6 ms·

An important one to note as it's applicable to all businesses whose customers include EU residents because it addresses the collection and processing of their p

An important one to note as it's applicable to all businesses whose customers include EU residents because it addresses the collection and processing of their personal data locally and internationally.

the_mitsuhiko 8y ago
I honestly can't wait to ask my local retailer what data they have on me based on their loyalty cards. So far they were exempt from data disclosure laws because they were not an IT company.
- StavrosK 8y ago
  Ooh, I never thought of that, but now I am very very excited about it myself.
  - amelius 8y ago
    But the answer you get might be less exciting. They might say: "We know you bought A, B, and C". What if they give you only part of what they know? How would you be able to tell if they know more? And even if you could, how would you convince authorities that something is wrong?
    - amelius 8y ago
      Also, they may have data that they just didn't "mine" yet. This may be data that they simply can't give you because it may concern you AND other people.
- tobltobs 8y ago
  I would assume that he has all the data on you, you ever gave him. What else did you do expect when you signed up for the loyalty program?
  - wlll 8y ago
    > him I think we're probably talking about national chains here. I would imagine stores will use the loyalty cards to profile users, and if they've every stored any of the profiling data then this data will be the data you will be getting.
- bennyp101 8y ago
  If you are in the UK, you can already ask for the information under the DPA.
  - outsideoflife 8y ago
    But they could charge you a reasonable fee before. Now it will be free!
- Geekette 8y ago
  Yes, grocery loyalty cards amass an inordinate amount of data on its users based on frequency and nature of use. It's interesting how the lower ticket loyalty schemes (grocery stores, etc) have arguably more powerful info than the higher-end types (air mile clubs, etc) for this reason; you can get more insight on a granular level.
- yread 8y ago
  I always lose my loyalty card from time to time (it doesn't have any loyalty advantages you just have to have it to get the discounts) and ask for a new one. I wonder if they were able to link them back together
  - amelius 8y ago
    I always switch my loyalty cards with random people I meet on the subway, etc.
  - viraptor 8y ago
    Unless you always pay cash - it should be trivial to link by the payment card number.
    - yread 8y ago
      Do they actually see a card number? Anyway, I have a couple and I have a habit of losing/breaking those as well. I'm just really bad at holding on to cards it seems
  - UncleEntity 8y ago
    I always just use the phone number approach -- give them <local-area-code> 867-5309 an when they ask "yeah, I'm Jenny". Works every time. Last time at the Walgreens they tried to give me a $5 discount but I had to know the zip code assigned to the account so was like "nah, next time."
donohoe 8y ago
I do not believe that is correct. Right now, for example, if you are a US business with no offices or employees in EU jurisdiction then there is little the EU can do if you are not GDPR compliant - regardless of whether you deal with EU traffic or not. The EU might wish their laws were global, but that doesn’t make it so. #notalawyer
- Cthulhu_ 8y ago
  You're not wrong, but, what internet company doesn't operate within the EU? If you operate in the EU, and handle EU citizen's data, you have to conform to the GDPR. I don't think there's many internet companies that would not serve the EU because of it. Although, Google did pull out of China due to the censorship demands and the like.
  - BillinghamJ 8y ago
    If you have users in the EU, but no actual physical or legal presence whatsoever within the EU, technically you "have to" comply. But if you do not do so, there will not be any consequences. As such, effectively it is not in scope and does not need to be considered. However there are cases where you might still run into trouble. For example, if you accept payments from people in the EU, you may well end up being forced to comply via the payment networks' presence in the EU.
  - donohoe 8y ago
    Hmm. You just agreed with me and then disagreed me :) Again, I say this as someone who is implementing GDPR for a US-based company, and is also a EU citizen (Irish) and has sat more meetings with various legal groups than I care to remember (again, stress I'm not a lawyer). It is all about a companies appetite for risk and how tied the are __PHYSICALLY__ to the EU (offices/employees/parent-companies/subsidiaries). This also gets into areas of Extraterritorial Jurisdiction. Any country can claim this over any other territory they wish. But, for the claim to be effective (except by use of force), it must be agreed either with the legal authority of the country. Right now there appears to be none. No one is clearly citing any treaty with the EU as giving them this authority.
dnomad 8y ago
This is not true. Just read the regulation. It's pretty clear that unless you're located in the EU or you're pursuing EU residents then the GDPR does not apply to you. Logically, it should be clear that the GDPR cannot apply to any business who an EU citizen stumbles upon and decides to buy something. The entire motivation of the GDPR is to prevent surveillance of EU residents with respect to their actions in the Union.
- Geekette 8y ago
  Mechanisms of enforcement is another discussion but the regulation clearly asserts the scope of data protection as global; it's applicable to all foreign companies processing data of EU residents, whether the companies are based in the EU or not.
- Sylos 8y ago
  It is true. Article 3.2 reads: This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: - the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or - the monitoring of their behaviour as far as their behaviour takes place within the Union.

the_mitsuhiko 8y ago

I honestly can't wait to ask my local retailer what data they have on me based on their loyalty cards. So far they were exempt from data disclosure laws because they were not an IT company.

StavrosK 8y ago
Ooh, I never thought of that, but now I am very very excited about it myself.
- amelius 8y ago
  But the answer you get might be less exciting. They might say: "We know you bought A, B, and C". What if they give you only part of what they know? How would you be able to tell if they know more? And even if you could, how would you convince authorities that something is wrong?
  - amelius 8y ago
    Also, they may have data that they just didn't "mine" yet. This may be data that they simply can't give you because it may concern you AND other people.
tobltobs 8y ago
I would assume that he has all the data on you, you ever gave him. What else did you do expect when you signed up for the loyalty program?
- wlll 8y ago
  > him I think we're probably talking about national chains here. I would imagine stores will use the loyalty cards to profile users, and if they've every stored any of the profiling data then this data will be the data you will be getting.
bennyp101 8y ago
If you are in the UK, you can already ask for the information under the DPA.
- outsideoflife 8y ago
  But they could charge you a reasonable fee before. Now it will be free!
Geekette 8y ago
Yes, grocery loyalty cards amass an inordinate amount of data on its users based on frequency and nature of use. It's interesting how the lower ticket loyalty schemes (grocery stores, etc) have arguably more powerful info than the higher-end types (air mile clubs, etc) for this reason; you can get more insight on a granular level.
yread 8y ago
I always lose my loyalty card from time to time (it doesn't have any loyalty advantages you just have to have it to get the discounts) and ask for a new one. I wonder if they were able to link them back together
- amelius 8y ago
  I always switch my loyalty cards with random people I meet on the subway, etc.
- viraptor 8y ago
  Unless you always pay cash - it should be trivial to link by the payment card number.
  - yread 8y ago
    Do they actually see a card number? Anyway, I have a couple and I have a habit of losing/breaking those as well. I'm just really bad at holding on to cards it seems
- UncleEntity 8y ago
  I always just use the phone number approach -- give them <local-area-code> 867-5309 an when they ask "yeah, I'm Jenny". Works every time. Last time at the Walgreens they tried to give me a $5 discount but I had to know the zip code assigned to the account so was like "nah, next time."

donohoe 8y ago

I do not believe that is correct. Right now, for example, if you are a US business with no offices or employees in EU jurisdiction then there is little the EU can do if you are not GDPR compliant - regardless of whether you deal with EU traffic or not. The EU might wish their laws were global, but that doesn’t make it so. #notalawyer

Cthulhu_ 8y ago
You're not wrong, but, what internet company doesn't operate within the EU? If you operate in the EU, and handle EU citizen's data, you have to conform to the GDPR. I don't think there's many internet companies that would not serve the EU because of it. Although, Google did pull out of China due to the censorship demands and the like.
- BillinghamJ 8y ago
  If you have users in the EU, but no actual physical or legal presence whatsoever within the EU, technically you "have to" comply. But if you do not do so, there will not be any consequences. As such, effectively it is not in scope and does not need to be considered. However there are cases where you might still run into trouble. For example, if you accept payments from people in the EU, you may well end up being forced to comply via the payment networks' presence in the EU.
- donohoe 8y ago
  Hmm. You just agreed with me and then disagreed me :) Again, I say this as someone who is implementing GDPR for a US-based company, and is also a EU citizen (Irish) and has sat more meetings with various legal groups than I care to remember (again, stress I'm not a lawyer). It is all about a companies appetite for risk and how tied the are __PHYSICALLY__ to the EU (offices/employees/parent-companies/subsidiaries). This also gets into areas of Extraterritorial Jurisdiction. Any country can claim this over any other territory they wish. But, for the claim to be effective (except by use of force), it must be agreed either with the legal authority of the country. Right now there appears to be none. No one is clearly citing any treaty with the EU as giving them this authority.

dnomad 8y ago

This is not true. Just read the regulation. It's pretty clear that unless you're located in the EU or you're pursuing EU residents then the GDPR does not apply to you. Logically, it should be clear that the GDPR cannot apply to any business who an EU citizen stumbles upon and decides to buy something. The entire motivation of the GDPR is to prevent surveillance of EU residents with respect to their actions in the Union.

Geekette 8y ago
Mechanisms of enforcement is another discussion but the regulation clearly asserts the scope of data protection as global; it's applicable to all foreign companies processing data of EU residents, whether the companies are based in the EU or not.
Sylos 8y ago
It is true. Article 3.2 reads: This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: - the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or - the monitoring of their behaviour as far as their behaviour takes place within the Union.