6 ms·

> Small tech owners can't fight such litigations. I am kind of baffled how this point evades so many people in this thread. Even if they could fight, why would

> Small tech owners can't fight such litigations. I am kind of baffled how this point evades so many people in this thread. Even if they could fight, why would they want to? There are lots of us with tiny things on the internet where the burden of maintenance is only slightly below the enjoyment we get making it available. Increase that burden and the costs are negative and things get shuttered. Question, if I have a small thing and don't want to preemptively concern myself with GDPR, as a non-EU site operator can I tell an information requester "no"? Might I harm my ability as a person to travel to the EU? Ignoring the standard "if you do nothing wrong you have nothing to worry about" and "the GDPR is really easy to understand" arguments, and assuming I'm not wanting to do any real work, would it be wise for me to just add known EU subnets to my firewall?

pdimitar 9y ago
In the spirit of my original comment I'd answer "yes" to your last question. If I wanted a legal career I'd pursue that -- but I don't. So I'll cut my loses. That doesn't mean I am a shady operator, it means I don't want to risk being sued for money I don't have and likely end up in jail; in EU you can't just declare bankruptcy and run free afterwards. Hobby or goodwill projects (==not turning a profit) just aren't worth that risk.
- jimktrains2 9y ago
  I thought the gdpr applied to all EU citizens, even if they're not in the EU. If so filtering IP addresses isn't enough.
  - jkaplowitz 9y ago
    It cares about the location where you're targeting your goods or services, the location where the data processor or controller is established, or the location where the data is processed. Not anyone's citizenship. Much reporting has been sloppy about this, but the more precise info is consistent.
    - jimktrains2 9y ago
      That's fairly contrary to how I've understood things. Can you provide a resource on that?
      - jkaplowitz 9y ago
        Here's one: https://www.wileyrein.com/newsroom-newsletters-item-May_2017_PIF-The_GDPRs_Reach-Material_and_Territorial_Scope_Under_Articles_2_and_3.html https://www.wileyrein.com/newsroom-newsletters-item-May_2017... I got a couple of small details wrong, but not the main point: citizenship of the data subject is irrelevant.
        jimktrains2 9y ago
        Ok, that does seem to be the consensus and a good reading of the law. However, IP blocks are still useless for the reverse reason: someone "in the Union" could be vpned through another country. (For example, I'm on vacation somewhere in the EU and VPN through my home computer to purchase something and have it delivered to my house in the US. By virtue of being in the EU at the time, at the least that specific information collected during my stay would be subject to the gdpr. How would said company ever know?
        jkaplowitz 9y ago
        If you're making a purchase for delivery to the US and using a VPN to hide your EU location, that wouldn't bring the website under the scope of the GDPR regardless of your physical location: the EU guidance talks about signs of targeting the EU for the offering of goods or services. Examples they list: use of EU languages or currencies not used in the host country, use of EU domain names, specific wording addressing an EU audience. This kind of nuance is where it's good that humans are the ones enforcing the GDPR, instead of needing a programmable rule.
        jimktrains2 9y ago
        > 2. Article 3(2): "This regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: a. The offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or b. The monitoring of their behavior as far as their behavior takes place within the Union." This doesn't seem to discuss intent at all? I mean, we could mince words about what offering a service means, but that doesn't seem productive and unless there is some other part of the law redefining this, won't make me comfortable.
  - lagadu 9y ago
    It's the other way around: it applies to people within the eu, regardless of citizenship so for example a non-eu national that resides within the eu would be covered but data provided by a eu national while living in the us wouldn't be covered.
    - jimktrains2 9y ago
      Yes, I realize that now, but since I can't wait to say I've been told so, I'll keep getting downvotes :) The recitals do sound as if it applies to citizens, however the actual definition of a data subject for a company outside the EU is someone "in the Union".
- naeemtee 9y ago
  > in EU you can't just declare bankruptcy and run free afterwards. Incorporate in the US?
  - pdimitar 9y ago
    Well, that's yet another legal black hole I don't want to fall into, but yours is still an excellent point.
tripletao 9y ago
I understand that Germany may impose criminal penalties for certain violations of the GDPR, maybe other countries too. In that case yes, you could get arrested changing planes in Frankfurt, and spend time in German prison. The probability of that of course seems very low. An EU government could try to convince your own government to enforce their fine / injunction / extradition / whatever. I don't think the USA has any treaty or other law that would compel them to. I'd guess that Trump's administration would treat the request as something between a joke and an attack on American sovereignty, so I doubt that's a major risk here. Other countries may vary. The easiest path for the EU to enforce is probably through your customers and vendors, probably starting with payment processors--like, require everyone who processes payments in the EU to transact only with people who transact only with GDPR-compliant companies. My personal guess is that everyone with a business model that depends on breaking the GDPR will move offshore, and the EU will play the same game of merchant account whack-a-mole that the USA does for online poker and such. I'd guess that the effort to enforce offshore will be big enough that only the most egregious violators will be worth the attention.
- isostatic 9y ago
  But none of this is new, as Sklyarov found out.
- guitarbill 9y ago
  Pretty sure there is an extradition treaty [0], which the US makes use of to e.g. try and get British hackers extradited [1]. Such requests can be blocked (also [1]). [0] http://ec.europa.eu/world/agreements/prepareCreateTreatiesWorkspace/treatiesGeneralData.do?step=0&redirect=true&treatyId=5461 http://ec.europa.eu/world/agreements/prepareCreateTreatiesWo... [1] http://www.bbc.com/news/uk-england-42946540 http://www.bbc.com/news/uk-england-42946540
  - tripletao 9y ago
    Yeah, but extradition treaties generally require "dual criminality", that the offense be a crime in both countries. If your offense wasn't a crime in the USA, then you probably won't get extradited; and if it was, then the USA probably has jurisdiction too (assuming you were physically here when you did it), so the USA can prosecute you itself.

pdimitar 9y ago

In the spirit of my original comment I'd answer "yes" to your last question. If I wanted a legal career I'd pursue that -- but I don't. So I'll cut my loses. That doesn't mean I am a shady operator, it means I don't want to risk being sued for money I don't have and likely end up in jail; in EU you can't just declare bankruptcy and run free afterwards. Hobby or goodwill projects (==not turning a profit) just aren't worth that risk.

jimktrains2 9y ago
I thought the gdpr applied to all EU citizens, even if they're not in the EU. If so filtering IP addresses isn't enough.
- jkaplowitz 9y ago
  It cares about the location where you're targeting your goods or services, the location where the data processor or controller is established, or the location where the data is processed. Not anyone's citizenship. Much reporting has been sloppy about this, but the more precise info is consistent.
  - jimktrains2 9y ago
    That's fairly contrary to how I've understood things. Can you provide a resource on that?
    - jkaplowitz 9y ago
      Here's one: https://www.wileyrein.com/newsroom-newsletters-item-May_2017_PIF-The_GDPRs_Reach-Material_and_Territorial_Scope_Under_Articles_2_and_3.html https://www.wileyrein.com/newsroom-newsletters-item-May_2017... I got a couple of small details wrong, but not the main point: citizenship of the data subject is irrelevant.
      - jimktrains2 9y ago
        Ok, that does seem to be the consensus and a good reading of the law. However, IP blocks are still useless for the reverse reason: someone "in the Union" could be vpned through another country. (For example, I'm on vacation somewhere in the EU and VPN through my home computer to purchase something and have it delivered to my house in the US. By virtue of being in the EU at the time, at the least that specific information collected during my stay would be subject to the gdpr. How would said company ever know?
        jkaplowitz 9y ago
        If you're making a purchase for delivery to the US and using a VPN to hide your EU location, that wouldn't bring the website under the scope of the GDPR regardless of your physical location: the EU guidance talks about signs of targeting the EU for the offering of goods or services. Examples they list: use of EU languages or currencies not used in the host country, use of EU domain names, specific wording addressing an EU audience. This kind of nuance is where it's good that humans are the ones enforcing the GDPR, instead of needing a programmable rule.
        jimktrains2 9y ago
        > 2. Article 3(2): "This regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: a. The offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or b. The monitoring of their behavior as far as their behavior takes place within the Union." This doesn't seem to discuss intent at all? I mean, we could mince words about what offering a service means, but that doesn't seem productive and unless there is some other part of the law redefining this, won't make me comfortable.
- lagadu 9y ago
  It's the other way around: it applies to people within the eu, regardless of citizenship so for example a non-eu national that resides within the eu would be covered but data provided by a eu national while living in the us wouldn't be covered.
  - jimktrains2 9y ago
    Yes, I realize that now, but since I can't wait to say I've been told so, I'll keep getting downvotes :) The recitals do sound as if it applies to citizens, however the actual definition of a data subject for a company outside the EU is someone "in the Union".
naeemtee 9y ago
> in EU you can't just declare bankruptcy and run free afterwards. Incorporate in the US?
- pdimitar 9y ago
  Well, that's yet another legal black hole I don't want to fall into, but yours is still an excellent point.

tripletao 9y ago

I understand that Germany may impose criminal penalties for certain violations of the GDPR, maybe other countries too. In that case yes, you could get arrested changing planes in Frankfurt, and spend time in German prison. The probability of that of course seems very low. An EU government could try to convince your own government to enforce their fine / injunction / extradition / whatever. I don't think the USA has any treaty or other law that would compel them to. I'd guess that Trump's administration would treat the request as something between a joke and an attack on American sovereignty, so I doubt that's a major risk here. Other countries may vary. The easiest path for the EU to enforce is probably through your customers and vendors, probably starting with payment processors--like, require everyone who processes payments in the EU to transact only with people who transact only with GDPR-compliant companies. My personal guess is that everyone with a business model that depends on breaking the GDPR will move offshore, and the EU will play the same game of merchant account whack-a-mole that the USA does for online poker and such. I'd guess that the effort to enforce offshore will be big enough that only the most egregious violators will be worth the attention.

isostatic 9y ago
But none of this is new, as Sklyarov found out.
guitarbill 9y ago
Pretty sure there is an extradition treaty [0], which the US makes use of to e.g. try and get British hackers extradited [1]. Such requests can be blocked (also [1]). [0] http://ec.europa.eu/world/agreements/prepareCreateTreatiesWorkspace/treatiesGeneralData.do?step=0&redirect=true&treatyId=5461 http://ec.europa.eu/world/agreements/prepareCreateTreatiesWo... [1] http://www.bbc.com/news/uk-england-42946540 http://www.bbc.com/news/uk-england-42946540
- tripletao 9y ago
  Yeah, but extradition treaties generally require "dual criminality", that the offense be a crime in both countries. If your offense wasn't a crime in the USA, then you probably won't get extradited; and if it was, then the USA probably has jurisdiction too (assuming you were physically here when you did it), so the USA can prosecute you itself.