case(s), you wont feel the need to report them to the ACCC.
The main problem is that there is no court with authority to hear this case outside of China. It may be futile to sue in US courts, since China will not enforce US judgments. You can sue a Chinese company in Chinese court, under their Civil Procedure Law, but this pertains to contract breach. The question is whether there is any law under which the government of China can be sued for negligence – it is unlikely that that is possible (perhaps there is an expert in Chinese law here who can address that issue). This lawsuit is filed in US courts. It is based on the Foreign Sovereign Immunities Act. Supposing that this lawsuit is successful in US courts, then the question is what enforcement actions are possible. Since the defendants are various governments and government agencies in China, execution of the judgment would have to be against those defendants – you can't seize the assets of every person with some connection to China. But given the nature of the Chinese government, it is possible that US courts could find that the assets of Chinese companies are effectively government assets. The short answer is, in fact a lawsuit has been filed, and I expect more. I also don't expect them to succeed in the long run.