The far, far more likely outcome if they can’t sustain a profit is that they’d be acquired.
Take for example Google Photos. I find it very unlikely that Google is making money off of it. What revenue they do have comes from storage, which is subsidized by the scale of the rest of the company.
On its own, though, Google Photos has a lot of data: who you were with, what products are in your home, where you were when you took those photos. Right now, Google doesn’t do anything to monetize the content of those images; it would be too much reputational damage and they already know enough about you from other signals.
But what if Google Photos were a stand-alone business? What if they were acquired by Epsilon or Oracle America? There are companies that are way worse on privacy than Google. They would have no qualms at all about taking your entire photo archive and adding to the profiles they sell.
Google has to follow European laws to sell anything or provide any services in Europe, even if it has no European entity. The EU would block payments otherwise.
Americans, Canadians and everyone else should get better laws enacted. EU legislation is to protect EU citizens, and the wellbeing and privacy of citizens that are not from a Member State are not a concern beyond sanctioning crimes against humanity. Case in point, it is perfectly legal for US government agencies to pay EU companies to spy on US citizens in ways it would be illegal for the US government to do, while it would not be legal in the inverse.
My simple point however is that a big Google is probably more (not less) likely to be compliant with GDPR. Breaking up one big badly behaving company may have the unintended consequence of creating a multitude of small, even worse behaving companies.
Don’t be so sure, for example, that if the (likely) two dozen or so employees working full time on Google Photos were their own business, with a need to show a profit, that they wouldn’t just sell that data immediately. There would be no nexus outside of Mountian View for foreign regulators to even intervene with then; it would be a small business.
That’s the point, the EU will absolutely go after the Mountain View nexus just the same as it went to get fines from Swiss banks for example.
The US is generally compliant with it, but even if it’s a no-so-friendly country, EU authorities recover money all the time for fines not paid by Arabs for example by incassoing it through SWIFT, as in for example the Dutch Centraal Justitieel Incassobureau has full rights to take money out of SWIFT connected bank accounts unilaterally, and that includes US banks and even most Arabic ones.
It usually never comes to that as US courts do enforce EU fines just as EU courts do help the US recover their stuff.
But stepping back, are you just making the argument that vertically integrated monopolies shouldn’t be broken up as small companies don’t have to or won’t follow the law?
I think you underestimate how many small, long tail businesses are non-compliant with GDPR. For that matter, there are probably quite a few in Europe.
Big companies can’t afford the liability of GDPR non-compliance. Small ones, like those created by breaking up Google, will treat compliance as a “nice to have.”
The far, far more likely outcome if they can’t sustain a profit is that they’d be acquired.
Take for example Google Photos. I find it very unlikely that Google is making money off of it. What revenue they do have comes from storage, which is subsidized by the scale of the rest of the company.
On its own, though, Google Photos has a lot of data: who you were with, what products are in your home, where you were when you took those photos. Right now, Google doesn’t do anything to monetize the content of those images; it would be too much reputational damage and they already know enough about you from other signals.
But what if Google Photos were a stand-alone business? What if they were acquired by Epsilon or Oracle America? There are companies that are way worse on privacy than Google. They would have no qualms at all about taking your entire photo archive and adding to the profiles they sell.
And the same authority that would have broke up Google has to approve the acquisition. They most likely wouldn’t.
That’s not something that they can do under EU law.
Why not? It wouldn’t create a monopoly.
And EU law applies only with regard to Europeans. And European companies.
That AND in there is an OR. It definitely applies to American companies selling to EU customers.
And well to be honest, it’s not the EU’s fault other countries are not enacting reasonable privacy or market regulations.
Google is big enough to have a nexus in Europe. I wouldn’t assume that for its long tail of products.
Either way, Americans, Canadians, etc could be concerned with their privacy issues.
Google has to follow European laws to sell anything or provide any services in Europe, even if it has no European entity. The EU would block payments otherwise.
Americans, Canadians and everyone else should get better laws enacted. EU legislation is to protect EU citizens, and the wellbeing and privacy of citizens that are not from a Member State are not a concern beyond sanctioning crimes against humanity. Case in point, it is perfectly legal for US government agencies to pay EU companies to spy on US citizens in ways it would be illegal for the US government to do, while it would not be legal in the inverse.
Better laws are indeed needed.
My simple point however is that a big Google is probably more (not less) likely to be compliant with GDPR. Breaking up one big badly behaving company may have the unintended consequence of creating a multitude of small, even worse behaving companies.
Don’t be so sure, for example, that if the (likely) two dozen or so employees working full time on Google Photos were their own business, with a need to show a profit, that they wouldn’t just sell that data immediately. There would be no nexus outside of Mountian View for foreign regulators to even intervene with then; it would be a small business.
That’s the point, the EU will absolutely go after the Mountain View nexus just the same as it went to get fines from Swiss banks for example.
The US is generally compliant with it, but even if it’s a no-so-friendly country, EU authorities recover money all the time for fines not paid by Arabs for example by incassoing it through SWIFT, as in for example the Dutch Centraal Justitieel Incassobureau has full rights to take money out of SWIFT connected bank accounts unilaterally, and that includes US banks and even most Arabic ones.
It usually never comes to that as US courts do enforce EU fines just as EU courts do help the US recover their stuff.
But stepping back, are you just making the argument that vertically integrated monopolies shouldn’t be broken up as small companies don’t have to or won’t follow the law?
I think you underestimate how many small, long tail businesses are non-compliant with GDPR. For that matter, there are probably quite a few in Europe.
Big companies can’t afford the liability of GDPR non-compliance. Small ones, like those created by breaking up Google, will treat compliance as a “nice to have.”