If Klout are collecting and storing data on UK individuals, they are subject to UK data protecction law. The ease of enforcing that if they don't have a UK operation is another matter, but they are still interacting with UK users in a way which triggers UK rights under UK laws, with which UK courts could require them to comply.

I don't know. When were they forced to?

So my understanding is what klout does is 'fine' for US users, but gathering data on UK/EU users is subject to EU data protection laws.

And of course, IANAL

Using that analogy, then it would be Stross the one committing the offense, not Klout?

So my understanding is what klout does is 'fine' for US users, but gathering data on UK/EU users is subject to EU data protection laws.

That would be the same as it being illegal for a US site to distribute pornography to a person in a country where it was illegal.

The fact is, unless Klout is hosted or incorporated in the UK or EU, the latter have no jurisdiction over the company, and such their laws don't apply.

Try telling that to the US government, which hounds internet gambling sites wherever they're based.

The issue of territorial jurisdiction and law on the internet is a really complex one, and much more so when you deal with a fundamental mis-match between legal systems (the EU constitutional-level right to privacy vs. the US lack of same).

So, in effect, you're arguing that it's perfectly legitimate for the US government to do this?

Law gets really complicated when you cross international boundaries, and usually everyone involved will assert their right to impose laws on you, and whether they actually do this mostly depends on how easy it would be for them to do it.

If you base legal decisions about your business on abstract principles, you might just get detained the next time you route through an airport that belongs to someone you've mightily pissed off. Generally, it's smarter to strive for not offending anyone, or if you cannot manage that, strictly not visiting or in any way depending on countries whose laws you might have broken. For example, if your site is not strictly legal under US law, don't host in under .com.

Jurisdiction is up for the court and legislative to decide.

I do believe that UK courts will assert jurisdiction in cases such as this. UK courts certainly do assert worldwide jurisdiction in other situations - one of several reasons why UK courts are so popular for people who wish to sue for libel, for example.

All I can say is as a UK resident I feel like UK data protection laws should protect me from a company like this no matter where they are based.

Entirely untrue. Jurisdiction is a legal term. If a matter directly affects UK citizens in the UK it's very clear that a UK court will consider itself to have jurisdiction over that matter.

The actual reach of the court's power is a different matter. If the offender has absolutely no assets in the UK, and no intention of ever having them, and lives in a country with no extradition treaty with the UK, then perhaps the UK has no ability to punish them. I do not think that is true for the company in question.

As far as I know, Klout has no UK/EU presence so it's not subject to these laws.

That's wrong.

This is the UK's Crown Prosecution Service advice on the matter:

http://www.cps.gov.uk/legal/h_to_k/jurisdiction/

As you can see, it sets out a long range of situations where UK jurisdiction extends outside the UK, in many cases even if the criminal behavior happened entirely outside of the UK.

I'm not a lawyer, and I don't know all the details and whether or not it'd be likely to be possible to get a court in the UK to accept jurisdiction in a case against Klout, but courts in the UK have a lot of flexibility and the fact that they are in the US by no means automatically means UK courts won't or can't claim jurisdiction.

Further, even if they were subject to EU law on this, how would any action for a breach be enforced?

The reason Facebook is being hounded is because they have an EU incorporated company.

Setting that aside: http://www.out-law.com/page-479 provides some advice on the Brussels Regulation 2001 concerning e-commerce. The B2C provisions in particular seem weighted to protect consumers, even when the supplier business is outside the EU.

However ... "In the case of disputes involving countries which are outside the scope of European law, there are a number of issues which must be considered. There are a number of international conventions dealing with choice of law, and consumer rights. If these do not set out the relevant position it is then worth checking whether the UK has entered into an agreement with the foreign jurisdiction. Any such agreement would set out the basis on which jurisdiction is determined between the countries. Failing this it would be necessary to consider the legal position under UK law, and what the courts consider to be the appropriate forum for hearing legal issues."

So it's basically a horrendous hairball of treaty law and interlocking legal systems. (And to make matters worse, the USA has a fundamentally different approach to determining jurisdiction in e-commerce, established via case law rather than a regulation aimed at defining consumer protections.)

My apologies, I regret any harm caused.

While it is true that holocaust denial is legal in the UK, that doesn't stop the UK authorities detaining people for it -- http://en.wikipedia.org/wiki/Gerald_Fredrick_T%C3%B6ben#2008...