6 ms·

How would this be enforceable for companies that have their headquarters only in the USA even if they have european users? Will this also apply for citizens of

by 77pt77 9y ago

How would this be enforceable for companies that have their headquarters only in the USA even if they have european users? Will this also apply for citizens of a EU country living outside the EU?

e12e 9y ago
Trade agreements.
- danieltillett 9y ago
  Trade agreements don’t enforce laws, they just mean the countries are supposed to draft local laws that cover the action. This assumes that the GDPR is covered by trade agreement.
danieltillett 9y ago
The EU is going to send over its army and force you to comply. My understanding is the GDPR applies to residents of the EU, not just citizens, and it also applies when they are outside the EU. In practice this means it is impossible to determine if it applies unless you gather far more information than you really need from your users - “sorry we have to invade your privacy to protect your privacy”.
- 77pt77 9y ago
  So a US company providing services to a US naturalized citizen in the US that is also a dual citizen of a country in the EU makes the company liable to follow these regulations? That makes no sense. This sounds unenforceable.
  - danieltillett 9y ago
    Yep. It is worse that it can be a EU resident (non-citizen) visiting the the USA using a USA only service and the law as currently written still applies. Good luck. The next fun job is working out how to remove the data from all your backups when you get a removal request. I have taken the approach that I will comply with the general intent of the GDPR (which I did long before it existed), but not try to apply the ridiculous parts.
    - s73v3r_ 9y ago
      "Yep. It is worse that it can be a EU resident (non-citizen) visiting the the USA using a USA only service and the law as currently written still applies. Good luck." You're going to have to provide proof to back up that statement.
      - danieltillett 9y ago
        The regulations are ridiculously broad [0]. They appear to cover everyone in the world no matter where they are or what their citizenship. The EU seems to be aiming for a universal human right. "The principles of, and rules on the protection of natural persons with regard to the processing of their personal data should, whatever their nationality or residence, respect their fundamental rights and freedoms, in particular their right to the protection of personal data.” 0. http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679&from=EN http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX...
        s73v3r_ 9y ago
        That's the intro statement. That's like saying the Declaration of Independence is overly broad because it says that "all men are created equal."
        danieltillett 9y ago
        See my posts down thread for the more detailed clauses.
  - danieltillett 9y ago
    It is not citizenship, but residency. Yes the regulations make no sense and they really aren’t enforceable outside of the EU.
    - 77pt77 9y ago
      > It is not citizenship, but residency. I think it's both.
      - danieltillett 9y ago
        There is nothing in the regulations that talk about citizenship, just residency.
- TheCoelacanth 9y ago
  It does not apply to people outside of the EU. Article 3[1] is quite clear about that it applies to people in the EU. [1] https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/
  - danieltillett 9y ago
    It says it applies to the “...processing of personal data of data subjects who are in the Union…”. If someone in the EU (say a visitor) asks to have their data removed that was collected while they were outside the EU, then the controller or processor is supposed to comply. How is any business supposed to know if a user while they were in the USA of a service located in the USA will not later travel to the EU and make a data removal request while there? If the request comes from someone located in the EU then the regulations apply. The practical result is you can’t just geo ban people from the EU and this is before we get to the problem of proxies.
    - TheCoelacanth 9y ago
      You're leaving off the end of the sentence. Data collected about someone outside of the EU is not covered by GDPR even if they later enter the EU. > where the processing activities are related to: the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or the monitoring of their behaviour as far as their behaviour takes place within the Union.
      - danieltillett 9y ago
        There is an “or” not an “and” between these two clauses. It applies if you offer any goods or service, OR monitor behaviour inside the EU. It is interesting that the monitoring clause only applied if the subject is inside the EU when the monitoring is done, while the service or goods clause applies if the person is inside the EU with no requirement that the service or good was acquire or used within the EU. I can’t really think of any logical reason for this distinction. The “takes place within the Union” for one and not the other is strange.

by 77pt77 9y ago

How would this be enforceable for companies that have their headquarters only in the USA even if they have european users? Will this also apply for citizens of a EU country living outside the EU?

e12e 9y ago

Trade agreements.

danieltillett 9y ago
Trade agreements don’t enforce laws, they just mean the countries are supposed to draft local laws that cover the action. This assumes that the GDPR is covered by trade agreement.

danieltillett 9y ago

The EU is going to send over its army and force you to comply. My understanding is the GDPR applies to residents of the EU, not just citizens, and it also applies when they are outside the EU. In practice this means it is impossible to determine if it applies unless you gather far more information than you really need from your users - “sorry we have to invade your privacy to protect your privacy”.

77pt77 9y ago
So a US company providing services to a US naturalized citizen in the US that is also a dual citizen of a country in the EU makes the company liable to follow these regulations? That makes no sense. This sounds unenforceable.
- danieltillett 9y ago
  Yep. It is worse that it can be a EU resident (non-citizen) visiting the the USA using a USA only service and the law as currently written still applies. Good luck. The next fun job is working out how to remove the data from all your backups when you get a removal request. I have taken the approach that I will comply with the general intent of the GDPR (which I did long before it existed), but not try to apply the ridiculous parts.
  - s73v3r_ 9y ago
    "Yep. It is worse that it can be a EU resident (non-citizen) visiting the the USA using a USA only service and the law as currently written still applies. Good luck." You're going to have to provide proof to back up that statement.
    - danieltillett 9y ago
      The regulations are ridiculously broad [0]. They appear to cover everyone in the world no matter where they are or what their citizenship. The EU seems to be aiming for a universal human right. "The principles of, and rules on the protection of natural persons with regard to the processing of their personal data should, whatever their nationality or residence, respect their fundamental rights and freedoms, in particular their right to the protection of personal data.” 0. http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679&from=EN http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX...
      - s73v3r_ 9y ago
        That's the intro statement. That's like saying the Declaration of Independence is overly broad because it says that "all men are created equal."
        danieltillett 9y ago
        See my posts down thread for the more detailed clauses.
- danieltillett 9y ago
  It is not citizenship, but residency. Yes the regulations make no sense and they really aren’t enforceable outside of the EU.
  - 77pt77 9y ago
    > It is not citizenship, but residency. I think it's both.
    - danieltillett 9y ago
      There is nothing in the regulations that talk about citizenship, just residency.
TheCoelacanth 9y ago
It does not apply to people outside of the EU. Article 3[1] is quite clear about that it applies to people in the EU. [1] https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/
- danieltillett 9y ago
  It says it applies to the “...processing of personal data of data subjects who are in the Union…”. If someone in the EU (say a visitor) asks to have their data removed that was collected while they were outside the EU, then the controller or processor is supposed to comply. How is any business supposed to know if a user while they were in the USA of a service located in the USA will not later travel to the EU and make a data removal request while there? If the request comes from someone located in the EU then the regulations apply. The practical result is you can’t just geo ban people from the EU and this is before we get to the problem of proxies.
  - TheCoelacanth 9y ago
    You're leaving off the end of the sentence. Data collected about someone outside of the EU is not covered by GDPR even if they later enter the EU. > where the processing activities are related to: the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or the monitoring of their behaviour as far as their behaviour takes place within the Union.
    - danieltillett 9y ago
      There is an “or” not an “and” between these two clauses. It applies if you offer any goods or service, OR monitor behaviour inside the EU. It is interesting that the monitoring clause only applied if the subject is inside the EU when the monitoring is done, while the service or goods clause applies if the person is inside the EU with no requirement that the service or good was acquire or used within the EU. I can’t really think of any logical reason for this distinction. The “takes place within the Union” for one and not the other is strange.