5 ms·

Yes, it's your right to block the EU users. But, if you want their money (and that's up to you to decide), you have to obey to their law, nothing new here.

by zuppy 9y ago

TomasEkeli 9y ago
It's not their money, it's if you store or process personal data about individuals in the European Economic Area (slightly larger than the EU). If you're running a Chinese site aimed at Chinese you're good. If you're running an Indonesian site aimed at Germans you need to honour the GDPR.
- x0x0 9y ago
  Probably... not really? Maybe? For starters, if you don't take payment and aren't in the EU, EU enforcement power is going to be extraordinarily limited. And even if you do require payment, if you don't have a physical nexus in the EU, it's unclear what exactly the EU can do? I think the GDPR was basically aimed at some of the scummier adtech practices and businesses like Facebook, and for those, it will be very enforceable.
  - doikor 9y ago
    > And even if you do require payment, if you don't have a physical nexus in the EU, it's unclear what exactly the EU can do? You need an EU VAT ID to accepts payments from EU citizens. So they will revoke that and then you can't accept payments from EU.
    - tatersolid 9y ago
      > You need an EU VAT ID to accepts payments from EU citizens. This was mentioned before: No, you don’t. Millions of business around the world accept transactions from EU citizens every day without collecting any VAT or having any relationship with the EU.
- yetanother1980 9y ago
  Why are you storing and processing their data if not for profit?
  - x0x0 9y ago
    personal data in the GDPR has a very expansive definition, and definitely includes things like IP. Processing likewise has an expansive definition, including collection and recording. Lots of sites will be processing and storing this data for internal analytics.
    - guitarbill 9y ago
      > Lots of sites will be processing and storing this data for internal analytics. Just because you can doesn't mean you should. And not asking that questions has got us where we are today.
    - yetanother1980 9y ago
      Did your customers consent to what is effectively someone following them round the store with a clipboard?
    - bjl 9y ago
      So just don't do internal analytics. Or, if you feel you must, ask consent first. Easy peasy.
- xxs 9y ago
  You don't need any personal data to conduct most of the business. I work in a place that would be beyond heavily affected by GDPR and I find the legislation a good change as companies should not hoard data they don't need - just in case... or just to sell.
  - Shoothe 9y ago
    Wouldn't you need personal data to accept payments? Or maybe a broker (like Stripe) would store these and the end business just a reference to payment.
    - xxs 9y ago
      You can get external ref to payment providers. Depending on the business you might need KYC and anti laundering procedures and then it's harder. However if you have some direct business and do accept payments - by all means make it secure and transparent to your customers.
    - smu 9y ago
      In lawyers terms: a payment apparently is just a contract. So you can store the data needed for the payment under that legal basis. IANAL
ysv2 9y ago
It isn't my responsibility to block them, or to take any action whatsoever to comply with another country's laws.
- athrun 9y ago
  Well, the point of the GDPR is to make you aware that collecting personal data of EU citizens requires their explicit consent. Just ask me for it, that's not a big deal, is it? If you don't, you're effectively stealing from me and I shall expect my government to go after you to the full extent of the law.
  - ysv2 9y ago
    What makes you imagine your government has any jurisdiction over me? EU citizens can choose to use services offered under other countries' laws, or not. The EU can choose to implement their own Great Firewall to block such services, or not. Frankly I don't care either way.
    - chrisper 9y ago
      >What makes you imagine your government has any jurisdiction over me? It doesn't. But once you enter Europe expect to be in trouble (if there is anything going on against you). Also forget to do business in Europe (with EU citizens). So if you don't care about these, then you don't have to care about this law.
      - ysv2 9y ago
        Right, hypothetically if I were to physically enter the EU I could expect trouble, and that's the EU's right. But in the meanwhile, if EU citizens wanted to do business with me, that's not my problem. I basically agree with your assessment.
    - athrun 9y ago
      Uh? This is already how the world works. It does not matter where you are located as long are you are transacting with EU citizens. In extreme cases of non-compliance, avenues for enforcement that have been discussed reuse existing Anti Money Laundering mechanisms: once flagged in the system, banks will simply freeze your business assets connected to EU countries and you might be arrested upon crossing any EU border.

Yes, it's your right to block the EU users. But, if you want their money (and that's up to you to decide), you have to obey to their law, nothing new here.

by zuppy 9y ago

Yes, it's your right to block the EU users. But, if you want their money (and that's up to you to decide), you have to obey to their law, nothing new here.

TomasEkeli 9y ago

It's not their money, it's if you store or process personal data about individuals in the European Economic Area (slightly larger than the EU). If you're running a Chinese site aimed at Chinese you're good. If you're running an Indonesian site aimed at Germans you need to honour the GDPR.

x0x0 9y ago
Probably... not really? Maybe? For starters, if you don't take payment and aren't in the EU, EU enforcement power is going to be extraordinarily limited. And even if you do require payment, if you don't have a physical nexus in the EU, it's unclear what exactly the EU can do? I think the GDPR was basically aimed at some of the scummier adtech practices and businesses like Facebook, and for those, it will be very enforceable.
- doikor 9y ago
  > And even if you do require payment, if you don't have a physical nexus in the EU, it's unclear what exactly the EU can do? You need an EU VAT ID to accepts payments from EU citizens. So they will revoke that and then you can't accept payments from EU.
  - tatersolid 9y ago
    > You need an EU VAT ID to accepts payments from EU citizens. This was mentioned before: No, you don’t. Millions of business around the world accept transactions from EU citizens every day without collecting any VAT or having any relationship with the EU.
yetanother1980 9y ago
Why are you storing and processing their data if not for profit?
- x0x0 9y ago
  personal data in the GDPR has a very expansive definition, and definitely includes things like IP. Processing likewise has an expansive definition, including collection and recording. Lots of sites will be processing and storing this data for internal analytics.
  - guitarbill 9y ago
    > Lots of sites will be processing and storing this data for internal analytics. Just because you can doesn't mean you should. And not asking that questions has got us where we are today.
  - yetanother1980 9y ago
    Did your customers consent to what is effectively someone following them round the store with a clipboard?
  - bjl 9y ago
    So just don't do internal analytics. Or, if you feel you must, ask consent first. Easy peasy.
xxs 9y ago
You don't need any personal data to conduct most of the business. I work in a place that would be beyond heavily affected by GDPR and I find the legislation a good change as companies should not hoard data they don't need - just in case... or just to sell.
- Shoothe 9y ago
  Wouldn't you need personal data to accept payments? Or maybe a broker (like Stripe) would store these and the end business just a reference to payment.
  - xxs 9y ago
    You can get external ref to payment providers. Depending on the business you might need KYC and anti laundering procedures and then it's harder. However if you have some direct business and do accept payments - by all means make it secure and transparent to your customers.
  - smu 9y ago
    In lawyers terms: a payment apparently is just a contract. So you can store the data needed for the payment under that legal basis. IANAL

ysv2 9y ago

It isn't my responsibility to block them, or to take any action whatsoever to comply with another country's laws.

athrun 9y ago
Well, the point of the GDPR is to make you aware that collecting personal data of EU citizens requires their explicit consent. Just ask me for it, that's not a big deal, is it? If you don't, you're effectively stealing from me and I shall expect my government to go after you to the full extent of the law.
- ysv2 9y ago
  What makes you imagine your government has any jurisdiction over me? EU citizens can choose to use services offered under other countries' laws, or not. The EU can choose to implement their own Great Firewall to block such services, or not. Frankly I don't care either way.
  - chrisper 9y ago
    >What makes you imagine your government has any jurisdiction over me? It doesn't. But once you enter Europe expect to be in trouble (if there is anything going on against you). Also forget to do business in Europe (with EU citizens). So if you don't care about these, then you don't have to care about this law.
    - ysv2 9y ago
      Right, hypothetically if I were to physically enter the EU I could expect trouble, and that's the EU's right. But in the meanwhile, if EU citizens wanted to do business with me, that's not my problem. I basically agree with your assessment.
  - athrun 9y ago
    Uh? This is already how the world works. It does not matter where you are located as long are you are transacting with EU citizens. In extreme cases of non-compliance, avenues for enforcement that have been discussed reuse existing Anti Money Laundering mechanisms: once flagged in the system, banks will simply freeze your business assets connected to EU countries and you might be arrested upon crossing any EU border.