4 ms·

Simple question: if I just want to not make my business available to subjects that fall under GDPR regulation (so that I don't have to worry about it at all), w

Simple question: if I just want to not make my business available to subjects that fall under GDPR regulation (so that I don't have to worry about it at all), would putting up a disclaimer that you have to accept before entering the website be enough? I was thinking about something similar to how many sites that deal with alcohol content, for example, make you confirm that you are 21 or older by clicking on a button before you get access to the website. Please, refrain from sidetracking to things like "well, you wouldn't worry about it if you built everything with GDPR in mind in the first place". That's not what I was asking.

deleted 9y ago
[deleted]
isostatic 9y ago
Any company can be asked about gdpr, you can ignore it, and on the whole jurisdiction isn't going to cross boundaries (the u.s does believe it's federal laws apply globally, but it's rare they enforce it) However should you ever do business or go to an eu country you may struggle. Just like if you insult the Thai King, then go to Bangkok on holiday, you may well get arrested. Or if your company is accused of breaking the dmca and then go to the u.s on holiday you get arrested.
- filoleg 9y ago
  I understand your point, and I agree that this is what would probably happen if I just ignored it, but how would my service be breaking the rules, if it explicitly would state that it is not designed for citizens of EU and that if you click "yes", then you confirm that you are not a EU citizen? Wouldn't that be on the user for lying, in the same way it would be if an underage person visits an adult website and clicks a button that says "Confirm that I am 21+"?
  - isostatic 9y ago
    I would suspect the EU would find such a box irellevent and would deal with you like the US dealt with David Carruthers or Peter Dicks
ams6110 9y ago
If you did that, in addition to geo-blocking (or redirecting to a page "Not available in your country") I would think (but don't know) that would be enough. Then a user would need to take active steps (VPN, etc.) to sidestep your clear intent to not provide service to him, which would probably create some sort of "circumventing security" offense on his part.
- filoleg 9y ago
  Doesn't seem like geoblocking would make sense, since GDPR applies to any citizens of a country that is a EU member, not just the ones living in EU. Not arguing against your point here, but why would it be necessary to actually block the people, rather than just giving a warning, and if they accept, then it is on the user. Same as adult sites/liquor companies, their websites don't actually check your age, at the end of the day.
  - isostatic 9y ago
    If I as an EU citizen, lives in New York and have a loyalty card at Sal's Bagels on 45th street, who has taken my name as part of the process, Sal becomes subject to the GDPR, just like Sal is subject to Thai lèse majesté laws. The US wouldn't extradite him to the EU or Thailand if he didn't comply with these laws, but he'd have to be wary of traveling to either place, or doing business or storing assets. I wonder if the US will raise complaints under GATT and other WTO rules. Question for OP. If a u.s bar has a sign saying "no under 21s", and they serve a 16 year old, does that sign mean they avoid any responsibility?
  - TheCoelacanth 9y ago
    This is simply not true. GDPR applies to businesses targeting people located in the EU. Citizenship does not matter.
piotrkaminski 9y ago
I believe it should be sufficient to: - Incorporate your business outside the EU. - Have no offices in the EU. - Reside outside the EU. - Not visit the EU (?). - Not employ any EU residents. - Not target any advertisements about your business to EU countries. - Only offer your site in your local language and/or English. - Don't register your site in an EU TLD. At that point, as far as I can tell (and of course I'm not a lawyer), you have no EU presence and even the GDPR admits that it doesn't apply to you. Presumably these conditions apply to the vast majority of small businesses where dealing with random claims of extra-territorial jurisdiction is just a waste of time. This being HN, I'm sure somebody will be ecstatic to correct me if the above is wrong.
- filoleg 9y ago
  I am sorry for the tone, but this is exactly the kind of answer I didn't need. I didn't ask "how to work around GDPR without complying to it". My question was "is putting a disclaimer and having to click and confirm that you aren't a EU citizen enough to guarantee me no trouble from EU?"
  - piotrkaminski 9y ago
    I guess my implicit answer was "I think so -- in fact, you probably don't even need to do that much". (Though you want to replace "EU citizen" with "EU resident".) And of course nothing will _guarantee_ no trouble.
lagadu 9y ago
That's not enough: as long as you're storing an EU citizen's data you're liable to GDPR, it's not something you can disclaim your way out of. That said, if you have no effective presence or business within the EEA then you're out of its reach.

deleted 9y ago

[deleted]

isostatic 9y ago

Any company can be asked about gdpr, you can ignore it, and on the whole jurisdiction isn't going to cross boundaries (the u.s does believe it's federal laws apply globally, but it's rare they enforce it) However should you ever do business or go to an eu country you may struggle. Just like if you insult the Thai King, then go to Bangkok on holiday, you may well get arrested. Or if your company is accused of breaking the dmca and then go to the u.s on holiday you get arrested.

filoleg 9y ago
I understand your point, and I agree that this is what would probably happen if I just ignored it, but how would my service be breaking the rules, if it explicitly would state that it is not designed for citizens of EU and that if you click "yes", then you confirm that you are not a EU citizen? Wouldn't that be on the user for lying, in the same way it would be if an underage person visits an adult website and clicks a button that says "Confirm that I am 21+"?
- isostatic 9y ago
  I would suspect the EU would find such a box irellevent and would deal with you like the US dealt with David Carruthers or Peter Dicks

ams6110 9y ago

If you did that, in addition to geo-blocking (or redirecting to a page "Not available in your country") I would think (but don't know) that would be enough. Then a user would need to take active steps (VPN, etc.) to sidestep your clear intent to not provide service to him, which would probably create some sort of "circumventing security" offense on his part.

filoleg 9y ago
Doesn't seem like geoblocking would make sense, since GDPR applies to any citizens of a country that is a EU member, not just the ones living in EU. Not arguing against your point here, but why would it be necessary to actually block the people, rather than just giving a warning, and if they accept, then it is on the user. Same as adult sites/liquor companies, their websites don't actually check your age, at the end of the day.
- isostatic 9y ago
  If I as an EU citizen, lives in New York and have a loyalty card at Sal's Bagels on 45th street, who has taken my name as part of the process, Sal becomes subject to the GDPR, just like Sal is subject to Thai lèse majesté laws. The US wouldn't extradite him to the EU or Thailand if he didn't comply with these laws, but he'd have to be wary of traveling to either place, or doing business or storing assets. I wonder if the US will raise complaints under GATT and other WTO rules. Question for OP. If a u.s bar has a sign saying "no under 21s", and they serve a 16 year old, does that sign mean they avoid any responsibility?
- TheCoelacanth 9y ago
  This is simply not true. GDPR applies to businesses targeting people located in the EU. Citizenship does not matter.

piotrkaminski 9y ago

I believe it should be sufficient to: - Incorporate your business outside the EU. - Have no offices in the EU. - Reside outside the EU. - Not visit the EU (?). - Not employ any EU residents. - Not target any advertisements about your business to EU countries. - Only offer your site in your local language and/or English. - Don't register your site in an EU TLD. At that point, as far as I can tell (and of course I'm not a lawyer), you have no EU presence and even the GDPR admits that it doesn't apply to you. Presumably these conditions apply to the vast majority of small businesses where dealing with random claims of extra-territorial jurisdiction is just a waste of time. This being HN, I'm sure somebody will be ecstatic to correct me if the above is wrong.

filoleg 9y ago
I am sorry for the tone, but this is exactly the kind of answer I didn't need. I didn't ask "how to work around GDPR without complying to it". My question was "is putting a disclaimer and having to click and confirm that you aren't a EU citizen enough to guarantee me no trouble from EU?"
- piotrkaminski 9y ago
  I guess my implicit answer was "I think so -- in fact, you probably don't even need to do that much". (Though you want to replace "EU citizen" with "EU resident".) And of course nothing will _guarantee_ no trouble.

lagadu 9y ago

That's not enough: as long as you're storing an EU citizen's data you're liable to GDPR, it's not something you can disclaim your way out of. That said, if you have no effective presence or business within the EEA then you're out of its reach.