3 ms·

I thought the gdpr applied to all EU citizens, even if they're not in the EU. If so filtering IP addresses isn't enough.

jkaplowitz 9y ago
It cares about the location where you're targeting your goods or services, the location where the data processor or controller is established, or the location where the data is processed. Not anyone's citizenship. Much reporting has been sloppy about this, but the more precise info is consistent.
- jimktrains2 9y ago
  That's fairly contrary to how I've understood things. Can you provide a resource on that?
  - jkaplowitz 9y ago
    Here's one: https://www.wileyrein.com/newsroom-newsletters-item-May_2017_PIF-The_GDPRs_Reach-Material_and_Territorial_Scope_Under_Articles_2_and_3.html https://www.wileyrein.com/newsroom-newsletters-item-May_2017... I got a couple of small details wrong, but not the main point: citizenship of the data subject is irrelevant.
    - jimktrains2 9y ago
      Ok, that does seem to be the consensus and a good reading of the law. However, IP blocks are still useless for the reverse reason: someone "in the Union" could be vpned through another country. (For example, I'm on vacation somewhere in the EU and VPN through my home computer to purchase something and have it delivered to my house in the US. By virtue of being in the EU at the time, at the least that specific information collected during my stay would be subject to the gdpr. How would said company ever know?
      - jkaplowitz 9y ago
        If you're making a purchase for delivery to the US and using a VPN to hide your EU location, that wouldn't bring the website under the scope of the GDPR regardless of your physical location: the EU guidance talks about signs of targeting the EU for the offering of goods or services. Examples they list: use of EU languages or currencies not used in the host country, use of EU domain names, specific wording addressing an EU audience. This kind of nuance is where it's good that humans are the ones enforcing the GDPR, instead of needing a programmable rule.
        jimktrains2 9y ago
        > 2. Article 3(2): "This regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: a. The offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or b. The monitoring of their behavior as far as their behavior takes place within the Union." This doesn't seem to discuss intent at all? I mean, we could mince words about what offering a service means, but that doesn't seem productive and unless there is some other part of the law redefining this, won't make me comfortable.
        jkaplowitz 9y ago
        The official EU guidance (not in the text of the GDPR) clarifies what offering means - it requires some evidence of intent to target the EU, rather than merely not blocking the EU. While that point of guidance won't have region-wide binding force of law unless the European Court of Justice rules that way, I'd be extremely surprised if any national supervising authority or court system would contradict such a document, since the official guidance's reading is clearly among the possibilities consistent with the text (admittedly not the only one) and predictability of this kind of law is key to achieving its goals. Even if they do, they wouldn't likely penalize people with more than a warning if they haven't announced their weird interpretation in advance.
lagadu 9y ago
It's the other way around: it applies to people within the eu, regardless of citizenship so for example a non-eu national that resides within the eu would be covered but data provided by a eu national while living in the us wouldn't be covered.
- jimktrains2 9y ago
  Yes, I realize that now, but since I can't wait to say I've been told so, I'll keep getting downvotes :) The recitals do sound as if it applies to citizens, however the actual definition of a data subject for a company outside the EU is someone "in the Union".

jkaplowitz 9y ago

It cares about the location where you're targeting your goods or services, the location where the data processor or controller is established, or the location where the data is processed. Not anyone's citizenship. Much reporting has been sloppy about this, but the more precise info is consistent.

jimktrains2 9y ago
That's fairly contrary to how I've understood things. Can you provide a resource on that?
- jkaplowitz 9y ago
  Here's one: https://www.wileyrein.com/newsroom-newsletters-item-May_2017_PIF-The_GDPRs_Reach-Material_and_Territorial_Scope_Under_Articles_2_and_3.html https://www.wileyrein.com/newsroom-newsletters-item-May_2017... I got a couple of small details wrong, but not the main point: citizenship of the data subject is irrelevant.
  - jimktrains2 9y ago
    Ok, that does seem to be the consensus and a good reading of the law. However, IP blocks are still useless for the reverse reason: someone "in the Union" could be vpned through another country. (For example, I'm on vacation somewhere in the EU and VPN through my home computer to purchase something and have it delivered to my house in the US. By virtue of being in the EU at the time, at the least that specific information collected during my stay would be subject to the gdpr. How would said company ever know?
    - jkaplowitz 9y ago
      If you're making a purchase for delivery to the US and using a VPN to hide your EU location, that wouldn't bring the website under the scope of the GDPR regardless of your physical location: the EU guidance talks about signs of targeting the EU for the offering of goods or services. Examples they list: use of EU languages or currencies not used in the host country, use of EU domain names, specific wording addressing an EU audience. This kind of nuance is where it's good that humans are the ones enforcing the GDPR, instead of needing a programmable rule.
      - jimktrains2 9y ago
        > 2. Article 3(2): "This regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: a. The offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or b. The monitoring of their behavior as far as their behavior takes place within the Union." This doesn't seem to discuss intent at all? I mean, we could mince words about what offering a service means, but that doesn't seem productive and unless there is some other part of the law redefining this, won't make me comfortable.
        jkaplowitz 9y ago
        The official EU guidance (not in the text of the GDPR) clarifies what offering means - it requires some evidence of intent to target the EU, rather than merely not blocking the EU. While that point of guidance won't have region-wide binding force of law unless the European Court of Justice rules that way, I'd be extremely surprised if any national supervising authority or court system would contradict such a document, since the official guidance's reading is clearly among the possibilities consistent with the text (admittedly not the only one) and predictability of this kind of law is key to achieving its goals. Even if they do, they wouldn't likely penalize people with more than a warning if they haven't announced their weird interpretation in advance.

lagadu 9y ago

It's the other way around: it applies to people within the eu, regardless of citizenship so for example a non-eu national that resides within the eu would be covered but data provided by a eu national while living in the us wouldn't be covered.

jimktrains2 9y ago
Yes, I realize that now, but since I can't wait to say I've been told so, I'll keep getting downvotes :) The recitals do sound as if it applies to citizens, however the actual definition of a data subject for a company outside the EU is someone "in the Union".