3 ms·

Hmm. You just agreed with me and then disagreed me :) Again, I say this as someone who is implementing GDPR for a US-based company, and is also a EU citizen (I

Hmm. You just agreed with me and then disagreed me :) Again, I say this as someone who is implementing GDPR for a US-based company, and is also a EU citizen (Irish) and has sat more meetings with various legal groups than I care to remember (again, stress I'm not a lawyer). It is all about a companies appetite for risk and how tied the are __PHYSICALLY__ to the EU (offices/employees/parent-companies/subsidiaries). This also gets into areas of Extraterritorial Jurisdiction. Any country can claim this over any other territory they wish. But, for the claim to be effective (except by use of force), it must be agreed either with the legal authority of the country. Right now there appears to be none. No one is clearly citing any treaty with the EU as giving them this authority.

dnomad 9y ago
The GDPR goes beyond physical presence. It's strange that your legal team would not know this. See my previous comment [1]. My own understanding based on conversations with lawyers (who spoke to regulators in France) is that the law is designed to target any business that targets EU citizens. The territorial scope is formally global but obviously this is very much narrowed to businesses who (1) are pursuing EU customers and (2) are carrying out surveillance of EU customers. Surveillance does not include legitimate business needs btw, but it does include a lot of things that web sites do today without even realizing that it is surveillance (the classic example here is targeted advertising where ads are selected based on personal data). BTW it's important to understand the real enforcement vector here. It's not like you'll have "EU cops" knocking on doors in America. Nor will anybody waiting for you to get off the plane in Germany. (I've actually seen this nonsense on HN in recent days.) The very real power they do have is over banks and payment processors. It's quite possible that if you're doing business with EU customers and you have bank accounts in EU or work with EU banks or EU payment processors then they'll be able to exert significant leverage against your business. But if you have no direct contact with the EU financial system and your website is hosted in the US in English (or even if it's in French but it's clear you're pursuing US customers) there's little they could do to you even if they wanted to. [1] https://news.ycombinator.com/item?id=16956123 https://news.ycombinator.com/item?id=16956123
- donohoe 9y ago
  OK. I think we agree on the core parts. Its a question of being able to enforce and your level of risk. Right now, everyone is in "wait and see" mode on how this will play out.

dnomad 9y ago

The GDPR goes beyond physical presence. It's strange that your legal team would not know this. See my previous comment [1]. My own understanding based on conversations with lawyers (who spoke to regulators in France) is that the law is designed to target any business that targets EU citizens. The territorial scope is formally global but obviously this is very much narrowed to businesses who (1) are pursuing EU customers and (2) are carrying out surveillance of EU customers. Surveillance does not include legitimate business needs btw, but it does include a lot of things that web sites do today without even realizing that it is surveillance (the classic example here is targeted advertising where ads are selected based on personal data). BTW it's important to understand the real enforcement vector here. It's not like you'll have "EU cops" knocking on doors in America. Nor will anybody waiting for you to get off the plane in Germany. (I've actually seen this nonsense on HN in recent days.) The very real power they do have is over banks and payment processors. It's quite possible that if you're doing business with EU customers and you have bank accounts in EU or work with EU banks or EU payment processors then they'll be able to exert significant leverage against your business. But if you have no direct contact with the EU financial system and your website is hosted in the US in English (or even if it's in French but it's clear you're pursuing US customers) there's little they could do to you even if they wanted to. [1] https://news.ycombinator.com/item?id=16956123 https://news.ycombinator.com/item?id=16956123

donohoe 9y ago
OK. I think we agree on the core parts. Its a question of being able to enforce and your level of risk. Right now, everyone is in "wait and see" mode on how this will play out.