8 ms·

Edit: I re-read it and it looks like it only applies if you are a business with physical presence in EU or if the user is accessing from EU GDPR applies to you

Edit: I re-read it and it looks like it only applies if you are a business with physical presence in EU or if the user is accessing from EU GDPR applies to you if a EU citizen signs up from somewhere outside EU as well, but since you don't have any physical or online presence in EU I don't think they will do anything.

dangrossman 9y ago
GDPR applies only to people physically located in EU. Citizenship doesn't matter. Read Article 3, Territorial Scope.
- downandout 9y ago
  Just to clarify your point: it applies to users physically located in the EU. Fines assessed under it apply businesses that serve them anywhere in the world, which is what makes it so damned scary. The EU government has essentially declared itself the Emperor of the Internet.
  - matthewmacleod 9y ago
    Transactions with EU users should be expected to comply with EU law. What’s unusual about that?
    - downandout 9y ago
      I was just clarifying that the Internet’s new Dear Leader will be trying to reach outside its borders to enforce this law. It doesn’t just apply to companies in the EU.
      - matthewmacleod 9y ago
        If you provide services to users in the EU, then you’re “in the EU” and should be expected to meet any regulations. Not complex.
        downandout 9y ago
        Which is why many of us will be blocking EU users.
        matthewmacleod 9y ago
        Absolutely baffling. Unless you’re doing something malicious, compliance is minimal. So I guess that’s good for users?
        downandout 9y ago
        People that say this have not actually read the law, talked to “experts” about how to comply, or attempted to comply themselves. I have, and you’re just flat wrong.
        matthewmacleod 9y ago
        I have read the law, read the guidance, been through the GDPR compliance process for a data-heavy product, have talked to lawyers about the same, and my partner has drafted GDPR policies for several large tech firms. I don’t know everything, but I’m reasonably well-informed. I’m confident that compliance is: - Straightforward for any non-tech firm; - More complex but not that hard for most tech firms that handle data; - Far more complex for large organisations than small ones; - Basically only a real problem for fly-by-night tech companies that want to operate by reselling personal data. I’m not sure what your motivations are it making it seem disproportionately burdensome to comply with, but I don’t think they’re good.
        downandout 9y ago
        I won’t contue arguing with you, other than to say that what you’re saying flies in the face of everything we have been told after spending thousands of dollars on experts and independently researching the issue for hundreds of hours. If you do a simple Google search, you’ll find that we are not alone in this view, and in fact you may find yourself alone in your view that compliance is easy and costs next to nothing. Chances are quite good that if you thought it was “easy,” you’re not fully in compliance.
    - closeparen 9y ago
      Money doesn't have to change hands to create a GDPR obligation. And if you mean "HTTP transactions," it's a fundamental shift in the nature of the internet to block countries by default and enable them only after studying and complying with local regulations. Maybe it's an inevitable or even healthy shift, but it's certainly not a "usual" dynamic today.
      - seszett 9y ago
        It's certainly not a recent development to require compliance with law even for products or services that are free. Transactions do not have to involve money and in fact, the very topic of this entry on HN is about a website that was free, with transactions that did not involve money.
        closeparen 9y ago
        >It's certainly not a recent development Really? If it's a currently established practice, what are some prior examples of countries punishing foreigners on foreign soil over websites with no payments component? Maybe each jurisdiction should be the business of regulating locally-accessible websites, not just locally-hosted ones, but that's a fundamental shift in the nature of the internet. "Not available in your country" is currently an anachronism. In that world, a prudent web publisher would start out local and enable specific countries for cross-border traffic only as its legal team expands. Internet communities like this one would splinter as people get tired of clicking links they can't follow. The countries currently regulating available web content do so with network blocks, not extraterritorial enforcement actions against publishers.
        seszett 9y ago
        The end of the sentence was "not a recent development to require compliance with law even for products or services that are free". Free doesn't mean you are exempt from complying with law, that is all I'm saying. I did not comment on how this one applies to EU citizens even for foreign services. In this regard though, it is similar to US law requiring foreign banks to go through special steps when they are dealing with US citizens so that's not anything new either. Money being involved or not in my opinion is not really significant (I actually think that private data is more important and needs more protection than money) but that was not the point of my comment.
    - AlgorithmicTime 9y ago
      No, they shouldn't. If some EU yahoo calls me at my mail order product company in Michigan, it's not on me to verify that they're ordering a product legal in the EU and they've paid taxes on it. That's on them. The same applies on the internet, but even more so.
  - stef25 9y ago
    How would they have the jurisdiction to fine a one man company established say in Panama? What about companies like Alibaba?
- pkaye 9y ago
  What if the EU citizen is living a abroad?
  - dangrossman 9y ago
    The EU citizen living abroad doesn't get the benefit of this EU regulation, just like an American living in London can't assert US laws against the British pub he's drinking in.

dangrossman 9y ago

GDPR applies only to people physically located in EU. Citizenship doesn't matter. Read Article 3, Territorial Scope.

downandout 9y ago
Just to clarify your point: it applies to users physically located in the EU. Fines assessed under it apply businesses that serve them anywhere in the world, which is what makes it so damned scary. The EU government has essentially declared itself the Emperor of the Internet.
- matthewmacleod 9y ago
  Transactions with EU users should be expected to comply with EU law. What’s unusual about that?
  - downandout 9y ago
    I was just clarifying that the Internet’s new Dear Leader will be trying to reach outside its borders to enforce this law. It doesn’t just apply to companies in the EU.
    - matthewmacleod 9y ago
      If you provide services to users in the EU, then you’re “in the EU” and should be expected to meet any regulations. Not complex.
      - downandout 9y ago
        Which is why many of us will be blocking EU users.
        matthewmacleod 9y ago
        Absolutely baffling. Unless you’re doing something malicious, compliance is minimal. So I guess that’s good for users?
        downandout 9y ago
        People that say this have not actually read the law, talked to “experts” about how to comply, or attempted to comply themselves. I have, and you’re just flat wrong.
        matthewmacleod 9y ago
        I have read the law, read the guidance, been through the GDPR compliance process for a data-heavy product, have talked to lawyers about the same, and my partner has drafted GDPR policies for several large tech firms. I don’t know everything, but I’m reasonably well-informed. I’m confident that compliance is: - Straightforward for any non-tech firm; - More complex but not that hard for most tech firms that handle data; - Far more complex for large organisations than small ones; - Basically only a real problem for fly-by-night tech companies that want to operate by reselling personal data. I’m not sure what your motivations are it making it seem disproportionately burdensome to comply with, but I don’t think they’re good.
        downandout 9y ago
        I won’t contue arguing with you, other than to say that what you’re saying flies in the face of everything we have been told after spending thousands of dollars on experts and independently researching the issue for hundreds of hours. If you do a simple Google search, you’ll find that we are not alone in this view, and in fact you may find yourself alone in your view that compliance is easy and costs next to nothing. Chances are quite good that if you thought it was “easy,” you’re not fully in compliance.
  - closeparen 9y ago
    Money doesn't have to change hands to create a GDPR obligation. And if you mean "HTTP transactions," it's a fundamental shift in the nature of the internet to block countries by default and enable them only after studying and complying with local regulations. Maybe it's an inevitable or even healthy shift, but it's certainly not a "usual" dynamic today.
    - seszett 9y ago
      It's certainly not a recent development to require compliance with law even for products or services that are free. Transactions do not have to involve money and in fact, the very topic of this entry on HN is about a website that was free, with transactions that did not involve money.
      - closeparen 9y ago
        >It's certainly not a recent development Really? If it's a currently established practice, what are some prior examples of countries punishing foreigners on foreign soil over websites with no payments component? Maybe each jurisdiction should be the business of regulating locally-accessible websites, not just locally-hosted ones, but that's a fundamental shift in the nature of the internet. "Not available in your country" is currently an anachronism. In that world, a prudent web publisher would start out local and enable specific countries for cross-border traffic only as its legal team expands. Internet communities like this one would splinter as people get tired of clicking links they can't follow. The countries currently regulating available web content do so with network blocks, not extraterritorial enforcement actions against publishers.
        seszett 9y ago
        The end of the sentence was "not a recent development to require compliance with law even for products or services that are free". Free doesn't mean you are exempt from complying with law, that is all I'm saying. I did not comment on how this one applies to EU citizens even for foreign services. In this regard though, it is similar to US law requiring foreign banks to go through special steps when they are dealing with US citizens so that's not anything new either. Money being involved or not in my opinion is not really significant (I actually think that private data is more important and needs more protection than money) but that was not the point of my comment.
  - AlgorithmicTime 9y ago
    No, they shouldn't. If some EU yahoo calls me at my mail order product company in Michigan, it's not on me to verify that they're ordering a product legal in the EU and they've paid taxes on it. That's on them. The same applies on the internet, but even more so.
- stef25 9y ago
  How would they have the jurisdiction to fine a one man company established say in Panama? What about companies like Alibaba?
pkaye 9y ago
What if the EU citizen is living a abroad?
- dangrossman 9y ago
  The EU citizen living abroad doesn't get the benefit of this EU regulation, just like an American living in London can't assert US laws against the British pub he's drinking in.