7 ms·

It's quite simple. If you want to do business in the EU or with people who reside in the EU, you need to comply with the EU's regulations. Don't like it? Don't

It's quite simple. If you want to do business in the EU or with people who reside in the EU, you need to comply with the EU's regulations. Don't like it? Don't do business in/with the EU. Then you're free to ignore their frameworks, rules and regulations. They are not trying to "impose their regulations on the rest of the world", they're trying to protect the privacy of their inhabitants. That this leads to measures that need to be taken by companies doing business with (the data of) their inhabitants is a side-effect and only logical.

mbesto 9y ago
> Don't like it? Don't do business in/with the EU. Then you're free to ignore their frameworks, rules and regulations. So, should you just start blocking IPs from EU-based citizens?
- Tomte 9y ago
  Yes, if you're not willing to comply, that's exactly what you should do. OTOH it just shows your remaining customers that you're willing to do shitty things to them, as long as America is trailing in privacy legislation.
  - aleksei 9y ago
    Geoblocking IPs is not a solution, unless you're willing to let some people slip through and block people who you don't need to block. Also, not everyone connecting from a EU country is a citizen thereof.
    - robin_reala 9y ago
      GDPR doesn’t just apply to citizens of EU countries, it also applies to residents and potentially people just passing through (e.g. changing flights at an EU hub).
  - ChickeNES 9y ago
    Given that the average small-to-medium sized business in the US is unlikely to do any business outside of the US, I think we'll be fine. :)
teeray 9y ago
If a business decides to opt-out of doing business with the EU as a result, what measures do they need to take? Would a banner asking "Are you an EU citizen? Yes/No" suffice? Or would we have to use some kind of Geo IP tool? How would that defend against EU citizens using a VPN or Tor, and what would a business's liability be in that case?
- ansgri 9y ago
  Simply stop accepting European credit cards. Just like many EU online shops do not accept non-EU (or what blacklist do they have) cards. At least I haven't been able to buy an ebook without a proper European card and/or billing address.
  - aquadrop 9y ago
    GDPR is not about money, you may not accept payments at all.
    - ansgri 9y ago
      ok, but maybe combined with the notice that if you're from EU, you should leave, that would be an effective measure to show you mean it when you say 'no business with EU'.
      - zaarn 9y ago
        Users in the EU are not legally required to follow such notices until you make some form of contract with them. Which requires consent.
- ryandrake 9y ago
  What kind of business exists where it would be cheaper to drop European revenue than comply with GDPR? The major tech companies impacted by the law are already likely taking steps to comply. Is anyone seriously saying they’d rather just wave goodbye to an entire continent?
- 9y ago
trothamel 9y ago
There's a big difference between "in the EU" and "with people who reside in the EU". When I come to the EU to do business, sure, I'll comply with their laws. But it's very different to expect people who live outside the EU to respect EU laws, just because someone from the EU happens to choose to visit their website. I don't see this as any different than if someone in the EU was to visit a convenience store in the US - should the convenience store owner be bound by EU regulations in that case?
- lostcolony 9y ago
  For the same reason that downloading a song is different than stealing with a CD. Digital stuff is innately different. You aren't doing business unless you're accepting payments/selling/shipping things to people in the EU. And as with any law, if you're sufficiently small fry the EU isn't going to care about you until you actually screw up. Don't accept euros as currency. Don't offer to ship to EU nations. Done. If you do accept payments/ship/etc, unless you're a multinational, the EU probably won't care anyway, as you'll fly under the radar, unless you leak customer information. Do that in a sufficiently extravagant way, and they -will- care, but unless you have assets in the EU they can't/won't do anything about it anyway.
  - nemetroid 9y ago
    > Don't accept euros as currency. I see multiple comments mentioning this. Do American banks restrict which currencies your credit card can be charged in? As far as I've been able to tell, my bank lets me pay in any currency I'd like, and they will convert the amount to SEK before charging my account.
    - lostcolony 9y ago
      Don't offer shipping options to the EU. If dealing with digital products, allow people to purchase without creating an account, or require them to select a country as part of account creation (and prevent those selecting the EU, or don't make it an option). If the bank processes the payment, but you've collected no information, you can't run afoul of the law (since you have no information).

mbesto 9y ago

> Don't like it? Don't do business in/with the EU. Then you're free to ignore their frameworks, rules and regulations. So, should you just start blocking IPs from EU-based citizens?

Tomte 9y ago
Yes, if you're not willing to comply, that's exactly what you should do. OTOH it just shows your remaining customers that you're willing to do shitty things to them, as long as America is trailing in privacy legislation.
- aleksei 9y ago
  Geoblocking IPs is not a solution, unless you're willing to let some people slip through and block people who you don't need to block. Also, not everyone connecting from a EU country is a citizen thereof.
  - robin_reala 9y ago
    GDPR doesn’t just apply to citizens of EU countries, it also applies to residents and potentially people just passing through (e.g. changing flights at an EU hub).
- ChickeNES 9y ago
  Given that the average small-to-medium sized business in the US is unlikely to do any business outside of the US, I think we'll be fine. :)

teeray 9y ago

If a business decides to opt-out of doing business with the EU as a result, what measures do they need to take? Would a banner asking "Are you an EU citizen? Yes/No" suffice? Or would we have to use some kind of Geo IP tool? How would that defend against EU citizens using a VPN or Tor, and what would a business's liability be in that case?

ansgri 9y ago
Simply stop accepting European credit cards. Just like many EU online shops do not accept non-EU (or what blacklist do they have) cards. At least I haven't been able to buy an ebook without a proper European card and/or billing address.
- aquadrop 9y ago
  GDPR is not about money, you may not accept payments at all.
  - ansgri 9y ago
    ok, but maybe combined with the notice that if you're from EU, you should leave, that would be an effective measure to show you mean it when you say 'no business with EU'.
    - zaarn 9y ago
      Users in the EU are not legally required to follow such notices until you make some form of contract with them. Which requires consent.
ryandrake 9y ago
What kind of business exists where it would be cheaper to drop European revenue than comply with GDPR? The major tech companies impacted by the law are already likely taking steps to comply. Is anyone seriously saying they’d rather just wave goodbye to an entire continent?
9y ago

trothamel 9y ago

There's a big difference between "in the EU" and "with people who reside in the EU". When I come to the EU to do business, sure, I'll comply with their laws. But it's very different to expect people who live outside the EU to respect EU laws, just because someone from the EU happens to choose to visit their website. I don't see this as any different than if someone in the EU was to visit a convenience store in the US - should the convenience store owner be bound by EU regulations in that case?

lostcolony 9y ago
For the same reason that downloading a song is different than stealing with a CD. Digital stuff is innately different. You aren't doing business unless you're accepting payments/selling/shipping things to people in the EU. And as with any law, if you're sufficiently small fry the EU isn't going to care about you until you actually screw up. Don't accept euros as currency. Don't offer to ship to EU nations. Done. If you do accept payments/ship/etc, unless you're a multinational, the EU probably won't care anyway, as you'll fly under the radar, unless you leak customer information. Do that in a sufficiently extravagant way, and they -will- care, but unless you have assets in the EU they can't/won't do anything about it anyway.
- nemetroid 9y ago
  > Don't accept euros as currency. I see multiple comments mentioning this. Do American banks restrict which currencies your credit card can be charged in? As far as I've been able to tell, my bank lets me pay in any currency I'd like, and they will convert the amount to SEK before charging my account.
  - lostcolony 9y ago
    Don't offer shipping options to the EU. If dealing with digital products, allow people to purchase without creating an account, or require them to select a country as part of account creation (and prevent those selecting the EU, or don't make it an option). If the bank processes the payment, but you've collected no information, you can't run afoul of the law (since you have no information).