6 ms·

I'm not a lawyer, but I would think your Argentina company can be in one of 2 states: 1. You have a subsidiary in EU, in which case that is who will get fined

I'm not a lawyer, but I would think your Argentina company can be in one of 2 states: 1. You have a subsidiary in EU, in which case that is who will get fined or will have to deal with the DPA where it is registered 2. You don't, in which case the EU can not fine you?

morgante 9y ago
I don't think any of this is entirely clear, but from my understanding it seems like the EU wants to apply GDPR even if you don't have an EU presence. In practice, I doubt that they'd get the US to enforce judgements. But it might mean that I can never risk going to Europe again lest I risk having a default judgement enforced against me for one of my businesses.
- pbhjpbhj 9y ago
  If your store front is accessible to EU based citizens then you have an EU presence.
  - dogma1138 9y ago
    No if you aren’t a legal entity in the EU you have no presence in the EU. If you would push for this the only thing that would happen is that companies would stop accepting orders from the EU. If this is going to be the definition expect a lot of store fronts to be closed to EU residents following May 25th or more likely the first time this precedence will be set in court.
    - pbhjpbhj 9y ago
      It seems a direct parallel of being tried for copyright infringement in USA when you have an offshore website - like O'Dwyer who had to bribe himself out of being extradited from UK to face charges of copyright infringement in USA. He'd never been there, didn't have servers there, and was acting legally in his jurisdiction of residence. Similar things happened with USA's actions on Silk Road, KAT, with Kim Dotcom, and I'm sure many other legal situations I'm not aware of. EU is seemingly extending logical contact to be equivalent to entry to a jurisdiction as USA appear to have established is desirable as a facet of inter-national application of law in the internet age. I much prefer the extension of jurisdiction in protection of member states citizens rights than in the service of media conglomerates.
      - dogma1138 9y ago
        Copyright is enforced via local copyright holders / representatives, trade agreements and WTO rules AKA local or international law. In no way shape or form does US law has a direct mandate outside of the US. All the examples you've given were those of actions performed through established legal channels to which all parties had and have a saying in. Extra-territorial application of the GDPR under existing frameworks (or the lack thereof) is tyrannical because you apply it to people that have had no saying in the establishment of the regulation and have no control over the interpretation and or the enforcement of it.
  - grabeh 9y ago
    The threshold for determining establishment is a low threshold however there will still be various factors taken into account in determining whether that establishment is there (for Art 3(1), and indeed whether goods and services are being offered to data subjects in the EU (for Art 3(2)). The mere availability of a website is not sufficient however to satisfy the above. Recital 23 below gives more details about those factors: *Whereas the mere accessibility of the controller's, processor's or an intermediary's website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union.*
    - pbhjpbhj 9y ago
      Yes, I should have better specified "accessible". If you ship to those customers, and make that publicly known, that appears to satisfy the intent to provide service to that country? Add on language and currency, basics of accessibility, and you're meeting the definition AFAICT.
dogma1138 9y ago
Well the GDPR doesn’t define that it applies to anyone who touches PII belonging to EU residents. The logic dictates is that it won’t apply to companies that simply dont have any legal presence in the EU. But that is not defined because again there are no exceptions. However PayPal might enforce it on you in fear of the EU going after PayPal because it’s expected that all EU companies would require GDPR compliance from their business partners overseas that perform any data processing for them or are exposed to EU PII. However how this compliance to be achieved, validated and arbitrated isn’t defined either.
- grabeh 9y ago
  Article 3 is clear about the scope of the regulation when an entity is outside the EU. It states that it will apply where that entity is offering goods/services or is monitoring data subjects in the EU. Enforcement is a separate matter but the underlying law is clear. Art 2 then contains general exceptions to the application of the regulation also.
  - dogma1138 9y ago
    It’s not clear at all by this definition if I sell guitar picks on my personal store and I’m located in say Zimbabwe I’m either forbidden form selling it to the EU or will have to comply with the GDPR which can be prohibitive to me due to local laws. The GDPR isn’t clear only anything it rewrittes agreeable concepts of localization which have much more severe applications than simply the GDPR. It also provides zero channels and infrastructure for non-EU entities to comply to the GDPR in a manner which is offered to local EU companies. If the GDPR would define its scope as if I can buy form you you must comply what stops the EU form mandating I must collect VAT on their behalf?
    - grabeh 9y ago
      Laws are not always crystal clear in each case because to do so risks making them capable of being worked around (and of course in some cases they are just badly drafted - but I don't see this so much with GDPR). Laws are then subject to interpretation by the courts and by lawyers. If you're having issues with understanding laws, then you may need an expert to guide you, as in many areas of life. Recital 23 of GDPR will give you insight into how your Zimbabwean guitar pick seller would be treated. If they are consciously offering picks to data subjects in the EU, either through specifically referencing EU data subjects, or through offering picks in EU currencies or tailoring the site for different European languages, then they are likely in scope. Conflict of laws provisions are a separate point, however in various areas, the GDPR expressly states that legal obligations override GDPR obligations in various areas. Whenever any company considers that a law may apply to them (whether as a result of operating in the country or because of the extra-territorial implications of certain laws, like GDPR) they generally take advice from local lawyers as to the implications or do independent research. The regulation is obviously available and there is a host of interpretative guidelines issued by the Article 29 Working Party which will enable anyone with enough time and desire to understand the implications of compliance. I'm not sure what kind of assistance you're looking for here? It's incumbent on the party who wants to operate in a country/provide services to users in that country to understand the relevant laws. If you disagree with the extra-territorial application of the GDPR then that's a separate issue. Bringing international tax treatment into the discussion is also not of relevance.

morgante 9y ago

I don't think any of this is entirely clear, but from my understanding it seems like the EU wants to apply GDPR even if you don't have an EU presence. In practice, I doubt that they'd get the US to enforce judgements. But it might mean that I can never risk going to Europe again lest I risk having a default judgement enforced against me for one of my businesses.

pbhjpbhj 9y ago
If your store front is accessible to EU based citizens then you have an EU presence.
- dogma1138 9y ago
  No if you aren’t a legal entity in the EU you have no presence in the EU. If you would push for this the only thing that would happen is that companies would stop accepting orders from the EU. If this is going to be the definition expect a lot of store fronts to be closed to EU residents following May 25th or more likely the first time this precedence will be set in court.
  - pbhjpbhj 9y ago
    It seems a direct parallel of being tried for copyright infringement in USA when you have an offshore website - like O'Dwyer who had to bribe himself out of being extradited from UK to face charges of copyright infringement in USA. He'd never been there, didn't have servers there, and was acting legally in his jurisdiction of residence. Similar things happened with USA's actions on Silk Road, KAT, with Kim Dotcom, and I'm sure many other legal situations I'm not aware of. EU is seemingly extending logical contact to be equivalent to entry to a jurisdiction as USA appear to have established is desirable as a facet of inter-national application of law in the internet age. I much prefer the extension of jurisdiction in protection of member states citizens rights than in the service of media conglomerates.
    - dogma1138 9y ago
      Copyright is enforced via local copyright holders / representatives, trade agreements and WTO rules AKA local or international law. In no way shape or form does US law has a direct mandate outside of the US. All the examples you've given were those of actions performed through established legal channels to which all parties had and have a saying in. Extra-territorial application of the GDPR under existing frameworks (or the lack thereof) is tyrannical because you apply it to people that have had no saying in the establishment of the regulation and have no control over the interpretation and or the enforcement of it.
- grabeh 9y ago
  The threshold for determining establishment is a low threshold however there will still be various factors taken into account in determining whether that establishment is there (for Art 3(1), and indeed whether goods and services are being offered to data subjects in the EU (for Art 3(2)). The mere availability of a website is not sufficient however to satisfy the above. Recital 23 below gives more details about those factors: *Whereas the mere accessibility of the controller's, processor's or an intermediary's website in the Union, of an email address or of other contact details, or the use of a language generally used in the third country where the controller is established, is insufficient to ascertain such intention, factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union.*
  - pbhjpbhj 9y ago
    Yes, I should have better specified "accessible". If you ship to those customers, and make that publicly known, that appears to satisfy the intent to provide service to that country? Add on language and currency, basics of accessibility, and you're meeting the definition AFAICT.

dogma1138 9y ago

Well the GDPR doesn’t define that it applies to anyone who touches PII belonging to EU residents. The logic dictates is that it won’t apply to companies that simply dont have any legal presence in the EU. But that is not defined because again there are no exceptions. However PayPal might enforce it on you in fear of the EU going after PayPal because it’s expected that all EU companies would require GDPR compliance from their business partners overseas that perform any data processing for them or are exposed to EU PII. However how this compliance to be achieved, validated and arbitrated isn’t defined either.

grabeh 9y ago
Article 3 is clear about the scope of the regulation when an entity is outside the EU. It states that it will apply where that entity is offering goods/services or is monitoring data subjects in the EU. Enforcement is a separate matter but the underlying law is clear. Art 2 then contains general exceptions to the application of the regulation also.
- dogma1138 9y ago
  It’s not clear at all by this definition if I sell guitar picks on my personal store and I’m located in say Zimbabwe I’m either forbidden form selling it to the EU or will have to comply with the GDPR which can be prohibitive to me due to local laws. The GDPR isn’t clear only anything it rewrittes agreeable concepts of localization which have much more severe applications than simply the GDPR. It also provides zero channels and infrastructure for non-EU entities to comply to the GDPR in a manner which is offered to local EU companies. If the GDPR would define its scope as if I can buy form you you must comply what stops the EU form mandating I must collect VAT on their behalf?
  - grabeh 9y ago
    Laws are not always crystal clear in each case because to do so risks making them capable of being worked around (and of course in some cases they are just badly drafted - but I don't see this so much with GDPR). Laws are then subject to interpretation by the courts and by lawyers. If you're having issues with understanding laws, then you may need an expert to guide you, as in many areas of life. Recital 23 of GDPR will give you insight into how your Zimbabwean guitar pick seller would be treated. If they are consciously offering picks to data subjects in the EU, either through specifically referencing EU data subjects, or through offering picks in EU currencies or tailoring the site for different European languages, then they are likely in scope. Conflict of laws provisions are a separate point, however in various areas, the GDPR expressly states that legal obligations override GDPR obligations in various areas. Whenever any company considers that a law may apply to them (whether as a result of operating in the country or because of the extra-territorial implications of certain laws, like GDPR) they generally take advice from local lawyers as to the implications or do independent research. The regulation is obviously available and there is a host of interpretative guidelines issued by the Article 29 Working Party which will enable anyone with enough time and desire to understand the implications of compliance. I'm not sure what kind of assistance you're looking for here? It's incumbent on the party who wants to operate in a country/provide services to users in that country to understand the relevant laws. If you disagree with the extra-territorial application of the GDPR then that's a separate issue. Bringing international tax treatment into the discussion is also not of relevance.