4 ms·

No, those recitals are exactly what make my point. Numbers 23 and 24 of the accompanying recitals on that page state that, even if you are not established in t

No, those recitals are exactly what make my point. Numbers 23 and 24 of the accompanying recitals on that page state that, even if you are not established in the EU, if you profile people "within the EU", the regulation claims to apply. "Within" is a physical location, so arguing that IP block associated with request is a perfect proxy is at best a legal grey area. For example, an EU citizen could use a VPN to access your services and then send you a data request. See here for discussion: https://www.gdpr360.com/gdpr-ip-addresses-and-classification-theory-and-practice https://www.gdpr360.com/gdpr-ip-addresses-and-classification... If this seems like a low risk incident, consider that there are litigious people inside the EU (as everywhere) that may actively explore the boundaries of the law.

tzs 9y ago
Careful. You were talking about capturing data in the comment I responded to. Now you are talking about profiling. These are distinct things under GDPR, with different rules. Profiling data subjects in the EU is covered, regardless of where the processor/controller is located. If you are processing personal data but not profiling and you are not established in the union it only applies if the processing is related to the offering of goods and services to data subjects in the Union. For those who are not profiling, blocking EU IP addresses should help establish that they were not envisaging offering goods and services in the Union.
- evrydayhustling 9y ago
  I was loose in introducing the word "capture", which blurred the distinction you're making. But the OC seems to be suggesting that IP blocking is likely to be a one stop solution for someone trying to avoid GDPR details, and your replies leave open that impression. In fact, there are many ways someone might be profiling without knowing it. For example, precedent about when logging IP addresses constitutes PII is still evolving and seems to apply in cases that would be unintuitive to many US businesses: https://www.whitecase.com/people/tim-hickman https://www.whitecase.com/people/tim-hickman. And there have been arguments that geolocating based on IP might itself be data enrichment that contributes to an argument that you are profiling! Similarly, I haven't seen a clean interpretation of what constitutes offering (or clearly not offering) services to EU users, which determines application to a data processor. For example, if I offer a Portuguese translation of my site for Brazilian users, have I offered service to continental Portuguese? IANAL but nobody knows exactly where GDPR will apply yet. I think the better takeaway for someone who is trying to respond with minimum effort is: IP blocking might help you build a defense, but it might matter how you implement it and it might not be sufficient.

tzs 9y ago

Careful. You were talking about capturing data in the comment I responded to. Now you are talking about profiling. These are distinct things under GDPR, with different rules. Profiling data subjects in the EU is covered, regardless of where the processor/controller is located. If you are processing personal data but not profiling and you are not established in the union it only applies if the processing is related to the offering of goods and services to data subjects in the Union. For those who are not profiling, blocking EU IP addresses should help establish that they were not envisaging offering goods and services in the Union.

evrydayhustling 9y ago
I was loose in introducing the word "capture", which blurred the distinction you're making. But the OC seems to be suggesting that IP blocking is likely to be a one stop solution for someone trying to avoid GDPR details, and your replies leave open that impression. In fact, there are many ways someone might be profiling without knowing it. For example, precedent about when logging IP addresses constitutes PII is still evolving and seems to apply in cases that would be unintuitive to many US businesses: https://www.whitecase.com/people/tim-hickman https://www.whitecase.com/people/tim-hickman. And there have been arguments that geolocating based on IP might itself be data enrichment that contributes to an argument that you are profiling! Similarly, I haven't seen a clean interpretation of what constitutes offering (or clearly not offering) services to EU users, which determines application to a data processor. For example, if I offer a Portuguese translation of my site for Brazilian users, have I offered service to continental Portuguese? IANAL but nobody knows exactly where GDPR will apply yet. I think the better takeaway for someone who is trying to respond with minimum effort is: IP blocking might help you build a defense, but it might matter how you implement it and it might not be sufficient.