4 ms·

GDPR rules do not apply to YC - a US company.

by mankash666 9y ago

dyu 9y ago
I thought the legal side would work in a similar fashion as EU-US Privacy Shield?
- mankash666 9y ago
  "While joining the Privacy Shield is voluntary, once an eligible organization makes the public commitment to comply with the Framework’s requirements, the commitment will become enforceable under U.S. law" from [1]. I'm not a lawyer, but it's fairly obvious that web services built in accordance with the jurisdiction of incorporation take precedence, especially when the software/service makes no customization to appeal to the EU. Maybe one runs a blog with content critical of China, but since they're running said blog as a US corp on US soil, China cannot apply it's laws on the said blog. [1]: https://www.privacyshield.gov/Program-Overview https://www.privacyshield.gov/Program-Overview
unicornporn 9y ago
That generalization is just plain wrong. > Article 3 of the GDPR says that if you collect personal data or behavioral information from someone in an EU country, your company is subject to the requirements of the GDPR. Two points of clarification. First, the law only applies if the data subjects, as the GDPR refers to consumers, are in the EU when the data is collected. This makes sense: EU laws apply in the EU. For EU citizens outside the EU when the data is collected, the GDPR would not apply. It's more complicated than that though. Just Google and you will find some valuable information. https://www.forbes.com/sites/forbestechcouncil/2017/12/04/yes-the-gdpr-will-affect-your-u-s-based-business/ https://www.forbes.com/sites/forbestechcouncil/2017/12/04/ye...
BjoernKW 9y ago
If that US company wants to do business with people or businesses located in the EU GDPR rules absolutely do apply. Yes, providing a free website can qualify as "doing business", too, for example if the company running the website uses it to attract potential customers, which arguably is one purpose of Hacker News.

GDPR rules do not apply to YC - a US company.

dyu 9y ago

I thought the legal side would work in a similar fashion as EU-US Privacy Shield?

mankash666 9y ago
"While joining the Privacy Shield is voluntary, once an eligible organization makes the public commitment to comply with the Framework’s requirements, the commitment will become enforceable under U.S. law" from [1]. I'm not a lawyer, but it's fairly obvious that web services built in accordance with the jurisdiction of incorporation take precedence, especially when the software/service makes no customization to appeal to the EU. Maybe one runs a blog with content critical of China, but since they're running said blog as a US corp on US soil, China cannot apply it's laws on the said blog. [1]: https://www.privacyshield.gov/Program-Overview https://www.privacyshield.gov/Program-Overview

unicornporn 9y ago

That generalization is just plain wrong. > Article 3 of the GDPR says that if you collect personal data or behavioral information from someone in an EU country, your company is subject to the requirements of the GDPR. Two points of clarification. First, the law only applies if the data subjects, as the GDPR refers to consumers, are in the EU when the data is collected. This makes sense: EU laws apply in the EU. For EU citizens outside the EU when the data is collected, the GDPR would not apply. It's more complicated than that though. Just Google and you will find some valuable information. https://www.forbes.com/sites/forbestechcouncil/2017/12/04/yes-the-gdpr-will-affect-your-u-s-based-business/ https://www.forbes.com/sites/forbestechcouncil/2017/12/04/ye...

BjoernKW 9y ago

If that US company wants to do business with people or businesses located in the EU GDPR rules absolutely do apply. Yes, providing a free website can qualify as "doing business", too, for example if the company running the website uses it to attract potential customers, which arguably is one purpose of Hacker News.