IANAL - but with the DPA and other EU data/privacy laws: at the point that the data was collected inside but transmitted outside the EU. Its treated somewhat like an export, or a border control. (this is why Apple allow you to preclude your app from certain local markets; enter the market, and you ARE bound by its laws for your actions in that market)
On the other hand; DPA violation doesn't result in prison, just a (potentially large) fine.
On the third hand, its quite possible that Path did not violate the DPA (although its possible they did). The DPA, in short states that you have to gather personal info for a specific, consensual purpose, and not use it for any other, and also store it in a way that protects it from loss/theft/misuse - where misuse includes deciding 6 months down the line to use it for another purpose. It also means that if your 'purpose' for holding that information ceases, you are legally obligated to purge the data - your legal permission to hold ends.
So; was there consent - almost certainly not, hence possible DPA violation. But once it was clear they had no broad public consent - they immediately purged the data, so possibly no _deliberate_ violation, and certainly a demonstration of willingness to correct the situation.
We live in times where owning a ".com" domain can get you extradited if you don't abide by the law of the US.
I'm not sure of the Data Protection Act has any limitations on which companies it covers, but since Path put an app in the UK App Store (they could have easily excluded it), that would seem to be ample jurisdiction from my armchair-internet-lawyer standpoint.
[For the record, I don't think they should go to jail]
Comments
If Path has violated the UK's Data Protection Act like some stories have mentioned, people from the company should go to jail.
Path is a US registered company with an office in San Francisco. Path is hosted by Amazon out of the US.
At what point does UK law have jurisdiction?
IANAL - but with the DPA and other EU data/privacy laws: at the point that the data was collected inside but transmitted outside the EU. Its treated somewhat like an export, or a border control. (this is why Apple allow you to preclude your app from certain local markets; enter the market, and you ARE bound by its laws for your actions in that market)
On the other hand; DPA violation doesn't result in prison, just a (potentially large) fine.
On the third hand, its quite possible that Path did not violate the DPA (although its possible they did). The DPA, in short states that you have to gather personal info for a specific, consensual purpose, and not use it for any other, and also store it in a way that protects it from loss/theft/misuse - where misuse includes deciding 6 months down the line to use it for another purpose. It also means that if your 'purpose' for holding that information ceases, you are legally obligated to purge the data - your legal permission to hold ends.
So; was there consent - almost certainly not, hence possible DPA violation. But once it was clear they had no broad public consent - they immediately purged the data, so possibly no _deliberate_ violation, and certainly a demonstration of willingness to correct the situation.
We live in times where owning a ".com" domain can get you extradited if you don't abide by the law of the US.
I'm not sure of the Data Protection Act has any limitations on which companies it covers, but since Path put an app in the UK App Store (they could have easily excluded it), that would seem to be ample jurisdiction from my armchair-internet-lawyer standpoint.
[For the record, I don't think they should go to jail]