5 ms·

So, does GDPR applies to ?: - European citizens only currently living in the EU ? - European citizens worldwide ? - Everyone currently living in the EU ? As

So, does GDPR applies to ?: - European citizens only currently living in the EU ? - European citizens worldwide ? - Everyone currently living in the EU ? As a European living in the US, I'm wondering.

tzs 9y ago
See Article 3, "Territorial Scope", here [1]. It's fairly clearly written. [1] https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/
- outside1234 9y ago
  I see it written there but that doesn't mean its enforceable.
  - lenzm 9y ago
    Yeah, I'm skeptical of the EU's ability to enforce their laws on someone outside of the EU (citizen or not) with a business outside of the EU.
    - donohoe 9y ago
      Not impossible, but unlikely. There are enough businesses that have dealings in the EU that they need to be compliant.
    - lovich 9y ago
      Unless they are willing to go to war they can't do shit to people outside their jurisdiction by definition, if they had power over that place it would be part of their jurisdiction. What they can do however is turn off access to any resources being acquired in the EU. As the EU is the largest economic bloc in the world atm, and with the massive connectedness of the modern global economy, there's no way for a major internatial to flaunt the EUs laws without losing money unless the EU decides to allow it
      - tzs 9y ago
        > Unless they are willing to go to war they can't do shit to people outside their jurisdiction by definition, if they had power over that place it would be part of their jurisdiction. True, but effective jurisdiction can be much bigger than you might think, especially in civil matters. Suppose X is in country Cx, and Y is in country Cy. X travels to Cy, and while there sells some item to Y, and then goes home to Cx. X ends up getting sued in Cy over this transaction, and loses, and the court in Cy awards a civil judgment to Y. In many countries Cx, Y can bring that judgment he got in Cy to a court in Cx, and that court will decide if the court in Cy had jurisdiction. In this example, there is a good chance they will say that it did. They will say it had personal jurisdiction over X because X was in Cy for the transaction. They also will look at how the courts work in Cy to ensure that they meet similar standards for fairness as the courts in Cx. If they do the court in Cx might issue a civil judgment good in Cx to enforce Cy's judgment. (If X did not defend himself in the Cy court, the Cx court might hold its own trial to allow a defense, applying Cx procedure but using Cy substantive law). In the above example, X was actually in Cy when the transaction happened that led to a civil action in Cy. I think most countries would agree that gives Cy personal jurisdiction. If X is not actually in Cy, but conducts business with people in Cy by mail, phone, or internet it would be less clear. If you were specifically targeting Cy people with ads and shipping goods to there, there is probably a good chance Cx would decide that is sufficient. If you were not shipping physical goods and not doing anything specifically to target Cy, then Cy might not have personal jurisdiction. Anyway, the bottom line is that if you are actually doing business with people in another jurisdiction, even if you have no physical presence in that jurisdiction and no assets in that jurisdiction, it is not wise to just assume that a civil judgment against you in that jurisdiction will not be enforceable. You really need to look at exactly how your jurisdiction deals with foreign judgments.
        CiaranMcNulty 9y ago
        2 points: 1. The primary mechanism for enforcing GDPR is via regulators, not legislation. This is something of an EU/USA culture clash, but the person _complains to a regulator_ rather than lawyering up, so the courts would only be involved in extreme case 2. The jurisdiction is geographical; GDPR applies to persons physically located in the EU irrespective of nationality
    - Someone 9y ago
      I agree, but they aren’t completely powerless, either. A CEO of a company that has been convicted won’t be able to visit a conference in London, go on holiday to Paris, etc. for example. Also, any assets on accounts in the EU could be frozen or confiscated.
      - lagadu 9y ago
        Not just assets: they have ISPs block access to fb, sure you can get around that but 99% of the population won't bother. Even worse: they can have central banks block payments to fb.
        majewsky 9y ago
        I don't think they'll block facebook.com, that would produce a public outrage. The payment block sounds much more likely.
    - CiaranMcNulty 9y ago
      They have to have a business somewhere. For instance, if a UK citizen is concerned how their data is being processed by a USA company: * They complain to the UK's Information Commissioner's Office (ICO) * ICO talks to their US equivalent (I want to say it's somehow the Treasury's job), on the basis of international treaties (Data Shield legislation) * That US regulator deals with the US company and imposes fines / process changes as appropriate
    - rmc 9y ago
      In Facebook's case, it's quite easy. There is an Irish/EU company. ~25% of Facebook revenue comes from EU. They have EU employees.
- shiado 9y ago
  What is funny about this is that in order to make the nontrivial determination that a subject is in the Union Facebook has to use all available personal data they possess about the individual such as IP history (consider the possibility of a European using an American VPN which still makes them European), geolocation history, etc... But upon establishing that they are in the Union the data they used to determine they are in the Union becomes a liability whose nonexistence would have prevented Facebook from determining if a person is in the Union. In other words they need to use personal data to determine if they need to protect and limit a user's personal data. Perhaps Facebook needs to assume all users are European?
  - Sir_Substance 9y ago
    https://gdpr-info.eu/art-11-gdpr/ https://gdpr-info.eu/art-11-gdpr/
donohoe 9y ago
Not a lawyer, but I've spoken to many on the subject. Consensus appears to be that if you are physically present in the legal jurisdiction of the EU, and not a tourist, it applies. That said, its recognizes that there are situations that are impossible to account for completely (wifi on flights, VPNs, airports, etc.)
rmc 9y ago
GDPR applies to (i) people in the EU regardless of where the the company is or (ii) companies in the EU irrespective if the data comes from someone outside the EU

tzs 9y ago

See Article 3, "Territorial Scope", here [1]. It's fairly clearly written. [1] https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/

outside1234 9y ago
I see it written there but that doesn't mean its enforceable.
- lenzm 9y ago
  Yeah, I'm skeptical of the EU's ability to enforce their laws on someone outside of the EU (citizen or not) with a business outside of the EU.
  - donohoe 9y ago
    Not impossible, but unlikely. There are enough businesses that have dealings in the EU that they need to be compliant.
  - lovich 9y ago
    Unless they are willing to go to war they can't do shit to people outside their jurisdiction by definition, if they had power over that place it would be part of their jurisdiction. What they can do however is turn off access to any resources being acquired in the EU. As the EU is the largest economic bloc in the world atm, and with the massive connectedness of the modern global economy, there's no way for a major internatial to flaunt the EUs laws without losing money unless the EU decides to allow it
    - tzs 9y ago
      > Unless they are willing to go to war they can't do shit to people outside their jurisdiction by definition, if they had power over that place it would be part of their jurisdiction. True, but effective jurisdiction can be much bigger than you might think, especially in civil matters. Suppose X is in country Cx, and Y is in country Cy. X travels to Cy, and while there sells some item to Y, and then goes home to Cx. X ends up getting sued in Cy over this transaction, and loses, and the court in Cy awards a civil judgment to Y. In many countries Cx, Y can bring that judgment he got in Cy to a court in Cx, and that court will decide if the court in Cy had jurisdiction. In this example, there is a good chance they will say that it did. They will say it had personal jurisdiction over X because X was in Cy for the transaction. They also will look at how the courts work in Cy to ensure that they meet similar standards for fairness as the courts in Cx. If they do the court in Cx might issue a civil judgment good in Cx to enforce Cy's judgment. (If X did not defend himself in the Cy court, the Cx court might hold its own trial to allow a defense, applying Cx procedure but using Cy substantive law). In the above example, X was actually in Cy when the transaction happened that led to a civil action in Cy. I think most countries would agree that gives Cy personal jurisdiction. If X is not actually in Cy, but conducts business with people in Cy by mail, phone, or internet it would be less clear. If you were specifically targeting Cy people with ads and shipping goods to there, there is probably a good chance Cx would decide that is sufficient. If you were not shipping physical goods and not doing anything specifically to target Cy, then Cy might not have personal jurisdiction. Anyway, the bottom line is that if you are actually doing business with people in another jurisdiction, even if you have no physical presence in that jurisdiction and no assets in that jurisdiction, it is not wise to just assume that a civil judgment against you in that jurisdiction will not be enforceable. You really need to look at exactly how your jurisdiction deals with foreign judgments.
      - CiaranMcNulty 9y ago
        2 points: 1. The primary mechanism for enforcing GDPR is via regulators, not legislation. This is something of an EU/USA culture clash, but the person _complains to a regulator_ rather than lawyering up, so the courts would only be involved in extreme case 2. The jurisdiction is geographical; GDPR applies to persons physically located in the EU irrespective of nationality
  - Someone 9y ago
    I agree, but they aren’t completely powerless, either. A CEO of a company that has been convicted won’t be able to visit a conference in London, go on holiday to Paris, etc. for example. Also, any assets on accounts in the EU could be frozen or confiscated.
    - lagadu 9y ago
      Not just assets: they have ISPs block access to fb, sure you can get around that but 99% of the population won't bother. Even worse: they can have central banks block payments to fb.
      - majewsky 9y ago
        I don't think they'll block facebook.com, that would produce a public outrage. The payment block sounds much more likely.
  - CiaranMcNulty 9y ago
    They have to have a business somewhere. For instance, if a UK citizen is concerned how their data is being processed by a USA company: * They complain to the UK's Information Commissioner's Office (ICO) * ICO talks to their US equivalent (I want to say it's somehow the Treasury's job), on the basis of international treaties (Data Shield legislation) * That US regulator deals with the US company and imposes fines / process changes as appropriate
  - rmc 9y ago
    In Facebook's case, it's quite easy. There is an Irish/EU company. ~25% of Facebook revenue comes from EU. They have EU employees.
shiado 9y ago
What is funny about this is that in order to make the nontrivial determination that a subject is in the Union Facebook has to use all available personal data they possess about the individual such as IP history (consider the possibility of a European using an American VPN which still makes them European), geolocation history, etc... But upon establishing that they are in the Union the data they used to determine they are in the Union becomes a liability whose nonexistence would have prevented Facebook from determining if a person is in the Union. In other words they need to use personal data to determine if they need to protect and limit a user's personal data. Perhaps Facebook needs to assume all users are European?
- Sir_Substance 9y ago
  https://gdpr-info.eu/art-11-gdpr/ https://gdpr-info.eu/art-11-gdpr/

donohoe 9y ago

Not a lawyer, but I've spoken to many on the subject. Consensus appears to be that if you are physically present in the legal jurisdiction of the EU, and not a tourist, it applies. That said, its recognizes that there are situations that are impossible to account for completely (wifi on flights, VPNs, airports, etc.)

rmc 9y ago

GDPR applies to (i) people in the EU regardless of where the the company is or (ii) companies in the EU irrespective if the data comes from someone outside the EU