4 ms·

"You do not have a place of business in the EU, you do not transact any business there to begin with so you are free to ignore the law. " Wrong. If you have a

• jacquesm 9y ago
  I'm not saying he's not in scope and should not comply I'm saying he can get away with ignoring it in practice, which was what he was asking about.
  • debt 9y ago
    He'd be exposed to increased risk by not complying(lawsuits, criminal action, etc.). It's based on his risk tolerance, the problem is it's hard to quantify at this point.
    • jacquesm 9y ago
      Based on a pretty thorough bit of search I can confidently say that no small (or even mid sized) US company has ever been fined or any executives detained or extradited because of breaking an EU law that would have not normally resulted in a criminal conviction. The EU tends to go after the larger entities and tends to fine rather than arrest.
      • danieltillett 9y ago
        The history of laws suggest that to rely on non-enforcement of a law is not wise. The GDPR is a good idea that has been written badly.
        • jacquesm 9y ago
          I've read most of it and I disagree that it has been written badly. As laws come it is accessible, has some pretty clearly defined goals and it is for the most part something you could easily comply with.
          • danieltillett 9y ago
            Yes the first 90% is reasonable, it is the last 10% that is a nightmare. I comply with the general intent (always have), but the law as currently written is near impossible to comply with. My feeling is this will be realised by the EU and a more rational set of guidelines will emerge.
            • jacquesm 9y ago
              Acting in good faith is the best protection you can have. In your case if there are parts that you can not comply with I would note these as clearly as possible and disclose those specifically to customers and why you can't comply with them. And another thing you could do is to get yourself a $500/hour lawyer specializing in privacy for an hour or two to tell you what to do on a sheet of letterhead.
              • danieltillett 9y ago
                Great another shake down by a lawyer :( Since we are not based in the EU and don’t have a business presence there I think I might just keep following the intent and wait for the EU to be more sensible. I really do wonder how EU companies are going to comply with all this. What an enormous waste of resources to catch a few bad actors.
                • jackfraser 9y ago
                  It really does feel like a lot of policymakers don't actually realize how onerous their requirements are, and in turn, how much this hurts smaller businesses that can't afford dedicated resources to keep up with all these issues. Of course, for the policymakers, it's a win, because as part of a rent-seeking bureaucracy, they can expand their empires as they produce more policies.
• icebraining 9y ago
  If you have a customer from the EU (...) you must comply with GPDR. Nope, you have to specifically target people in the EU: "In order to determine whether such a controller or processor is offering goods or services to data subjects who are in the Union, it should be ascertained whether it is apparent that the controller or processor envisages offering services to data subjects in one or more Member States in the Union. (...) the mere accessibility of the controller’s, processor’s or an intermediary’s website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention" https://gdpr-info.eu/recitals/no-23/ https://gdpr-info.eu/recitals/no-23/