6 ms·

I have a feeling a number of more services are going to announce they are cutting of access to the EU as we get closer to the deadline.

by itg 8y ago

graeme 8y ago
I run a site targeting north americans. I get a tiny number of european visitors. Should I be cutting them off? It’s not a market I target in any way.
- actuator 8y ago
  You should anyway implement some basic stuff related to GDPR as that is good for other users as well. But it would make sense for you to cut off the access to EU citizens as full compliance is definitely a big pain and probably not worth it for just few users.
  - graeme 8y ago
    So just block all visits from IP addresses from EU countries? Or block account creation/purchases from those countries?
- tscs37 8y ago
  If your contact with EU customers is only accidental/incidental then I don't believe you're under the GDPR cover. [ https://gdpr-info.eu/recitals/no-23/ https://gdpr-info.eu/recitals/no-23/ ]
  - jimktrains2 8y ago
    That's not actually law though, only commentary. The law says anyone "in the Union" is covered, with no cut out for targeting.
    - tscs37 8y ago
      https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/ The actual law is here and it applies when you offer services or goods to people in the EU or if you monitor their behavior in the EU. The recitals are a pretty good commentary to clear up the law, the same recitals will be used by regulatory bodies and judges later on, as a guideline.
      - jimktrains2 8y ago
        > The recitals are a pretty good commentary to clear up the law, the same recitals will be used by regulatory bodies and judges later on, as a guideline. But they are not law. The law says anyone "in the Union".
        tscs37 8y ago
        That law says if you offer service or goods to anyone or monitor them while they are in the EU. It does not say "anyone in the EU" as people you aren't offering services or goods to and you aren't monitoring are not included. Afaict from summaries on court cases in germany, "offering goods or services" definitely means you have to have more than accidental contact with EU customers. Monitoring is hopefully obvious.
        jimktrains2 8y ago
        That doesn't feel wholesome to me. I'm a software engineer in the US. I don't know German case law or if German case law can/will be used in, say, Spain. The law says anyone in the EU (or is it EEA?) that you're interacting with. Article 3: > 2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: > (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or (This also seems to mean a forum with no monetary value at all, but that's another issue.)
        tscs37 8y ago

I have a feeling a number of more services are going to announce they are cutting of access to the EU as we get closer to the deadline.

by itg 8y ago

I have a feeling a number of more services are going to announce they are cutting of access to the EU as we get closer to the deadline.

graeme 8y ago

I run a site targeting north americans. I get a tiny number of european visitors. Should I be cutting them off? It’s not a market I target in any way.

actuator 8y ago
You should anyway implement some basic stuff related to GDPR as that is good for other users as well. But it would make sense for you to cut off the access to EU citizens as full compliance is definitely a big pain and probably not worth it for just few users.
- graeme 8y ago
  So just block all visits from IP addresses from EU countries? Or block account creation/purchases from those countries?
tscs37 8y ago
If your contact with EU customers is only accidental/incidental then I don't believe you're under the GDPR cover. [ https://gdpr-info.eu/recitals/no-23/ https://gdpr-info.eu/recitals/no-23/ ]
- jimktrains2 8y ago
  That's not actually law though, only commentary. The law says anyone "in the Union" is covered, with no cut out for targeting.
  - tscs37 8y ago
    https://gdpr-info.eu/art-3-gdpr/ https://gdpr-info.eu/art-3-gdpr/ The actual law is here and it applies when you offer services or goods to people in the EU or if you monitor their behavior in the EU. The recitals are a pretty good commentary to clear up the law, the same recitals will be used by regulatory bodies and judges later on, as a guideline.
    - jimktrains2 8y ago
      > The recitals are a pretty good commentary to clear up the law, the same recitals will be used by regulatory bodies and judges later on, as a guideline. But they are not law. The law says anyone "in the Union".
      - tscs37 8y ago
        That law says if you offer service or goods to anyone or monitor them while they are in the EU. It does not say "anyone in the EU" as people you aren't offering services or goods to and you aren't monitoring are not included. Afaict from summaries on court cases in germany, "offering goods or services" definitely means you have to have more than accidental contact with EU customers. Monitoring is hopefully obvious.
        jimktrains2 8y ago
        That doesn't feel wholesome to me. I'm a software engineer in the US. I don't know German case law or if German case law can/will be used in, say, Spain. The law says anyone in the EU (or is it EEA?) that you're interacting with. Article 3: > 2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: > (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or (This also seems to mean a forum with no monetary value at all, but that's another issue.)
        tscs37 8y ago